Overview
Wireless testing needs a presence near the building, because the radio signal is the thing being tested. For Indian clients we decide at scoping whether a site visit is practical or whether a preconfigured test device sent to your premises and operated remotely covers the need. Offices, hospital campuses, factories and retail stores each run separate staff, guest and device networks, and we check that each one stays where it belongs.
Wireless is the one part of your network an attacker can reach without a cable or a phished click. Signal leaks into car parks, neighbouring units and the street, which makes the strength of your authentication and encryption the only thing standing between an outsider and an internal foothold. A wireless assessment needs a presence at your premises, arranged at scoping, because that is where the real signal footprint and the devices connecting to it can actually be observed.
We assess the networks you run and the ways they can be abused. For enterprise authentication we test how clients validate the network they join and whether their credentials can be captured or relayed; for pre-shared networks we test the strength of the key and the handshake. We look for rogue and evil-twin exposure, where a client can be lured onto an attacker-controlled network, and we check whether guest, corporate and operational wireless are truly separated or quietly share a path.
The result ties wireless weaknesses to business impact. A weak key or a client that trusts any network is only serious if it leads somewhere, so we show whether wireless access reaches the internal LAN and what it exposes once there. Findings are scored with CVSS v4.0 and paired with practical fixes, stronger authentication, client configuration, proper isolation, that an on-site network team can apply.
How we work with Indian clients
- Fixed-price proposals in INR, with 18% GST shown separately on every invoice
- Remote-first delivery from Ahmedabad in IST working hours; on-site work can be discussed at scoping
- Signed authorisation, an NDA on request and agreed testing windows before any activity begins
- Reports and closure evidence shaped for RBI, SEBI CSCRF, IRDAI, DPDP, ISO 27001 and PCI DSS reviews
What's included
Our approach
- Site planningWe agree locations, networks, timing and whether a visit or a remote test device will be used.
- SurveyWe map the wireless footprint, the networks present and the devices connecting.
- Authentication testingWe test encryption, authentication and client validation for each network.
- Rogue & isolationWe assess evil-twin exposure and whether network separation holds.
- Report & debriefFindings are tied to LAN impact, scored and explained to your network team.
What you receive
- Inventory of wireless networks and their exposure
- Encryption and authentication findings with CVSS v4.0 scores
- Rogue and evil-twin exposure assessment
- Isolation and segmentation test results
- Free retest of fixed issues and an attestation letter
Standards & frameworks
- PTES
- NIST SP 800-115
- OWASP WSTG
- MITRE ATT&CK
- CIS Benchmarks
- CVSS v4.0
- CERT-In Directions 2022
- RBI IT Governance Direction 2023
Frequently asked questions
Does wireless testing have to be on site?
Yes. Wireless is a physical, signal-based medium, so meaningful testing of your encryption, rogue exposure and real coverage needs a presence at your location: either a visiting tester or a preconfigured device we operate remotely. On-site work can be discussed at scoping, and sites and timings are agreed in advance.
Will you knock users off the network?
We avoid disruption wherever possible and schedule any technique that could affect connectivity with your team. Some targeted tests briefly involve specific devices we agree in advance, never a blanket disruption of your users during business hours.
What do you need from us to start?
Access to the sites in scope, a list of the wireless networks you operate, and a technical contact who knows the environment. Letting us know about any critical operational wireless beforehand means we can treat it with extra care.
Can internal and Active Directory testing be done without a site visit?
Usually, yes. We connect through a VPN you provide or a small preconfigured device that your team plugs in at the office. On-site work can be discussed at scoping where a network needs it.
Will you look at our CERT-In log and time-sync settings?
When infrastructure is in scope, we note whether logs appear to be kept for the 180 days the 2022 CERT-In Directions require and whether systems sync time with NIC or NPL servers. Treat this as a technical observation, not a legal opinion.