The short answer
- Use WPA3, and sign staff in individually. A single shared Wi-Fi password is the weakest point of most office networks.
- Keep guests and gadgets apart. Visitors, TVs, cameras and smart devices belong on their own networks, away from company data.
- Remember the signal leaves the building. Anyone in the parking lot or the next suite can try to connect.
- Watch for devices you did not install. Business access points can detect rogue and look-alike networks automatically.
Wi-Fi does not stop at your walls
Every other part of the network needs a cable and a way into the building. Wi-Fi does not. It reaches the hallway, the suite next door and the cars outside, which makes it the easiest place for someone to try their luck. The illustration below shows the weak spots we find most often when we survey an office.
The threats that matter, and the defence for each
| Threat | How it happens | The defence |
|---|---|---|
| A shared password gets out | Written on a whiteboard, given to a contractor, kept by an ex-employee | Individual sign-in for staff, and a guest network with a password that changes |
| Guests reach company systems | Visitors join the same network as the file server | A separate, isolated guest network with internet access only |
| Smart devices become a way in | TVs, cameras and thermostats with weak security sit beside laptops | A device network that can reach only what it needs |
| A rogue access point | Someone plugs a cheap router into a network jack | Rogue detection on business access points, and unused jacks switched off |
| A look-alike network | An attacker broadcasts your network name to capture logins | Certificate-based staff sign-in, and alerts for spoofed network names |
| Old encryption | WEP, WPA or TKIP still enabled for an old scanner | WPA3, or WPA2 with AES at minimum, and old devices replaced or isolated |
| Default settings on access points | Factory passwords, WPS switched on, firmware years old | Changed credentials, WPS off and a firmware schedule |
Encryption and sign-in
Encryption protects what travels over the air. Sign-in decides who gets on in the first place. Both have improved a great deal, and most offices are still using the weakest options.
| Option | How people connect | Verdict for business |
|---|---|---|
| WPA2-Personal | One shared password for everyone | Acceptable for guests only |
| WPA3-Personal | Shared password, but much harder to crack offline | Good for guest and device networks |
| WPA2 or WPA3-Enterprise | Each person signs in with their own work account, or the laptop uses a certificate | Best for staff |
| WEP, WPA or TKIP | Legacy settings left on for old devices | Switch off |
Enterprise sign-in has a practical advantage beyond security: there is no shared password to change when someone leaves. Their Wi-Fi access ends with their account. Company laptops managed by Microsoft Intune can receive a certificate that connects them automatically, so staff never type a Wi-Fi password at all. Networks using the newer 6 GHz band require WPA3, which is one more reason to move.
One network for each kind of device
Separating networks limits the damage when something goes wrong. A compromised smart TV on its own network cannot reach the accounting server. Most offices need three or four networks, no more, because every extra network name adds background traffic and slows everyone down.
- Staff: company laptops and phones, with individual sign-in.
- Guest: internet only, with devices unable to see each other, and a password that changes regularly.
- Devices: printers, TVs, displays, cameras and sensors, allowed to reach only the systems they serve.
- Voice: Wi-Fi phones, where used, given priority so calls stay clear.
The separation is enforced by the firewall, not by the Wi-Fi alone, so the rules between networks need as much care as the networks themselves.
Finding devices that should not be there
Most businesses have no idea how many devices are on their network. The number is usually higher than expected, and a few are often unknown. These are the tools that close the gap.
- Turn on rogue detection. Business access points from Fortinet, Cisco Meraki and Ubiquiti UniFi can scan the air for unknown access points and for networks pretending to be yours, and alert you.
- Review connected devices monthly. The Wi-Fi controller lists every device. Unknown names and manufacturers are worth a question.
- Disable unused network jacks. A switch port that is switched off cannot have a rogue router plugged into it.
- Use individual sign-in. With Enterprise authentication, every connection is tied to a named person or a managed device, so strangers stand out.
- Expect randomized addresses. Modern phones and laptops change their hardware address per network, so identify devices by sign-in rather than by address lists.
Closing the weak spots
- Lower the transmit power on access points near outside walls. It improves roaming inside and reduces how far the signal carries outside.
- Switch off WPS, the push-button pairing feature, which has long had known weaknesses.
- Change default administrator passwords and keep access point management on its own network, never reachable from guest Wi-Fi.
- Update firmware on a schedule. Access points and controllers have had serious flaws, and Ubiquiti, for one, issued several critical fixes in 2026.
- Retire consumer gear. Mesh kits and range extenders from a store rarely support separate networks, enterprise sign-in or rogue detection.
If your Wi-Fi was never designed for business use, our business Wi-Fi installation service plans it properly from your floor plan. We also look after UniFi and Meraki networks, and a vulnerability assessment will find the old access point nobody remembers.