Wi-Fi security

Your Wi-Fi reaches the car park. Treat it like a door.

Most Wi-Fi problems are not clever attacks. They are a shared password that never changes, guests on the same network as the accounts PC, and access points still on default settings. Here is how to fix those, what WPA3 changes, and a planner that lays out your networks.

WPA3 and Enterprise Wi-Fi details from vendor and Microsoft documentation, checked 30 October 2026.

Get a Wi-Fi review Plan your Wi-Fi 07 3114 2808

WPA2 vs WPA3
Guest and device networks
Wi-Fi planner

Reviewed by Blake Bath, General Manager, on 30 October 2026.

A technician on a step ladder fits a round ceiling Wi-Fi access point in a timber-fitted design office while a staff member works on a laptop below. — **No shared password**Enterprise Wi-Fi gives each device its own certificate. Nothing walks out the door when someone leaves.

What we find

Five Wi-Fi weaknesses we see in small offices.

None of them need special skills to exploit. All of them are cheap to fix.

A password everyone knows

The same Wi-Fi password for years, known by ex-staff, contractors and half the neighbours.

Enterprise Wi-Fi
Change on leaving
Separate guest access

Wi-Fi network planner

Lay out your Wi-Fi networks and how each is secured.

Pick what connects in your office. You get the networks to set up, the security for each, and what each one should reach.

Tell us what connects. You get a list of Wi-Fi networks, the security for each and what each one can reach.

What connects to your Wi-Fi?

Are company laptops managed?

Any Wi-Fi devices from before mid-2020?

Your Wi-Fi plan

4separate networks

Suggested Wi-Fi networks
Network	Security	Can reach
Staff	WPA2/WPA3-Enterprise with certificates (EAP-TLS) pushed by Intune	Internal network and internet
Staff phones	Same Enterprise network if enrolled, otherwise the guest network	Internet only unless enrolled
Guest	WPA3/WPA2 transition mode, or an open network with Enhanced Open (OWE)	Internet only, client isolation on, speed limited
Devices	WPA3/WPA2 transition mode, its own password	Only what each device needs; no route into staff network

Fewer networks is better for performance, so devices can share a network and still be kept apart with VLANs where your access points support it.

Get it set up

Encryption

WPA2, WPA3 and Enterprise: what each one means.

Mode	How people connect	Use it for
WPA2-Personal	One shared password	Older devices only, with a long random password
WPA3-Personal	One shared password, much harder to guess offline	Small offices and guest or device networks
WPA3/WPA2 transition mode	Both kinds of device on one network	Mixed fleets while older devices are replaced
WPA2/WPA3-Enterprise (802.1X)	Each device or person with its own certificate or login	Staff networks with managed laptops
Enhanced Open (OWE)	No password, but traffic is still encrypted	Open guest Wi-Fi

On the 6 GHz band (Wi-Fi 6E and 7), WPA3 and protected management frames are required and WPA2 is not allowed. WPA3 has been required for Wi-Fi certified devices since 1 July 2020.

Segmentation

Keep staff, guests and devices apart.

Each group gets its own network and VLAN, with firewall rules deciding what it can reach.

StaffEnterprise Wi-Fi for managed laptops. Access to internal systems and the internet.
GuestsInternet only, client isolation on, speed limited. No route to anything internal.
DevicesPrinters, TVs, cameras and smart devices. Only the connections each one needs.
PaymentsEFTPOS and POS on their own network, or wired, reaching only the payment provider.
ManagementAccess point and switch admin on a network only IT can reach.

The hardware

Securing the access points themselves.

Change the default admin loginAnd protect the cloud or controller portal with MFA.
Keep firmware currentKRACK in 2017 and FragAttacks in 2021 were Wi-Fi flaws fixed by updates. Unsupported gear stays exposed.
Turn off what you do not useWPS, remote admin from the internet, and old protocols.
Watch for rogue access pointsMost business platforms can flag unknown networks pretending to be yours.
Mount them where they cannot be unpluggedCeiling mounts, not desks or open shelves.

With Intune

Enterprise Wi-Fi with Intune: no password to share.

With Enterprise Wi-Fi, each laptop proves who it is with a certificate (EAP-TLS) instead of a password. Intune issues the certificate through a SCEP or PKCS profile and pushes the Wi-Fi settings, so staff never see or type a Wi-Fi password.

It needs a RADIUS service to check the certificates. That can be a cloud RADIUS service or one built into some access point platforms. When a laptop is lost or someone leaves, you revoke that one device and nobody else is affected.

Our view

Fix the shared password and the guest network first.

For most small offices, two changes cover the biggest risks: put guests and smart devices on their own networks, and stop using one shared password for staff Wi-Fi. Enterprise Wi-Fi is the clean way to do the second if your laptops are in Intune.

After that, keep the access points updated and managed from one place. A survey to place access points properly matters more for coverage than for security, but poor coverage pushes people onto phone hotspots and guest networks, which is its own risk.

The order

Securing office Wi-Fi in five steps.

Step 1List what connects
Staff laptops, phones, guests, devices, payments.
Step 2Split the networks
Separate networks and VLANs with firewall rules.
Step 3Pick the security
Enterprise for staff, WPA3 for the rest.
Step 4Lock down the hardware
Admin passwords, MFA, firmware, unused features off.
Step 5Check it
Test from the guest network that nothing internal is reachable.

Related guides

Wi-Fi is one part. The network is the rest.

The connection, the cabinet and the devices that use it.

Get help your way

Six ways to reach us. Pick whichever suits you.

Helpdesk hours are Monday to Friday, 8am to 5pm AEST. On Advantage and above, emergencies get a response within 1 hour and outages within 2, with 24/7 best-effort escalation.

Questions

What people ask about Wi-Fi security.

WPA2 or WPA3?

WPA3 where your devices support it. WPA3-Personal makes password guessing much slower because every guess has to be made against the live network, and it adds forward secrecy. If you have older devices, run WPA3/WPA2 transition mode so both can connect, and move to WPA3 only once they are replaced.

How do we secure our access points themselves?

Change the default admin password, manage them from one controller or cloud portal with MFA on the admin account, keep firmware up to date, turn off remote admin you do not use, and put their management on a network staff and guests cannot reach.

Is 802.11ac (Wi-Fi 5) still secure?

The standard is fine if the equipment is still getting firmware updates. Some Wi-Fi 5 access points received WPA3 through updates. If the maker has stopped releasing firmware, replace them, because known Wi-Fi flaws such as KRACK and FragAttacks were fixed in firmware.

Do we need WPA2/WPA3-Enterprise (802.1X)?

If you have more than a handful of staff and managed laptops, it is the better option. Each device or person connects with its own certificate or login, so nobody shares a password and you can cut off one device without changing everyone's. It needs a RADIUS service, and with Intune you push the Wi-Fi settings and certificates to devices automatically.

Should guest Wi-Fi be on the same network as staff?

No. Guests get their own network on its own VLAN with internet access only and client isolation turned on, so guest devices cannot see each other or anything of yours.

Does hiding the network name help?

No. Hidden networks are easy to find with free tools and they cause connection problems for your own devices. Use proper encryption and separate networks instead.

How often should we change the Wi-Fi password?

Whenever someone who knew it leaves, and whenever it may have been shared beyond the people who should have it. That is the main reason Enterprise Wi-Fi is worth it: there is no shared password to change.

Next step