Wireless work at NIIS 9 is not a checklist of encryption suites. It is an assessment of who can hear, who can speak, and which identities are minted from that conversation. Enterprise Wi-Fi, consumer BLE, cellular attachment, and thin proprietary links all fail in related ways: an implicit assumption that the local radio neighborhood is benign.
What is in scope
- Wi-Fi estates, including guest segmentation, identity-based pre-shared keys, and the operational reality of onboarding.
- Bluetooth Classic and BLE product ecosystems: pairing, GATT surfaces, mesh, and accessories that outlive the phone that commissioned them.
- Cellular edge behavior as it affects devices and applications: attach, paging, and the identifiers still exposed in mixed 4G/5G environments.
- Undocumented or thinly documented ISM-band protocols, where the specification is the captured air.
How the work is shaped
A wireless assessment starts with a map of emitters and a story about the adversary’s proximity, equipment, and patience. From there the practice looks for control-plane lies: forged beacons, cloned accessories, downgrade paths, and state machines that believe a previous pairing forever.
Encryption on a link does not decide who was allowed onto the link.
Findings are written as impact on assets, not as a museum of packet captures. If a relay or impersonation matters, the report shows the trust decision that made it matter.