A rogue access point (rogue AP) is any WiFi device connected to your internal network without IT approval. It can be a mini router an employee brings from home, or a device deliberately planted by an attacker.
Why are rogue APs dangerous?
- They create a back door around your firewall, allowing access to the internal network from outside the building.
- They often run default settings, weak passwords or no encryption at all.
- They are hard to spot with standard network management tools.
Common types
- Internal rogue AP: a router plugged directly into a company network port.
- Evil Twin: a fake AP that copies your network name to steal credentials.
- Phone hotspot: a company laptop connected to two networks at once, bridging data out.
How to protect your organization
The most effective approach is continuous WiFi spectrum monitoring with dedicated sensors, correlated with the MAC tables on your switches to determine which AP is actually wired into your network — and automatically blocking the matching port.
A $15 router can bypass a million-dollar firewall.