A fit-out changes the physical properties of your building, and wireless is a physical medium. New partitions absorb signal, glass reflects it, and metal storage kills it entirely. The survey that justified your access point layout described a building that no longer exists, which is why coverage complaints and quiet security problems tend to arrive together a month after everyone moves back in.
What changes when the layout changes
Signal strength is the obvious effect and rarely the important one. Where coverage drops, people improvise: a personal hotspot on a desk, a consumer access point brought in to fix a meeting room, or a laptop bridging its connection. Each of those is a rogue device on your network without malice behind it. At the other extreme, an engineer raising transmit power to fill a gap pushes your signal into the street, extending the range at which somebody can capture handshakes or stand up a convincing rogue access point in the car park.
The cabling and VLAN changes nobody documented
Fit-outs move network points, and access points get re-patched by whoever was on site. That is where segmentation quietly breaks. An access point serving the guest network can end up on a switch port carrying the corporate VLAN, and the wireless controller will keep reporting a healthy guest network while it bridges somewhere it should not. NIST’s guidance on securing wireless local area networks, SP 800-153, recommends periodic technical assessment for exactly this reason: configuration that was verified once drifts through ordinary building work.
“The best time to test wireless is a fortnight after the builders leave, once people have settled into where they actually sit. Test on the day of handover and you measure an empty building. Test a month later and you find the two access points somebody added in week three because the corner meeting room had no signal.”
William Fieldhouse, Director, Aardwolf Security Ltd
What to check once the dust settles
Walk the floor with a survey tool and compare against the design, including areas outside the building where your signal now reaches. Verify each access point is on the switch port and VLAN it should be, rather than trusting the controller’s view. Reconcile the list of devices associated with each network against what you expect to be there. Look for new SSIDs, including any left behind by contractors, and check that guest client isolation survived the changes. Most of this is a morning’s work and it catches the problems that would otherwise sit for a year.
Turning it into a repeatable trigger
Add wireless testing to the checklist for any physical change, alongside the electrical and fire checks that already happen automatically. Office moves, floor reconfigurations, mergers that bring in another company’s kit and warehouse racking changes all qualify. A wireless security assessment covers the radio layer and the segmentation behind it, and pairing it with internal network testing services answers the question that follows every wireless finding, which is what somebody could reach after connecting.
Frequently asked questions about wireless after a refit
These questions come up whenever facilities and IT plan work together.
Is a predictive survey enough?
It is a good starting point for design and it models materials rather than measuring them. Validate with a physical survey once the space is built, because plasterboard, glazing and storage rarely behave the way the model assumed.
Who should own rogue access point detection?
Whoever runs the wireless platform, with alerts going somewhere staffed. Detection that logs to a console nobody opens is the same as no detection, and fit-outs are exactly when the alerts matter most.
