A laptop in the car park beacons your corporate SSID — what does hunting and containing it cost?

## What detection can actually see A wireless intrusion detection capability compares what the air contains against what your infrastructure is. Your corporate SSID transmitted from a radio whose identifier is not in your inventory is the signal. Signal strength across several sensors gives a rough bearing, which is what turns an alert into a walk. Everything about that depends on coverage. A radio the sensors cannot hear does not exist to you, and the estate this leaf describes — branch sites with one or two access points on consumer broadband, plus a shared floor where neighbouring radios overlap yours — has enormous gaps. So the first honest statement is a direction-of-claim one: the absence of a rogue alert is not evidence that no rogue operated. It is evidence that none was heard. ## The three ways to pay for detection **Off-channel scanning on serving radios.** The access points that carry your clients periodically leave the serving channel to listen elsewhere. This is the cheapest option because you already own the hardware, and the cost is airtime: clients on that radio get nothing during the excursion. It is invisible on file transfers and very visible on real-time traffic, so the scan aggressiveness knob is a direct trade of detection latency against call quality. Sites running voice or handheld scanners are exactly the sites that cannot afford aggressive scanning, and are often the sites with the least other coverage. **Dedicated monitor radios or sensors.** A radio that never serves clients scans continuously and costs nothing in airtime. It costs capital, per site, and it has to be mounted, cabled and maintained. Getting that funded for a flagship office is easy and for two hundred branches is not, so coverage ends up shaped like the budget rather than like the risk. **Feet.** A scheduled walk with a handheld survey covers what no sensor does, including the car park. It costs staff time on a cadence somebody has to own and defend when the quarter is busy, and it only samples — a laptop that runs for forty minutes on a Tuesday is not there when you walk on Thursday. Most estates end up with a mix, and the mix should be stated explicitly: which sites have continuous coverage, which have opportunistic scanning, which have neither and are covered only by a walk cadence. ## Why containment is the expensive answer Automatic containment works by disrupting the associations between the rogue and its clients. Three problems follow. First, **collateral**. Identification is by network name and radio identifier, and on a shared multi-tenant floor a mis-scoped containment rule reaches a neighbouring tenant's clients. You have then caused an outage in someone else's business from your own equipment. Second, **legality and contract**. Deliberately disrupting radio transmissions you do not own is treated as interference in several jurisdictions, and regulators have penalised venue operators for blocking guests' own wireless. Building leases for shared floors frequently say something about it too. This is not a setting an engineer should switch on alone; it needs someone who can accept the consequence. Third, and most importantly, **it treats the symptom**. The rogue in the car park is only valuable because some devices complete an authentication exchange with anything that announces the right name. Containing this one changes nothing about that. The fix is in the supplicant profile, and rogue hunting exists to tell you the failure is being exploited — not to be the defence. ## How to size the programme honestly Set the cadence from what you can staff, not from what you would like: continuous sensing where it is funded, a stated scan aggressiveness elsewhere with the airtime cost written down, and a walk frequency per site tier. Then record the coverage gaps as gaps rather than as zero findings. A quiet quarter from a programme with no sensors at half the estate is not a result, and reporting it as one is how these programmes get quietly defunded — and then genuinely stop working.