# Is a separate guest Wi-Fi enough for security?

It is a good first step, but only if it is really separate and not the only separation you have. A guest network with its own name but the same address range and no rules between it and the office is not separate at all; check that it is isolated and offers only internet access. It also protects only against visitors: staff phones, smart TVs and the coffee machine often end up on the office network instead. Put personal and IoT devices on the guest network or a device network, keep company laptops on a network with certificate or per-user authentication, change the guest password regularly, and do not let the guest network reach the admin interfaces of the Wi-Fi itself. Then confirm with real traffic. If the guest segment is monitored, NetSenX lists its devices on the network map and flags any connections from them to internal hosts, scanning or lateral movement, on every plan.

FAQ: [Zero trust, identity and segmentation](https://netsenx.com/en/faq/zero-trust) · https://netsenx.com/en/faq/is-a-separate-guest-wifi-enough

## Read next

- https://netsenx.com/en/detect-lateral-movement-c2-beaconing
- https://netsenx.com/en/what-is-ndr

## Related questions

- [Can someone plug a device into a free network socket in our office?](https://netsenx.com/en/faq/can-someone-plug-a-device-into-a-free-network-socket)
- [What is 802.1X, and does a small office need it?](https://netsenx.com/en/faq/what-is-802-1x-and-does-a-small-office-need-it)
- [Is multi-factor authentication enough to stop account takeover?](https://netsenx.com/en/faq/is-mfa-enough-to-stop-account-takeover)
- [Does a partial MFA rollout count for insurers and auditors?](https://netsenx.com/en/faq/does-a-partial-mfa-rollout-count)
- [Which MFA methods resist phishing?](https://netsenx.com/en/faq/which-mfa-methods-resist-phishing)