Plan Wi-Fi security around WPA3, Protected Management Frames and Enhanced Open instead of legacy modes

The Wi-Fi Alliance makes WPA3 mandatory for Wi-Fi CERTIFIED devices and requires Protected Management Frames on all new certified devices. WPA3 disallows outdated protocols, and Wi-Fi Enhanced Open encrypts traffic on guest networks without a shared passphrase.

Source facts

The Wi-Fi Alliance says WPA3 is mandatory for Wi-Fi CERTIFIED devices. WPA3-Personal users receive increased protections from password guessing attempts, WPA3-Enterprise offers higher-grade security protocols for sensitive data networks, and WPA3 networks disallow outdated legacy protocols and require Protected Management Frames.

Protected Management Frames extend protection to unicast management action frames against eavesdropping and forging and to multicast management frames against forging, and PMF is required for all new certified devices.

Wi-Fi Enhanced Open provides unauthenticated data encryption on networks that would otherwise be open, with no public passphrases to maintain or share, and interoperates with legacy networks, even those using a captive portal.

Applicability

Use this when designing or refreshing wireless networks. Older clients and some embedded devices may not support WPA3 or Enhanced Open, so plan transition settings and device replacement rather than switching every network at once.

DSE recommendation

DSE recommends setting WPA3 with Protected Management Frames as the target for every SSID and replacing open guest networks with Wi-Fi Enhanced Open where clients support it. Inventory clients that only support older security, move them to a separate, restricted network until they are replaced, and require WPA3 support in the purchasing criteria for new wireless cameras, locks and scanners.

Verification

Export each SSID’s security mode and PMF setting from the wireless controller and compare it with the target. Survey connected clients by security type each quarter, and track the count of legacy-only devices down to zero.

Official reference

Wi-Fi Alliance — Wi-Fi security technologies. Reviewed October 18, 2026.