We Know Public Wi-Fi Is Risky. Why Don’t We Act Accordingly?

Public Wi-Fi is a good example of a recurring problem in cybersecurity: people often know what they should do, yet fail to act accordingly in a particular situation.

Knowing the recommendations does not guarantee safe behaviour

The security recommendations are well known:

• do not connect to suspicious networks,
• verify the network name before connecting,
• do not transmit sensitive data over an untrusted connection,
• use a VPN,
• disable automatic connections to open networks.

On paper, this makes sense. In real life, however, users face more immediate concerns: they need to send a file quickly, read a message, complete their work, conserve mobile data or simply get online.

What our research showed

In one of our studies, we therefore examined the difference between awareness of risk and actual security behaviour. The questionnaire survey showed that a large proportion of respondents recognised public Wi-Fi as a security risk. That is the good news.

The less encouraging finding is that recognising the risk does not automatically lead to protective behaviour. Even users who acknowledge the danger often fail to use a VPN regularly, do not verify the network name or leave automatic connection enabled.

Risk does not arise only from a conscious human decision

The research also included careful field observation of exposure to rogue access points.

Such observations show that risk is not created solely by a conscious decision made by the user. It also arises from the way devices and networks are designed.

What this means for organisations and public institutions

When an organisation relies only on training, it places too much of the responsibility for security on the individual. In every situation, the user is expected to assess the network name correctly, understand the risk, use a VPN and resist the attraction of convenience. This is a fragile security strategy.

In practice, awareness initiatives need to be supported by technical and organisational measures:

• secure default settings,
• automatic VPN use,
• device management,
• context-dependent access restrictions,
• clear and understandable communication of risks.

A broader lesson about the human factor

Research into public Wi-Fi is therefore not only about wireless networks. It offers a broader lesson about the human factor in cybersecurity. Knowledge matters, but it is not enough.

Users make decisions under the influence of convenience, time pressure, habit and the options available to them. A security system that fails to account for these factors will repeatedly encounter the same problem.