Episode overview

In this episode of Built, Wired, and Secured, Alex Wargan and Michael Harrington examine a problem that often stays hidden until operations are already under pressure: shadow networks. The conversation focuses on undocumented Wi-Fi and IoT systems inside buildings, including contractor access points, tenant-installed wireless gear, vendor-managed sensors, temporary commissioning networks, and consumer-grade repeaters that were never formally inventoried or governed by facilities or IT teams.

The episode opens with a practical outage scenario. On a busy Thursday morning, tenants are preparing for a major all-hands meeting when the building network slows dramatically. Troubleshooting reveals an unapproved mesh of repeaters inside a tenant fit-out. At the same time, efforts to quarantine traffic create side effects for a vendor-managed sensor and an access control panel. The result is a long, frustrating incident where no one has a clean baseline of what devices are active in the RF environment. That framing sets the tone for the rest of the discussion: shadow networks are not just a security issue, they are an operational blind spot that increases confusion, downtime, and mean time to repair.

What counts as a shadow network?

Michael defines shadow networks broadly as any wireless or IoT stack operating in a property without being inventoried or governed by the building's IT or facilities team. That includes:

• Contractor Wi-Fi used during construction or commissioning
• Tenant IoT hubs and convenience devices
• Vendor-managed environmental sensors
• Temporary test networks
• Consumer-grade repeaters and extenders

The important point is not whether the device was installed with good intentions. In many cases, these systems are added to solve a short-term problem quickly. The issue is that they remain invisible until they interfere with production systems, complicate troubleshooting, or introduce unmanaged risk.

Where shadow networks enter the building lifecycle

A major theme in the episode is that shadow networks do not appear randomly. They tend to enter at predictable lifecycle stages.

• During construction and commissioning, teams need fast connectivity and often stand up local wireless access points to get devices configured.
• During tenant fit-out, tenants and integrators bring their own equipment to support lighting, AV, controls, and convenience devices.
• During maintenance and upgrades, vendors may add sensors or remote management capabilities without formal onboarding.

According to Michael, these systems persist because handoff processes often emphasize contracts, drawings, and turnover paperwork rather than maintaining a live inventory of RF assets. Procurement and occupancy processes may also fail to require wireless device registration, which allows temporary or one-off deployments to become permanent operational unknowns.

Why shadow networks are such an operational problem

The discussion makes clear that shadow networks affect more than internet performance. Tenants feel the impact first through degraded voice and video performance, but the downstream consequences can be broader. Badge readers, access control, and other building systems may become intermittent or unstable. Because the devices and owners are undocumented, every effort to determine scope and ownership takes longer than it should.

That delay is central to the problem. When technicians do not know what is on the air, who owns it, or what critical service it touches, mean time to repair expands quickly. Michael notes that what appears to be a simple wireless issue can turn into a full day of coordination with tenants and vendors just to map a few rogue access points.

How to discover undocumented wireless and IoT safely

One of the most practical sections of the episode covers discovery. Rather than jumping straight to disruptive controls, the recommended approach starts with low-impact visibility. Michael advises passive RF scanning as the least intrusive first step. Teams can walk floors with a spectrum analyzer or managed Wi-Fi scanner and log:

• SSIDs
• Channels
• Signal strengths
• MAC OUI information

That data can then be correlated against known inventories to identify what belongs and what does not. For traffic-level discovery, the episode recommends using consented sampled telemetry at network egress points rather than broad invasive packet capture.

Just as important is what not to do too early. Active measures such as deauthentication or channel reassignments should wait until ownership is established and a communication plan is in place. Otherwise, a team trying to enforce order may accidentally disrupt legitimate tenant services and deepen the problem.

How to prioritize findings

Not every undocumented SSID deserves the same response. The episode offers a useful impact-based model for triage.

• Highest priority goes to anything interfering with critical infrastructure, including access control, building management, or emergency communications.
• Next are networks causing capacity issues on shared channels or creating backhaul congestion.
• Lower impact consumer devices can often move into tenant outreach, education, and scheduled remediation.

This priority model reflects a practical tradeoff that comes up throughout the conversation: enforcement versus continuity. Aggressive action may solve the immediate technical issue, but it can also strain tenant relationships or disrupt legitimate operations. Soft governance may take longer, but it often preserves continuity and cooperation.

Security and resilience implications

Alex and Michael also connect shadow networks to security and incident response. Interference and reduced throughput are the obvious technical effects, but the larger risk is that unmanaged IoT expands the attack surface. Devices without enterprise controls can become entry points or pivot points for attackers. Even where no malicious behavior is involved, a missing inventory makes forensic analysis and regulatory reporting harder if an incident occurs.

In other words, undocumented wireless and IoT do not just create noise. They weaken the building's ability to respond cleanly when something goes wrong.

Governance patterns that scale

For property teams managing multiple sites, the episode highlights three governance patterns that can scale across a portfolio:

• Vendor and tenant onboarding templates that require device registration and a minimal security posture
• A baseline discovery cadence, including passive RF scans at handoff and scheduled quarterly sweeps
• A playbook for temporary networks that defines approved durations, frequency plans, and escalation paths

The conversation also stresses the value of low-friction alternatives. If contractors are likely to bring their own Wi-Fi, provide a managed temporary SSID so they do not have to improvise. Lease language and service-order language can further reinforce registration as a condition of occupancy.

Field examples from the episode

Michael shares two practical cases. In the first, contractors used wireless extenders during a tenant move-in to reach an equipment closet. Those extenders created co-channel interference that affected a neighboring tenant's VoIP system. The team used a passive scan to identify the SSIDs and signal sources, then coordinated an evening migration to a temporary managed access point. By the next morning, call quality had returned to normal.

In the second case, a vendor-managed environmental sensor mesh appeared to be causing a DHCP storm because it was beaconing at unusual intervals and consuming leases unexpectedly. Rather than taking broad action against the devices, the team used the onboarding channel to contact the vendor, confirm a firmware issue, and coordinate an update during a low-impact window. The lesson was simple: vendor coordination works better when vendors are treated as known stakeholders instead of unknown problems.

Week-one action checklist

The episode closes with a concrete checklist teams can implement immediately:

• Run an initial passive RF and SSID inventory across critical floors
• Publish a vendor and tenant onboarding template with device registration requirements and a troubleshooting contact
• Offer a managed temporary SSID for contractors and add it to the construction playbook
• Prioritize remediation by impact, protecting access control and emergency communications first
• Schedule quarterly passive sweeps and post-change scans after major fit-outs
• Create an escalation runbook so teams know who to call when undocumented devices are found

Why this episode matters

This conversation is a strong reminder that modern buildings accumulate hidden technical dependencies over time. Shadow networks usually start as convenience measures, but they become operational liabilities when there is no inventory, no governance, and no shared process for discovery and remediation. The practical value of this episode is that it does not frame the issue as a hunt for bad actors. Instead, it shows how better onboarding, better scanning, and better coordination can reduce blind spots without alienating tenants or vendors.

For facilities leaders, property operators, and IT teams supporting occupied spaces, the message is clear: if you do not have visibility into the wireless and IoT environment, you do not fully understand the resilience of the building you are operating.

Shadow Networks: The Hidden Wireless Problem Slowing Buildings Down

Modern buildings depend on more wireless systems than most operators realize. Some are planned, approved, and documented. Others appear quietly during construction, tenant move-ins, maintenance work, or vendor projects, then remain in place long after their original purpose is forgotten. In this episode of Built, Wired, and Secured, Alex Wargan and Michael Harrington focus on that second category: shadow networks, or undocumented Wi-Fi and IoT systems that create operational blind spots inside occupied properties.

The conversation is grounded in a practical building operations problem, not theory. A network slowdown during a major tenant meeting leads to a scramble. Help desk teams trace the issue to a mesh of repeaters in a tenant fit-out that the facilities team never approved. Attempts to quarantine traffic trigger side effects elsewhere. A vendor-managed sensor loses connectivity. An access control panel begins reporting intermittent failures. The outage drags on because nobody has a clear baseline of what is on the air, who owns it, or which services are connected to it.

That is the core business risk of shadow networks. They do not just add technical complexity. They slow response, increase uncertainty, and extend downtime when tenants and operators can least afford it.

What shadow networks actually are

In the episode, shadow networks are defined as any wireless or IoT stack running in a property without being inventoried or governed by the building's IT or facilities team. That can include contractor Wi-Fi used during commissioning, tenant IoT hubs, vendor-managed sensors, temporary test networks, and consumer-grade repeaters. None of those examples are inherently malicious. In fact, many are deployed to solve a real operational need quickly.

The problem is that convenience without governance creates hidden dependencies. A temporary wireless bridge becomes permanent. A vendor leaves sensors connected to its own cloud management plane. A tenant adds smart devices for environmental control or AV support. Each decision may seem small by itself, but spread across a building or campus, those decisions create a crowded RF environment and an unmanaged operational surface.

Why these networks appear so often

One of the most useful takeaways from the episode is that shadow networks tend to appear at predictable points in the project lifecycle.

During construction and commissioning, teams need connectivity fast. Devices have to be configured, tested, and brought online, so contractors often spin up local access points without waiting for a formal process. During tenant fit-out, tenants and integrators bring their own equipment to support lighting, AV, environmental monitoring, or convenience features. During maintenance or upgrades, vendors may add sensors or remote access capabilities that never go through a documented onboarding path.

They persist because handoff processes often focus on what is easy to document on paper: contracts, drawings, completion forms, and turnover packages. What gets missed is the live inventory of RF assets actually operating in the space. If procurement, onboarding, and occupancy processes do not require registration of wireless devices, undocumented infrastructure becomes part of the building by default.

The operational cost of poor visibility

The immediate effect of a shadow network is often performance-related. Overlapping channels, uncoordinated access points, and ad hoc repeaters can reduce throughput and increase packet loss. Tenants feel that in practical ways: unstable video calls, poor voice quality, and unexplained slowdowns during critical business hours.

But the larger issue is operational drag. When a problem affects badge readers, building systems, voice, video, or tenant connectivity, speed matters. If technicians do not know which devices are present, who owns them, or whether they are tied to critical functions, troubleshooting becomes a coordination exercise instead of a technical response. That drives mean time to repair up fast.

The transcript makes this point clearly. It is not unusual for a handful of rogue access points to consume an entire day of coordination with tenants and vendors simply because there is no baseline inventory to work from.

Why this is also a security issue

Shadow networks are not only an uptime problem. They also expand the unmanaged attack surface inside a property. Unmanaged IoT systems may not follow enterprise security standards. They may lack hardening, segmentation, or visibility. Even when no malicious behavior is involved, undocumented devices complicate incident response because teams cannot quickly determine what shares the air, what shares IP space, and what may have been exposed during an event.

That creates real consequences for forensic work and, if an incident becomes reportable, for regulatory and contractual response obligations. In practical terms, a missing inventory turns a controllable issue into a broader uncertainty problem.

How to discover shadow networks without creating more disruption

The episode recommends starting with low-friction discovery, not aggressive enforcement. Passive RF scanning is presented as the least intrusive first step. Teams can walk critical floors with a spectrum analyzer or managed Wi-Fi scanner and document visible SSIDs, channels, signal strength, and MAC OUI information. From there, they can compare those findings against known inventories to identify unknown or unregistered systems.

For traffic-level visibility, the conversation recommends using consented sampled telemetry at network egress points rather than broad, invasive capture. That matters because the goal is to improve visibility without trampling privacy or disrupting legitimate tenant operations.

The warning against premature active measures is equally important. Deauthentication, channel changes, and similar interventions may seem efficient, but they can interrupt legitimate services and damage relationships if ownership and communication are not established first. In occupied buildings, technical control without operational context can make things worse.

How to prioritize the response

Not every undocumented network should be treated as an emergency. The best response model is impact-based.

Systems affecting critical infrastructure should move to the top of the list immediately. If undocumented wireless is interfering with access control, building management systems, or emergency communications, it deserves urgent attention. The next tier includes networks creating capacity issues on shared channels or congesting backhaul. Lower-impact consumer devices may be better handled through tenant outreach, education, and scheduled remediation.

This approach reflects a reality many operators face: heavy-handed enforcement may remove a technical issue quickly, but it can also disrupt a tenant's business or strain an important relationship. A practical governance model balances control with continuity.

Governance that works in the real world

Michael outlines three patterns that scale well across a portfolio. First, use tenant and vendor onboarding templates that require device registration and a minimum security posture. Second, establish a discovery cadence with passive RF scans at handoff and scheduled quarterly sweeps. Third, create a playbook for temporary networks that defines approved durations, frequency plans, and escalation procedures.

Just as important, provide alternatives that make compliance easy. If contractors frequently bring their own wireless because they need connectivity fast, a managed temporary SSID can remove the incentive to improvise. If lease language or service-order language makes registration a condition of occupancy, the property team gains a stronger basis for enforcement without treating every incident as an exception.

Two field lessons worth remembering

The episode includes two quick case examples that show why process matters. In one, contractors deployed wireless extenders during a tenant move-in and created interference with another tenant's VoIP system. A passive scan identified the sources, and a coordinated evening migration to a managed temporary access point resolved the issue by the next morning. In the other, a vendor-managed environmental sensor mesh looked like a DHCP storm. Instead of broad enforcement, the team used the onboarding channel to contact the vendor, confirm a firmware problem, and apply a controlled update during a low-impact window.

Both examples point to the same lesson: visibility plus coordination beats guesswork. The goal is not simply to remove unknown devices. It is to restore operational clarity quickly and without unnecessary disruption.

A practical starting point for property teams

The checklist in the episode is refreshingly direct. Start with a passive RF and SSID inventory across critical floors. Publish a simple onboarding template for vendors and tenants. Offer a managed temporary SSID for contractors. Prioritize remediation around access control and emergency communications first. Schedule quarterly passive sweeps and post-change scans after major fit-outs. Build an escalation runbook so everyone knows who to call when an undocumented device appears.

Those steps are not complicated, but they change the operating model from reactive to prepared.

Final takeaway

Shadow networks persist because modern buildings are full of fast decisions made by many parties with different priorities. Left undocumented, those decisions become operational blind spots. This episode makes the case for a more disciplined but still practical approach: discover passively, govern consistently, offer low-friction alternatives, and prioritize according to business impact.

For teams responsible for occupied spaces, that mindset can reduce downtime, shorten incident response, and improve tenant trust. If this topic is relevant to your properties, listen to the full episode and use it as a starting point for stronger wireless and IoT governance across the spaces you manage.