Public Wi-Fi is where company data travels on someone else's network: airport lounges, client offices, hotel lobbies, the cafe downstairs. The traffic is usually encrypted by HTTPS, but the human habits around it — joining a lookalike network, opening sensitive systems before connecting protection, ignoring a certificate warning — are what turn a convenient connection into a breach. This guide gives Australian managers a short training plan that staff can actually apply the next time they work from a cafe.
Key takeaways
- Treat public Wi-Fi as untrusted: assume someone nearby can see what the network sees.
- Connect protection first, log in second — an approved hotspot or VPN before any sensitive system.
- Train staff to refuse fake hotspots; the network name is chosen by whoever set it up.
- Certificate warnings are stop signs, never clicks.
- Rehearse the sequence in training, not just a policy line — behaviour under time pressure is what counts.
Who this is for
This is for owners, office managers and MSPs at Australian organisations between roughly 5 and 200 staff, especially teams with sales, field or hybrid roles who work away from the office several days a week. No IT department required — the plan fits a 30-minute session and a pocket card.
Why this matters
The Australian Signals Directorate's advice on connecting to public Wi-Fi and hotspots is direct: public hotspots are convenient but risky, and users should take specific precautions before connecting. The risks are not exotic — an attacker can run a hotspot with a convincing name, intercept unencrypted traffic, or capture login attempts to a fake portal.
What makes public Wi-Fi dangerous in 2026 is less the network and more the rush around it. A salesperson at the airport 20 minutes before a flight opens the invoicing portal before connecting protection. A consultant joins "Airport_Free_WiFi" because it appears first in the list. These are habit failures, and habits are trainable.
The training plan
Step 1: Set the rule — protection before login
Give staff one sentence they can remember: on public Wi-Fi, connect your protection before you touch anything that matters.
- Where policy allows a mobile hotspot, that is the first choice — a hotspot you own is a network you control.
- Where staff must use venue Wi-Fi, they connect the company VPN first and confirm it is active before opening email, finance systems or client files.
- sensitive-but-not-critical browsing (reading the news) is the only thing that can wait without protection.
Expected outcome: every staff member can state the sequence unprompted.
Step 2: Teach the fake hotspot tell
An attacker's hotspot costs nothing and can be named anything: "Free_Airport_WiFi", "Cafe_Guest_5G", even the venue's real name with a digit appended.
- Train staff to verify the network name against the venue's official signage or ask staff, not to trust the strongest signal.
- If two networks carry the same name, treat both as suspect and use the hotspot instead.
- The phone's "captive portal" login page is where fake networks harvest credentials — a portal asking for an email and password that the real venue never requires is the tell.
Expected outcome: staff can describe one fake-hotspot scenario in their own words.
Step 3: Rehearse the certificate warning
A browser certificate warning on a trusted site over public Wi-Fi can mean someone is intercepting traffic. The training instruction is absolute: never click through. Close the tab, disconnect, and either move to the hotspot or report it. This is the one behaviour where a five-second click does the damage, so it deserves its own drill in the session.
Expected outcome: zero staff members describe clicking through a warning as normal.
Step 4: Apply the same discipline to links and files
Public Wi-Fi does not change what a phishing email is, but it changes the environment: a staff member rushing between terminals is exactly the person who clicks first and thinks later. Pair this session with your phishing simulations programme so the pause-and-report habit is rehearsed in both places.
- Remind staff that a public network is a bad place to open unexpected attachments — they can wait 30 minutes.
- Turn off file sharing and AirDrop-style sharing on laptops and phones before working publicly.
- Lock the screen whenever stepping away, even in a client's meeting room.
Step 5: Handle devices leaving and returning
Public Wi-Fi sessions are also a good checkpoint for device hygiene:
- "Forget this network" after each session, so the laptop does not auto-join a similarly named clone next month.
- Keep the operating system and browser current — the ACSC treats device updates as the easiest way to cut cyber risk, and updates matter most on devices that roam.
- Record any device that behaved oddly on a public network (slow, unexpected prompts, dropped sessions) and report it the same day.
Step 6: Make it a pocket card, not a policy
One page, laminated or in the phone's notes app:
- Hotspot first, venue Wi-Fi second.
- VPN on before anything sensitive.
- Verify the network name against signage.
- Never click through a certificate warning.
- Forget the network afterwards.
Five lines outperforms a two-page acceptable-use policy, because it is the version staff can actually retrieve from memory at an airport gate.
What to avoid
- The "HTTPS makes it safe" message. Encryption protects the traffic, not the session — a fake portal still collects the password a user types into it.
- Banning public Wi-Fi outright. Field teams will work from cafes regardless; the useful outcome is a rehearsed sequence, not an ignored rule.
- One-time training. Run the 15-minute refresher every six months, and after every incident.
- Assuming the VPN covers everything. A VPN protects the traffic path; it does not stop a staff member typing a password into a fake portal or ignoring a warning.
FAQ
Is public Wi-Fi safe for work in 2026? It is safe enough for sensitive work only with protection connected first — a personal hotspot or company VPN — and with staff trained against fake hotspots and certificate warnings.
Does HTTPS make public Wi-Fi safe? No. HTTPS encrypts traffic between you and a site, but a fake network portal can still capture login credentials, and an intercepted session on an unencrypted service is exposed.
Is a phone hotspot better than cafe Wi-Fi? Yes. A hotspot you own is a network you control, which removes the fake-hotspot and interception risks entirely. Where reception allows, make it the default.
What should staff do if they see a certificate warning? Stop, close the tab, disconnect from the network and report it. Never click through a certificate warning on a trusted site.
Should we provide a VPN for all staff? For anyone who works away from the office on sensitive systems, yes. It is one of the cheapest controls available relative to the risk it removes.
What is a captive portal scam? A fake Wi-Fi login page that asks for credentials or payment details before granting access. Verify the network against official signage and never enter a work password into a Wi-Fi portal.
How does this connect to phishing training? It is the same behaviour at a different layer: pause, verify, report. Running both through the same reporting habit is what makes either one stick.
How often should we retrain? A 15-minute refresher every six months, plus the pocket card, keeps the sequence retrievable under time pressure.
One last thing
The cheapest test of your training is a question in the lift: "you are at the airport, 20 minutes to boarding, invoice portal — what do you open first?" A staff member who answers "the VPN" has learned it. Anyone who answers "the invoice portal" gives you next quarter's training topic for free.