While i do not claim to be an expert in all things security based to like to think that i have a good grounded knowledge of what is acceptable and what is not in regards to digital security.

After giving some general advice on internal network security i was advised by a company that physical access based attacks (I.E attacker has access to internal network) are unrealistic and are considered out of scope.

I was informed that due to the company having a guest wifi system which is in a DMZ its not a problem for them. The main oversight that they don't seem to understand or accept is that from outside the office you can see in plain sight the private wifi password stuck to the walls around the office - As so many people constantly forget them.

Without lighting fires i am really struggling to get them to accept that this is horrible practice and they are really opening themselves up if an attacked or compromised system was connected to their private wifi.

Example: Customer brings device into office for a meeting, sees a publicly advertised wifi password in the meeting room and continues to connect to the wifi. Customers machine is compromised and now has full access to the private internal network containing business critical data, and a ton of personal data due to bad domain policies.

Any suggestions on the best way to approach this situation?