diff --git a/internal/wifi/wpasupplicant/bss.go b/internal/wifi/wpasupplicant/bss.go
index 799e9f9..ab1b5b7 100644
--- a/internal/wifi/wpasupplicant/bss.go
+++ b/internal/wifi/wpasupplicant/bss.go
@@ -137,13 +137,13 @@ func (b *BSS) GetSignal() (int16, error) {
 
 // DetermineSecurityType determines the security type based on BSS properties
 func (p *BSSProperties) DetermineSecurityType() string {
-	// Check for WPA2 (RSN)
-	if len(p.RSN) > 0 {
+	// Check for WPA2 (RSN) - need to check if KeyMgmt has actual values
+	if hasKeyManagement(p.RSN) {
 		return "psk"
 	}
 
 	// Check for WPA
-	if len(p.WPA) > 0 {
+	if hasKeyManagement(p.WPA) {
 		return "psk"
 	}
 
@@ -155,3 +155,20 @@ func (p *BSSProperties) DetermineSecurityType() string {
 	// Open network
 	return "open"
 }
+
+// hasKeyManagement checks if a WPA/RSN map contains actual key management methods
+func hasKeyManagement(secMap map[string]dbus.Variant) bool {
+	if len(secMap) == 0 {
+		return false
+	}
+
+	// Check if KeyMgmt field exists and has values
+	if keyMgmtVariant, ok := secMap["KeyMgmt"]; ok {
+		// KeyMgmt is an array of strings
+		if keyMgmt, ok := keyMgmtVariant.Value().([]string); ok {
+			return len(keyMgmt) > 0
+		}
+	}
+
+	return false
+}