A computer-implemented method for securing a wireless mesh network of beacon devices, comprising: receiving, by a master beacon device and from a plurality of servant beacon devices (110a, 110b) in the mesh network, survey data comprising, for each of the servant beacon devices, a beacon device identifier and one of path loss information, a received signal strength indicator, a received channel power indicator, a time of arrival, or a round trip time, of proximate servant beacon devices detected by each servant beacon device; transmitting, by the master beacon device and to each of the plurality of servant beacon devices, enrolment data comprising beacon device identifiers and the corresponding one of path loss values, received signal strength indicators, received channel power indicators, times of arrival, or round trip times, of proximate beacon devices to servant beacon devices, wherein the enrolment data is based on the received survey data, wherein the enrolment data may be retransmitted by servant beacon devices within the mesh network to reach other recipient servant beacon devices; receiving, by the master beacon device, authentication data from the plurality of servant beacon devices in the mesh network, the authentication data comprising beacon device identifiers for servant beacon devices and the one of path loss information, the received signal strength indicator, the received channel power indicator, the time of arrival, or the round trip time, detected by servant beacon devices of proximate servant beacon devices; comparing, by the master beacon device, a first virtual map comprising the one of the path loss data, the received signal strength indicator, the received channel power indicator, the time of arrival, or the round trip time, from the received survey data to a second virtual map comprising the one of the path loss data, the received signal strength indicator, the received channel power indicator, the time of arrival, or the round trip time, from the received authentication data; determining, by the master beacon device, that the mesh network is insecure based on identified differences between the one of the path loss data, the received signal strength indicator, the received channel power indicator, the time of arrival, or the round trip time, from the received survey data and the one of the path loss data, the received signal strength indicator, the received channel power indicator, the time of arrival, or the round trip time, from the received authentication data. receiving, by a master beacon device and from a plurality of servant beacon devices (110a, 110b) in the mesh network, survey data comprising, for each of the servant beacon devices, a beacon device identifier and one of path loss information, a received signal strength indicator, a received channel power indicator, a time of arrival, or a round trip time, of proximate servant beacon devices detected by each servant beacon device; transmitting, by the master beacon device and to each of the plurality of servant beacon devices, enrolment data comprising beacon device identifiers and the corresponding one of path loss values, received signal strength indicators, received channel power indicators, times of arrival, or round trip times, of proximate beacon devices to servant beacon devices, wherein the enrolment data is based on the received survey data, wherein the enrolment data may be retransmitted by servant beacon devices within the mesh network to reach other recipient servant beacon devices; receiving, by the master beacon device, authentication data from the plurality of servant beacon devices in the mesh network, the authentication data comprising beacon device identifiers for servant beacon devices and the one of path loss information, the received signal strength indicator, the received channel power indicator, the time of arrival, or the round trip time, detected by servant beacon devices of proximate servant beacon devices; comparing, by the master beacon device, a first virtual map comprising the one of the path loss data, the received signal strength indicator, the received channel power indicator, the time of arrival, or the round trip time, from the received survey data to a second virtual map comprising the one of the path loss data, the received signal strength indicator, the received channel power indicator, the time of arrival, or the round trip time, from the received authentication data; determining, by the master beacon device, that the mesh network is insecure based on identified differences between the one of the path loss data, the received signal strength indicator, the received channel power indicator, the time of arrival, or the round trip time, from the received survey data and the one of the path loss data, the received signal strength indicator, the received channel power indicator, the time of arrival, or the round trip time, from the received authentication data.