Technologies for preventing insider attacks in a wireless network are described. A processor of a first device receives a disconnect frame with i) a source address that identifies a wireless access point (WAP) device in a wireless network and ii) a destination address that the disconnect frame is addressed to all devices in the wireless network. The processor sends a frame to the WAP device after expiration of a configurable delay and receives an acknowledgment frame from the WAP device. The processor determines that the disconnect frame is a non-authorized disconnect frame received from a second device and is not to be processed. The processor can increment a first counter value to a second counter value, the second counter value indicating how many times a non-authorized disconnect frame is received at the first device. The processor sends a management frame with the second counter value to the WAP device.