Aspects described herein include a method for use with an access point (AP). The method comprises inspecting control frames received from a rogue AP, characterizing an intrusion by the rogue AP using one or more spatial reuse parameters included in the control frames, and selecting a defensive posture for the AP based on the characterization.