Skip to content
GoldAgent
Specialist telephony security

Know exactly how exposed your PBX and VoIP systems are

GoldAgent performs authorised PBX, SIP and VoIP security assessments to uncover configuration weaknesses, needless exposure and telecom-fraud risk before they become expensive incidents.

Request a PBX Security AssessmentSee how GoldAgent works

Testing is performed only against systems you own or are explicitly authorised to test.

Authorised exposure map in scope
SIP trunk serviceExposed
Admin interfaceRestricted
Extension rangeReview
Firmware versionOutdated
Outbound routingPermissive
Risk score62 / 100

Illustrative representation of assessment output. Not live data.

  • Authorised, scoped testing
  • Human-validated findings
  • Telephony-specialist, not generalist
  • UK-based, sold nationally

The problem

Phone systems sit outside most security programmes

PBX and VoIP platforms are installed once, connected to the internet for administration or SIP trunking, and then left. That is exactly why attackers scan for them, and why the telephony layer is so often the weakest point.

  • Exposed management services

    Administration interfaces reachable from the public internet, often protected by nothing more than a password.

  • Weak authentication

    Default, reused or guessable credentials on administrative and SIP accounts, with no lockout on repeated attempts.

  • Permissive dialling

    Outbound and premium-rate routes left wide open: the exposure that turns a compromise into fraudulent call spend.

  • Forgotten accounts

    Test extensions and departed-staff logins that were never disabled and no longer belong to anyone.

  • Ageing firmware

    PBX and VoIP software running versions with known, published vulnerabilities that never get patched.

  • No monitoring

    No logging or alerting on the systems that carry every inbound and outbound call.

The GoldAgent approach

Specialist telephony expertise, validated by people

We combine deep PBX and SIP knowledge with a repeatable assessment engine and human validation, so you get findings that are real, ranked by business risk, and ready to act on.

  • Telephony-specific checks a generalist scanner does not run
  • Every finding validated by a person before it reaches your report
  • Risk prioritised by exploitability and business impact
  • Clear, evidenced remediation your team can implement
  • A defined retest path to confirm the fixes worked
  • Scheduled reassessment that re-checks for new exposure between assessments
Explore the services

What you receive

Every assessment produces a management-ready deliverable, not a raw scanner dump.

  • Executive summary
  • Technical findings
  • Severity ratings & evidence
  • Prioritised remediation
  • Exposure inventory
  • Retest status

The GoldAgent lifecycle

From what's exposed to what's assured

Every engagement follows the same outcome-led path. Authorisation is confirmed before any active work begins, and the final stage, Assure, runs the checks on a schedule and tracks changes run to run, with findings human-validated.

  1. 1

    Discover

    See what is exposed

    Identify the PBX, SIP and VoIP infrastructure reachable within your authorised scope, starting from the outside-in view an attacker has.

  2. 2

    Validate

    Confirm what is real

    A person confirms which findings are genuinely exploitable and, where authorised, demonstrates impact, so you act on evidence, not scanner noise.

  3. 3

    Prioritise

    Know what matters first

    Rank findings by severity, exploitability and business impact, with a risk score and an illustrative view of fraud exposure.

  4. 4

    Remediate

    Fix with clear guidance

    Each finding carries specific, actionable remediation your team can implement: patch, restrict, tighten or segment.

  5. 5

    Verify

    Prove it is closed

    Retest the remediated findings to confirm the weakness is genuinely gone and the fix introduced no new gap.

  6. 6

    Assure

    Keep it current

    Run the authorised checks on a schedule and diff each run against the last: new, resolved and unchanged findings tracked over time. Automated runs, human-validated findings.

Why GoldAgent

Services

Assessments built for the telephony layer

Point-in-time assessments where the risk is highest, plus scheduled reassessment between them.

How we compare

Specialist depth a scanner or general test misses

A fair, category-level comparison. Many organisations pair a broad scanner or penetration test with specialist telephony assessment. This shows what GoldAgent adds.

How GoldAgent compares with generic scanning, traditional penetration testing and general autonomous security platforms across telephony-security dimensions.
DimensionGeneric vulnerability scannerTraditional penetration testGeneral autonomous platformGoldAgent
PBX / SIP specialismDepth of telephony-specific coverage: SIP, trunks, dial-plan, AMI, toll fraud.
Repeatable, consistent methodSame checks run the same way each time, so results are comparable over time.
Human validation of findingsA person confirms findings are real and removes false positives before reporting.
Toll-fraud demonstrationEvidence of whether fraudulent outbound calling is genuinely possible, under agreed limits.
Dial-plan & routing reviewReviews the calling permissions where most telephony fraud risk actually lives.
Prioritised remediation guidance
Retest / verificationRe-checks remediated findings to confirm they are genuinely closed.
Recurring assuranceGoldAgent delivers scheduled, automated reassessment with historical change tracking; findings are human-validated. No live portal.
Machine-readable output (SARIF)Findings that flow into SIEM and security pipelines.
Low procurement complexity for SMEs
Suited to MSP / multi-site deliveryCan be packaged and delivered across many customer estates.

This compares categories of approach, not named companies. Each has legitimate strengths; many organisations combine a broad scanner or pen test with specialist telephony assessment.

The deliverable

See exactly what you get

The report is the product. Explore an interactive, sanitised sample: executive and technical views, severity, evidence, remediation and retest status.

View the sample reportStart with a free exposure review
  • Executive summary + risk score /100
  • Per-finding severity, evidence & remediation
  • Retest status: open / remediated / verified
  • Exports: HTML, JSON, CSV, SARIF

Exposure changes; an assessment does not

  • A firewall rule is changed and reopens exposure
  • Remote administration is switched on for a supplier
  • A trunk is migrated or a new endpoint deployed
  • A new vulnerability is published for your platform vendor

Recurring assurance

Protect the estate after the first assessment

A point-in-time assessment is true on the day it is run. Continuous Assurance runs the authorised checks on a schedule and compares each run against the last, tracking new, resolved and unchanged findings over time. Runs are automated; findings are human-validated. No customer portal; reports come to you directly.

About Continuous Assurance

Who we help

Where telephony risk is highest

The exposure is common; the business impact is not. These sectors feel it most.

  • Industry

    Call & Contact Centres

    High call volumes and always-on telephony make exposure and fraud costly.

    Read more

  • Industry

    Healthcare

    Legacy estates and sensitive lines raise the stakes on telephony security.

    Read more

  • Industry

    Finance & Professional Services

    Card-by-phone and regulatory pressure make telephony security a control, not an option.

    Read more

  • Channel

    MSPs & Telecom Providers

    White-label PBX and VoIP security to add telephony assurance to your stack.

    Read more

FAQ

Common questions

What does GoldAgent actually do?

GoldAgent runs authorised security assessments of PBX, VoIP and SIP telephony. It finds exposed services, weak authentication, permissive dialling and toll-fraud risk, then delivers evidenced, prioritised findings your team can act on.

Is this legal, and what do you test?

We test only systems you own or are explicitly authorised to test. Every active assessment starts with confirmed scope and written authorisation. Where a hosted provider's consent is required, we confirm it before any active work begins.

Will testing disrupt our live phones?

Assessments are planned around your environment, with lockout-aware techniques and an agreed emergency-stop contact. Higher-impact tests are only run with your explicit agreement, and any recurring reassessment is scheduled and non-intrusive.

Do you work with MSPs and telecom providers?

Yes. We offer white-label PBX and VoIP security for MSPs and resellers who want to add telephony assurance to their stack without building the specialism in-house.

Find out exactly how exposed your phone system is

Request an authorised PBX, VoIP or SIP security assessment. We confirm scope and authorisation first, then show you what is exposed and what to fix.

Request an AssessmentTry the self-assessment

Testing is only performed against systems you own or are explicitly authorised to test.