Questions & answers
Before you commission an assessment
Clear answers to the practical questions: what we assess, how testing works and what you receive. For advice on your own systems, speak to us directly.
Choosing an assessment
What does GoldAgent do?
GoldAgent provides authorised PBX, SIP and VoIP security assessments for UK organisations. We review agreed systems, validate findings and provide prioritised recommendations for reducing telephony risk.
What is a PBX security assessment?
A PBX security assessment examines the security of a business phone system. Depending on the agreed scope, it can cover external exposure, accounts, administration, SIP services, call permissions and safeguards against toll fraud.
How is a VoIP assessment different from a general network scan?
A VoIP assessment considers how calls are authenticated, routed and controlled. It adds telephony context and human validation to technical checks, rather than relying on a list of open ports or scanner alerts.
What does a SIP security audit cover?
A SIP audit examines the agreed signalling services and their controls. Scope may include registrations, authentication, trunk access, permitted sources and the configuration that governs who can make or route calls.
Can you assess a hosted phone system?
Yes, subject to scope and permission. A hosted provider may control parts of the service that the customer cannot authorise us to test. We establish the relevant responsibilities and obtain provider consent where required.
Can you assess an on-premises PBX?
Yes. We agree which PBX, supporting services, interfaces and locations are in scope. Access arrangements and any on-site requirements are confirmed before the engagement.
Do you support every PBX platform?
Platform support is confirmed during scoping. Tell us the product, version, hosting arrangement and any provider restrictions so we can establish which checks are appropriate.
Which service should I choose?
Start with a PBX Security Assessment if you want a broad review of your phone system. If you have a specific concern about SIP, VoIP or toll fraud, tell us and we will propose a suitable scope.
Permission and service continuity
Do you need written permission to test?
Yes. Active testing starts only after scope and written authorisation are agreed with the party entitled to give permission. A website enquiry does not authorise testing.
Will testing interrupt our calls?
No assessment can promise zero operational risk. We agree test windows, exclusions, account-lockout precautions and an emergency-stop contact to reduce the risk of disruption.
Do you make fraudulent or premium-rate calls?
Fraud demonstrations are non-billable by default. Any higher-impact proof requires explicit agreement within the written scope; we do not make unauthorised billable calls.
Should I send passwords in my enquiry?
No. Do not send passwords, access tokens, call recordings or sensitive findings through the enquiry form or WhatsApp. We will agree an appropriate transfer method if the assessment requires sensitive material.
What if our telecom provider will not authorise testing?
We do not proceed with active testing of systems for which permission cannot be established. We can discuss whether a narrower review of your own controls or published information would be useful.
What is the free PBX Exposure Check?
It is a request for a later review of already-published information about the host or domain you provide. It does not log in, probe or send traffic to your phone system, and it is not a penetration test.
Does the self-assessment scan our systems?
No. The self-assessment uses your answers to twelve questions to suggest an indicative security posture and next step. It cannot verify your configuration or confirm that a system is secure.
Reports and follow-up
What will we receive after an assessment?
The agreed deliverables include a report explaining scope, findings, supporting evidence, business impact and recommended remediation. We confirm the reporting format and any retest arrangements in the proposal.
Are findings reviewed by a person?
Yes. GoldAgent validates findings before reporting them. Automation supports repeatable checks; human review helps establish context, relevance and priority.
Can we see a sample report before buying?
Yes. The sample-report page illustrates the report structure and example findings. It uses demonstration material rather than real customer data.
Will you fix the issues you find?
The assessment provides remediation guidance. Who implements changes, and any support required from GoldAgent or your telecom provider, should be agreed separately in the scope of work.
Can you check that a fix worked?
Retesting can verify an agreed remediation. The proposal sets out which checks are included, the retest window and any additional work needed after wider system changes.
What is GoldAgent Assure?
Assure is an annual programme with an authorised baseline assessment and scheduled reassessment. Findings are human-validated. It is not a 24-hour monitoring, alerting or incident-response service.
How often should we reassess?
The right interval depends on your exposure, change rate and business requirements. Significant changes to the PBX, provider, trunking or access controls are useful points at which to review the agreed assessment scope.
Does a clean report guarantee security?
No. An assessment covers the agreed systems, methods and testing window. It cannot exclude every weakness or predict later changes, so continued maintenance and appropriate reassessment remain necessary.
Pricing and working with us
How much does an assessment cost?
GoldAgent Assess starts from £800 per assessment. Assure starts from £1,290 per year. These are indicative prices in pounds sterling; a written quotation follows scoping.
What determines the final price?
Price depends on the systems, sites, access arrangements, assessment depth and deliverables agreed. We confirm fees and any applicable tax treatment in the quotation before work begins.
How long does an assessment take?
Timing depends on scope, access and provider permissions. We agree the testing window and report delivery schedule in the proposal rather than promising a fixed turnaround for every system.
Do you work across the UK?
Yes. GoldAgent provides services across the UK by arrangement. Engagements are delivered remotely, with on-site work agreed where required. The Bristol registered office is not a walk-in location.
Can an MSP resell your assessments?
White-label and referral arrangements are available by agreement. We confirm branding, customer responsibilities, data handling and testing authorisation before work starts.
Can you help with supplier procurement?
We can discuss an NDA, statement of work, authorisation requirements, data handling and sample reporting. Tell us about mandatory qualifications or accreditations at the outset so we can confirm suitability.
Does an assessment certify compliance?
No. Assessment findings can contribute evidence to a wider compliance review, but a GoldAgent report is not a regulatory certification or a guarantee that all obligations have been met.
Who operates GoldAgent?
GoldAgent is a trading name of GoldPaid Ltd, company number 17382540. Its registered office is Unit 217, Bristol Business Centre, 179 Whiteladies Road, Clifton, Bristol BS8 2AG.
How do I contact GoldAgent?
Call 07763 741067, use the WhatsApp link on this website or submit the contact form. A short description of your phone system and the help you need is enough to begin.
Have a question about your phone system?
Tell us what you use, who hosts it and what concerns you. We will help you establish a sensible next step.
Testing is only performed against systems you own or are explicitly authorised to test.