Automated PBX assessment vs traditional penetration testing

What each method actually is

A traditional penetration test is a time-boxed, human-led engagement. A tester is given a scope and a window, and works to find and exploit weaknesses much as an attacker would, then writes up what they found. The output reflects the skill of the individual and the depth of the scope you agreed.

An automated assessment uses tooling to enumerate a system against a known set of checks. It runs the same tests the same way every time, which makes it fast and repeatable. On its own it produces findings rather than a demonstrated, business-relevant story of impact.

GoldAgent works in the telephony layer specifically, on PBX, SIP and VoIP estates, and combines automated enumeration with human validation of what the tooling reports. The comparison below is meant to help you choose sensibly, not to dismiss either approach.

Repeatability and consistency

Automation is consistent by design. Run it in March and again in September and the method is identical, so you can compare results over time and see whether an estate is improving or drifting. That consistency also removes the variability that comes from different individuals interpreting the same scope differently.

A traditional test is only as repeatable as the tester's notes and the rigour of the methodology behind it. Good firms document thoroughly, but two tests months apart can still diverge in coverage. If your priority is a stable baseline you can re-run, automation has the edge.

Telephony specialism

A general penetration test usually covers networks, web applications and infrastructure, with telephony as one item among many. That breadth is useful, but a PBX has its own failure modes: dial-plan misconfiguration, unauthenticated SIP registration, weak trunk credentials, exposed management interfaces and international call routing that can be abused for revenue-share fraud.

The FreePBX vulnerability CVE-2025-57819, rated CVSS 10.0 and listed in the CISA Known Exploited Vulnerabilities catalogue, is a reminder that telephony platforms carry critical, exploited weaknesses of their own. Assessing them well needs someone who understands how the platform is meant to behave.

Cost and frequency

Human-led tests are priced by tester time, so depth and cost move together. That is appropriate for a one-off, deep engagement, but it makes frequent repetition expensive. Many organisations end up testing once a year and living with the gaps in between.

Automated assessment lowers the marginal cost of each run, which makes more frequent checking affordable. The trade is that speed alone does not tell you which findings truly matter to your business. The figures below are illustrative, not a forecast, and simply show the shape of the decision.

• A deep annual penetration test: higher cost per engagement, strong depth, infrequent by necessity.
• Automated assessment: lower cost per run, broad and repeatable coverage, needs interpretation.
• Automated assessment with human validation: repeatable coverage plus confirmed, prioritised findings.

Human validation and evidence

The weakness of unvalidated automation is false positives and false confidence. A tool may flag an issue that is not exploitable in your configuration, or miss a chained weakness that only a person would spot. Validation is where a human confirms whether a reported issue is real and what it would let an attacker do.

Evidence is what turns a finding into something a board, an auditor or an insurer will act on. A demonstrated toll-fraud path, with the request and response that proves it, is far more persuasive than a line item in a scanner report. Both a traditional test and a validated automated assessment can produce this; raw automation usually cannot.

What each is best for

Choose a traditional penetration test when you need maximum depth against a defined target, creative attacker thinking across many layers, or a bespoke engagement tied to a specific project such as a major migration.

Choose an automated assessment when you need a repeatable telephony baseline, affordable re-checks as the estate changes, and consistent evidence you can track over time. In practice most organisations benefit from both, used for what each does well.

How GoldAgent approaches it

GoldAgent runs automated enumeration focused on PBX, SIP and VoIP, then applies human validation so that reported issues are confirmed and, where safe and authorised, demonstrated. The aim is the repeatability of automation with the credibility that only validation and evidence provide.

All testing is carried out only with written authorisation and an agreed scope. This is a defensive service intended to help you understand and reduce exposure, not a substitute for a broad, whole-estate penetration test where that is what you need.