SIP is the signalling that sets up and tears down calls across most modern telephony. It is also where a large share of telephony fraud begins. This primer explains why, and what to do about it, without describing how to attack anyone.
What SIP exposure means
A SIP service that is reachable from the internet is, in effect, advertising that a phone system lives here. Attackers scan for these services continuously because a single compromised SIP account can be converted into fraudulent call spend within hours.
Exposure is not automatically a vulnerability, but exposed SIP with weak authentication, no lockout, or permissive routing usually is.
Why attackers target the SIP layer
- It is often internet-facing by necessity, for trunks and remote users.
- Credentials are frequently weak, reused, or left at defaults.
- Many deployments have no rate limiting or lockout on registration.
- A compromise converts directly into money through fraudulent calls.
The controls that reduce SIP risk
- Restrict SIP services to the addresses and trunks that genuinely need them.
- Use strong, unique credentials on every registration and trunk.
- Enforce rate limiting and lockout on registration attempts.
- Tighten routing so only expected call paths are possible.
- Restrict international and premium-rate dialling by default.
- Log and alert on unusual registration and calling activity.
Assessing the SIP layer
An authorised SIP security audit checks how trunks and registrations are exposed, how authentication holds up, and how routing is configured, then validates and prioritises the findings. It is a focused piece of work that targets the layer where most telephony fraud starts.
Related service
SIP Security Audit
A focused review of SIP trunks, registration and authentication.
Related reading
- SIP registration security: preventing rogue endpoints
How SIP registration works, why weak registration authentication lets attackers register rogue endpoints and drive toll fraud, and the controls that stop it.
- The complete guide to SIP security
A defensive guide to SIP security for UK organisations: how the protocol works, why fraud so often starts here, trunk and registration exposure, authentication, transport security, routing and how an authorised SIP audit works.
- The complete guide to VoIP security
A defensive, UK-focused guide to securing business VoIP end to end: the attack surface, transport and signalling encryption, media protection with SRTP, endpoints and softphones, hosted versus on-premises responsibilities, fraud, and independent assessment.
- The complete guide to PBX security
A defensive, UK-focused guide to securing a modern PBX: external exposure, authentication, management interfaces, dial-plan design, patching, encryption, logging and independent assessment against NCSC guidance.
This guide is educational and defensive. Test only systems you own or are explicitly authorised to test. See our responsible-testing policy.