Skip to content
GoldAgent

Authorised assessment

PBX Security Assessment

A structured, authorised assessment of your PBX estate that shows exactly what is exposed, how an attacker would use it, and what to fix first.

Request this assessmentHow we work

This is active, authorised testing. We confirm scope and written authorisation before any active work begins, including a hosted provider's consent where required.

The problem

Phone systems are rarely tested, and attackers know it

PBX platforms sit outside most vulnerability-management programmes. They are installed once, connected to the internet for remote administration or SIP trunking, and then left. Configuration drifts, extensions accumulate, and firmware ages while nobody is watching the telephony layer.

What we commonly find

  • Management interfaces reachable from the public internet
  • Default or weak credentials on administrative and SIP accounts
  • Forgotten extensions and test accounts that were never disabled
  • Outbound dialling permissions wider than the business needs
  • Firmware and application versions with known, published vulnerabilities
  • No logging or alerting on the systems that carry every call

The approach

A specialist assessment built for telephony

GoldAgent combines deep PBX and SIP knowledge with a repeatable assessment engine and human validation. We map what is exposed, confirm which weaknesses are real, and rank them by the business risk they carry, not by raw scanner output.

  • Telephony-specific checks a generalist scanner does not run
  • Every finding validated by a person before it reaches your report
  • Risk prioritised by exploitability and business impact
  • Clear, evidenced remediation guidance your team can act on
  • A defined retest path to confirm the fixes worked

Methodology

How the engagement runs

  1. 1

    Define scope

    Agree the exact systems, addresses and services in scope, and the systems explicitly out of scope.

  2. 2

    Confirm authorisation

    You confirm ownership or right-to-test in writing before any active work begins. Hosted systems need the provider's consent where required.

  3. 3

    Discover exposure

    Identify the PBX, SIP and management services reachable within the agreed scope.

  4. 4

    Analyse posture

    Assess configuration, authentication, versioning and dialling controls against known telephony attack paths.

  5. 5

    Validate findings

    Confirm each issue is real and reproducible, removing false positives before reporting.

  6. 6

    Prioritise risk

    Rank findings by severity, exploitability and business impact.

  7. 7

    Deliver the report

    A management summary plus technical detail, evidence and remediation guidance.

  8. 8

    Retest

    Re-check remediated findings and update their status.

What you receive

  • Executive summary written for decision-makers
  • Technical findings with severity ratings
  • Evidence for each finding and the affected service
  • Prioritised, actionable remediation guidance
  • An exposure inventory of the tested estate
  • Retest status once fixes are applied

Who it suits

  • Organisations running on-premises or hosted PBX systems
  • Businesses with legacy telephony that has never been assessed
  • IT teams preparing for Cyber Essentials or an insurance renewal
  • Companies taking card payments by phone (PCI DSS scope)

Risks it addresses

  • Toll fraud

    Compromised extensions and permissive dial plans let attackers place expensive calls the business is usually liable for.

  • Call interception

    Weak segmentation and authentication can expose call content and signalling.

  • Service disruption

    An exposed, unpatched PBX is a single point of failure for every inbound and outbound call.

FAQ

PBX Security Assessment: questions

Will testing disrupt our live phones?

The assessment is planned around your environment, with lockout-aware techniques and an agreed emergency-stop contact. Higher-impact tests are only run with your explicit agreement.

Do you test hosted PBX systems?

Yes, where the party with authority over the hosted system authorises it. Where a provider's consent is required, that is confirmed before active work begins.

How long does an assessment take?

A single-site PBX assessment is typically completed within a few working days from the point scope and authorisation are confirmed. Larger estates are scoped individually.

What do we get at the end?

A management-ready report with an executive summary, evidenced technical findings, severity ratings and prioritised remediation guidance, followed by a retest of the fixes.

Related services

Explore related assessments

Request a PBX Security Assessment

We confirm scope and authorisation first, then show you exactly what is exposed and what to fix.

Request an Assessment

Testing is only performed against systems you own or are explicitly authorised to test.