Overview
The UK's move from the traditional copper telephone network to all-IP voice means most organisations now rely on SIP trunks or hosted telephony. We test for toll fraud, eavesdropping and service abuse, so the switchover does not open new risks.
Voice over IP (VoIP) systems — IP PBXs, SIP trunks, contact-centre platforms and unified communications — are often deployed and forgotten. Attackers target them for toll fraud, eavesdropping, caller-ID spoofing and as a route into the data network.
Our VoIP penetration tests assess SIP servers, PBX management interfaces, phones and softphones, voice VLAN segmentation, encryption of signalling and media, and the controls that prevent unauthorised international calling.
We test safely to avoid disrupting live call services, coordinating windows with your telecom team.
How testing works for UK organisations
- Signed scope and written authorisation before any testing, in line with the Computer Misuse Act 1990
- Testing windows agreed in UK time, including out-of-hours windows for production systems
- Fully remote delivery, with internal and wireless access via VPN or a posted test device, so there are no travel costs
- Reports mapped to ISO 27001, PCI DSS, UK GDPR Article 32 and customer questionnaires, with a fixed price in GBP
What's included
Our approach
- DiscoverMap voice infrastructure and endpoints.
- AssessReview configuration and exposure.
- AttackTest fraud, interception and access scenarios safely.
- SegmentationValidate separation of voice and data.
- ReportFindings with prioritised fixes.
What you receive
- VoIP asset inventory
- Toll fraud exposure findings
- Encryption and interception findings
- Segmentation results
- Remediation guidance and retest
Standards & frameworks
- PTES
- NIST SP 800-58
- MITRE ATT&CK
- CIS Controls
- NCSC penetration testing guidance
Frequently asked questions
What is VoIP penetration testing?
A security assessment of voice-over-IP systems, including call servers, PBXs, SIP trunks, phones and the networks they use.
Will testing interrupt our phone service?
We test in agreed windows and avoid denial-of-service techniques to protect live call services.
Do you test cloud phone systems?
Yes, within the provider's testing policy and your configuration scope.
Are you CREST or CHECK accredited?
We don't claim CREST or NCSC CHECK status on this site. Most private-sector tests, including those for ISO 27001, PCI DSS and customer due diligence, don't require either. If a contract, public-sector buyer or regulator specifically requires a CHECK or CREST-accredited provider, tell us at scoping and we'll tell you honestly whether we can meet it. See our CREST and CHECK guide.
Do you quote in pounds sterling?
Yes. UK proposals are fixed-price and quoted in GBP. Prices exclude VAT where VAT applies to cross-border services. We confirm the treatment for your organisation in the proposal.