Security budgets have grown for a decade. Voice traffic still sits outside almost all of them.
Walk into any enterprise security review and you’ll find a detailed account of endpoint protection, cloud posture, network segmentation and identity controls. Ask the same room who owns voice security… and the conversation stalls. Someone assumes the telecom team has it. The telecom team assumes it runs on the network, so the security team must cover it.
Nobody actually does.
That gap? Not a small one. Voice connects to identity and finances as well as your most sensitive internal conversations. Attackers already know this. Your security program, in most cases, does not account for it.
The blind spot sitting in plain sight
Enterprise security spending keeps climbing, but almost none of that lands on voice. The reason is historical. For twenty years, voice has been a closed system. Calls ran over dedicated PRI lines and legacy PBX hardware that had no direct exposure to the internet. You could reasonably treat it as separate infrastructure, out of scope for the threats hitting your data network.
Now? Voice runs on IP. Session Initiation Protocol (SIP), the standard behind modern voice, carries your calls as data traffic across the same networks everything else uses. The moment voice became software, it inherited every risk that comes with software, but the security assessment process never caught up.
So you have a live, internet-adjacent attack surface that your framework still treats like a phone closet from 2004. That’s the blind spot, and it’s a doozy.
The threats are real and already in use
Three attack types exploit unsecured voice right now.
1. Toll fraud
Toll fraud is a billing attack where an attacker compromises your SIP credentials, often through brute-force registration attempts, an exposed port or social engineering, then routes high volumes of calls through your trunks. Often these are premium-rate or international calls that generate revenue for the attacker. You only find out when the invoice arrives.
The damage is direct and financial. Toll fraud is a leading category that targets the exact weakness most enterprises leave open: SIP credentials sitting on infrastructure nobody monitors.
2. Vishing
Vishing (voice phishing) has moved well past the clumsy scam call. Attackers now use AI-generated voice to impersonate executives, finance staff or trusted vendors with unsettling accuracy. A convincing call to your accounts payable team, in a voice that sounds like your CFO, can authorize a fraudulent transfer in minutes.
Since people tend to trust what they hear, voice carries an authority that email has lost. That’s precisely what makes vishing effective, and AI has lowered the cost and skill required to run it at scale. Your phishing training focuses on the inbox. The attacker has moved to the phone.
3. Unencrypted SIP sessions
Here is the one most security teams miss entirely. A large share of enterprise SIP signaling and RTP media travels unencrypted. Left unprotected, an attacker positioned on the network path can intercept call content, capture credentials passed during setup or eavesdrop on conversations outright.
Think about what travels over voice: deal negotiations, patient information, legal discussions, authentication codes read aloud. An unencrypted call is a plaintext conversation moving across networks you may not fully control. You would never accept that for email. Many enterprises accept it for voice without realizing they have made the choice.
Why voice keeps getting skipped
It comes down to perception. Voice is seen as solved infrastructure. It works. Calls connect. Nobody files a ticket, so nobody looks closer. While working and secure are hardly the same thing, the distinction rarely surfaces because voice performs its basic job every day.
Then there is the legacy PBX mindset. Voice has lived under telecom or facilities for decades, outside the security team’s remit. Ownership never formally transferred when voice moved to IP. So it falls into the gap between teams, reviewed by neither.
Compliance frameworks reinforce the omission. Most security audits scrutinize data systems and cloud configurations. Voice rarely appears on the checklist, so it rarely gets tested. What your framework does not name, your team does not examine.
The result is a system carrying financial and identity risk that sits permanently off the security agenda. Attackers have noticed the pattern even where defenders have not.
Reframing the risk
Stop thinking of voice as a utility and start thinking of it as an attack surface. Because that’s what it is. Voice touches three of the assets your program works hardest to protect.
- It connects to identity, since caller trust and voice impersonation bypass controls built for other channels.
- It connects to finances, since toll fraud and vishing both convert directly into monetary loss.
- It connects to your most sensitive conversations, the ones people are most careful to keep out of writing and least careful to protect on a call.
A determined attacker looks for the path of least resistance. When your endpoints are hardened, your cloud is monitored and your network is segmented, the unmonitored voice layer becomes the obvious way in. You spent the budget everywhere else, which is exactly why voice is now the soft target.
Securing voice starts at the network
The good news is that voice security is not a mystery; it’s actually a solved problem that most enterprises have not yet applied. And it starts where voice lives: the network layer.
The single biggest improvement you can make is moving voice off the public internet and fragmented regional carriers onto a private, monitored backbone. When your voice traffic rides a Tier 1 IP network the provider owns and operates, you control the path calls take and gain visibility into what moves across it. Voice runs on one global private network instead of a patchwork nobody fully sees. With 80% of customer traffic staying on GTT’s top-ranked Tier 1 global backbone, that traffic stays under consistent control rather than crossing networks you cannot inspect.
A managed SIP Trunking service builds security into that foundation rather than bolting it on afterward. This means:
- Session Border Controllers deployed globally. SBCs act as the security perimeter for voice, enforcing consistent policy across every region and every site. Instead of security levels that vary from one local carrier to the next, you apply one standard everywhere. This is the Secure pillar applied directly to voice.
- 24/7 monitoring. Continuous oversight from global operations centers means unusual patterns get caught as they happen. Voice finally gets the same active monitoring you already expect for the rest of your estate.
Consolidating voice this way also collapses the ownership gap. One provider running voice as an extension of your team means voice stops falling between telecom and security. Instead, it becomes a governed part of your infrastructure with a clear line of accountability.
Put voice on the agenda
For your next security posture review, ask three questions.
- Where does our voice traffic actually travel, and who controls that path?
- Is our SIP signaling encrypted, and who would know if it were intercepted?
- Who monitors our trunks for the calling anomalies that signal fraud?
If the answers are vague, you’ve found an exposure that attackers may already be probing.
Voice belongs in the same sphere of invested protection that you’ve already built, governed by consistent policy and watched around the clock. The enterprises that close this gap will stop paying the fraud tax and stop leaving their most sensitive conversations in the open. Otherwise, it’ll mean continuing to learn the hard way.
Nobody is securing the phone. It’s about time you should.
Bring voice into your security posture. Talk to a GTT expert about SIP Trunking on a private, monitored Tier 1 backbone.
