Voice over Internet Protocol (VoIP) has become the primary way for businesses and people to communicate. It’s cheaper and more flexible than traditional copper phone lines so the shift makes sense.
But what most people don’t realise is that the more that our conversations move online, the more risks there are. Every call and meeting that takes place over the Internet is vulnerable to hackers.
And since the usage of VoIP has skyrocketed in the last couple of years, it’s given criminals new ways to exploit its weak points.
A few industry experts have shared their thoughts on the cybersecurity risks that come with this widespread VoIP adoption.
Our Experts
- Ed Gaudet: CEO and Founder of Censinet.
- Sarah Bone: CMO and Co-Founder of YEO Messaging.
- Chris Sorensen: CEO of ARMOR Dial and PhoneBurner.
- Benjamin Knauss: Cybersecurity Professional at Racter.
- Deepak Shukla: CEO of Pearl Lemon Web.
- Mark Fermor: Founder of Firevault.
- Adam Seamons: Head of Information Security at GRC International Group.
- Daniel dos Santos: Senior Director, Head of Research at Forescout.
- Derrick Fordwuor: Managing Director at SyncraIT.
- Vansh: Analyst at InfoSec.
- Marcal Santos: Founder of Secureleap.
- Graham Dodd: Web Developer at Limely.
Ed Gaudet, CEO and Founder of Censinet
Vishing, or voice phishing, is becoming a huge problem as more businesses rely on VoIP. Attackers just need to make a convincing phone call. With so much company information now publicly available online, it’s easy for someone to pretend to be a manager or IT support.
They often come from spoofed numbers that look legitimate, and the person on the other end knows just enough details to sound trustworthy. We’ve seen cases where employees approve payments or share credentials.
The FBI reported that phishing and spoofing scams led to billions in losses last year, and voice-based scams are climbing fast. It’s a reminder that cybersecurity is about people. When someone hears a familiar voice or a confident tone, their guard drops. That’s exactly what attackers count on.
Sarah Bone, CMO and Co-Founder of YEO Messaging
As VoIP adoption continues to accelerate, particularly across remote and hybrid workforces, it opens the door to a host of cybersecurity and spoofing risks that many organisations are still underestimating. The inherently digital nature of VoIP makes it vulnerable to packet sniffing, caller ID spoofing, DDoS attacks, and even potentially, eavesdropping if encryption isn’t properly implemented.
At YEO Messaging, we come about communications with a different perspective. We’re especially focused on identity verification and one of the biggest gaps in traditional VoIP systems is the lack of real-time identity authentication, meaning you can’t always be sure who’s on the other end. Continuous authentication, such as biometric verification or facial recognition, should be part of the conversation around securing VoIP platforms going forward.
The key, we believe, is not just a secure infrastructure, but rethinking how we establish trust in digital communications from the ground up.
Chris Sorensen, CEO of ARMOR Dial and PhoneBurner
VoIP has definitely become a big backbone of modern business communication, largely due to the flexibility it provides with a growing security cost. Probably the biggest risk would be visibility as VoIP traffic often spans multiple carriers, apps, and endpoints which tends to create a blind spot where data can be intercepted, spoofed, and even manipulated. What attackers tend to do is exploit these gaps through caller ID spoofing, phishing, and denial of service attacks.
What we have seen at ARMOR® is that AI can be both the problem but also the solution. As threats become more automated, defending against them requires AI-driven detection and call reputation monitoring to spot unusual traffic patterns in real time. Its really not an option to no longer have proactive monitoring and strict authentication protocols.
All in all, widespread VoIP adoption really does demand a mindset shift. Treat your voice network like your data network. The organisations who really prioritise security will probably be the ones that keep trust intact as they scale digitally.
Benjamin Knauss, Cybersecurity Professional at Racter
The big issue with widespread VoIP adoption is that it radically expands the attack surface. It’s no different from any other critical app we’ve moved to the cloud; it’s just data packets now.
I’m concerned about targeted SIP-based DDoS attacks taking down our entire comms stack, or sophisticated vishing campaigns that spoof internal extensions to hit our execs. And toll fraud is a real budget-killer.
Because it’s IP-based, it’s wide open to the classic network-layer attacks: eavesdropping, man-in-the-middle on call signalling, you name it. If that traffic isn’t encrypted end-to-end (both signalling and media), we’re exposed.
Honestly, it just boils down to fundamentals. We have to treat it like any other critical workload: strong encryption, proper network segmentation to isolate the voice VLAN, and relentless user training on vishing. It’s just another high-priority asset to defend.
Deepak Shukla, CEO of Pearl Lemon Web
VoIP’s great for cutting costs and keeping teams connected, but it also comes with a few cracks that hackers love to slip through. Weak encryption and open networks are usually the biggest culprits. Once someone gets into that system, private data and calls can be exposed before anyone even realises what’s happening.
A lot of businesses also skip the basics — things like keeping software patched or turning on multi-factor authentication. That’s where most of the trouble starts. And lately, I’ve seen more phishing happening through VoIP. Attackers fake numbers that look legit, and because it feels like “just another call,” people let their guard down.
Mark Fermor, Founder of Firevault
Adam Seamons, Head of Information Security at GRC International Group
VoIP has blurred the line between traditional telephony and the internet, introducing familiar network-level risks into what was once a closed system. Attackers now target VoIP systems through credential theft, unpatched servers, exposed SIP interfaces, and poorly secured endpoints. The biggest risk isn’t the technology itself, it’s the assumption that it’s ‘just phones’.
Organisations should treat VoIP like any other internet-connected service: apply multi-factor authentication, segment VoIP from other network traffic, patch SIP gateways promptly, and restrict admin access.
Sectors handling sensitive conversations such as legal, financial, and healthcare are particularly attractive targets for eavesdropping and fraud. Voice spoofing and deepfake-based attacks are still emerging but growing rapidly as AI tools improve. Staff awareness and verification procedures are key defences here.
Daniel dos Santos, Senior Director, Head of Research at Forescout
VoIP systems are consistently up there among the riskiest IoT devices, not just because of their communication role but due to how deeply embedded they are in corporate networks. We continuously see VoIP among persistent suspects such as network attached storage (NAS), IP cameras and printers, as the riskiest IoT devices.
Often left exposed on the internet, VoIP devices have long been exploited by attackers. VoIP threats typically stem from exploitable vulnerabilities in firmware and weak configurations, making it possible for attackers to hijack devices for botnets or to move laterally within an organisation’s network, as well as to intercept or record calls.
Unlike traditional telephony, VoIP relies on IP connectivity, which blurs the line between voice infrastructure and IT systems. This connectivity brings convenience but also creates additional attack surfaces, especially when devices are unmanaged or not regularly patched. VoIP systems can be targeted alongside other IoT assets such as IP cameras, network video recorders and NAS devices, amplifying the potential impact of compromise. Once breached, these systems can be exploited to launch DDoS attacks, move laterally, or access confidential communications. As adoption continues to grow, organisations need to treat VoIP endpoints with the same security discipline applied to core IT infrastructure; patching, monitoring, and segmentation are essential.
Derrick Fordwuor, Managing Director at SyncraIT
As more businesses move to internet based phone systems, many don’t realise they’re taking on new cybersecurity risks at the same time. When voice traffic travels over data networks, it becomes open to the same threats as email or file sharing. Without proper safeguards, attackers can intercept calls, steal data or take systems offline altogether.
I often see smaller firms treat VoIP as just a modern version of their old phone system. In truth, it’s part of your IT estate and needs to be protected in the same way. Things like skipping updates, not using encryption, or having voice and data share the same network are common mistakes that increase risk.
The safest approach is to manage VoIP as part of your wider cyber security plan. Use encrypted connections such as TLS or SRTP, keep software patched, and segment voice traffic where possible. It’s also worth training staff to spot suspicious calls or social engineering attempts. VoIP can bring flexibility and cost savings, but only if it’s secured properly from the start.
Vansh, Analyst at InfoSec
The increasing adoption of VoIP has widened its threat landscape. Mostly, cybersecurity takes a backseat for businesses as their focus is on the monetary aspect. This focus on the monetary aspect sometimes leads to using some “not-so-safe” VoIP vendors, posing both reputational and financial risk to the organisation.
One of the biggest vulnerabilities arises when VoIP calls are not encrypted. Since the packets are routed through the Internet, anyone part of the route or having access to a compromised router/node can intercept and listen to conversations without any indicators of compromise (IOC) and resulting in theft of sensitive information.
Attackers also exploit VoIP systems for social engineering attacks, especially targeting customer-facing organisations. By spoofing caller IDs, they impersonate companies and trick customers into revealing confidential information such as government IDs or banking data, etc. With some research over the internet, internal employees can also be targeted to extract information that should never be publicly available.
Marcal Santos, Founder of Secureleap
VoIP has evolved massively in recent years. It’s now super affordable and accessible, even for small businesses. But here’s the problem: this affordability also makes it ridiculously easy for criminals to launch campaigns and scam people.
The most common attack I see now is social engineering attacks. A person can easily pretend to be your boss or bank, and people will believe it.
Another issue is toll fraud. One bad practice I saw a lot is people reusing their passwords across several services. Once a data breach occurs, criminals will “test” leaked passwords in VoIP services. Late in the month, customers notice some super high bills.
As AI tools advance, we’re seeing more voice clones available to the general public. This makes a dangerous combination where cloned voice + VoIP is cheap and easy to target several people at the same time for a tiny cost.
Bottom Line: VoIP brings tons of great features, however educating and protecting the people who use it (employees) is also super important.
Graham Dodd, Web Developer at Limely
As more businesses adopt VoIP, the technology’s popularity has also expanded its exposure to common cyber threats. Caller ID spoofing, toll fraud and malware are among the biggest risks, often targeting systems left unprotected during rapid migration. Problems arise when networks use weak passwords, outdated routers or unpatched PBX software, giving attackers easy entry points. Treating VoIP as a core part of a company’s IT infrastructure, rather than a simple phone upgrade, helps close these gaps before they’re exploited.
Reducing these risks requires a proactive approach to both technology and people. Segregate VoIP traffic on a separate network, restrict administrative access, and keep all related hardware and software up to date. Use encrypted connections such as TLS and SRTP, monitor for suspicious call patterns, and train staff to recognise social engineering tactics. Without these precautions, VoIP systems can quickly become a route to data breaches and financial losses.
