- Voice-based attacks exploit trust rather than technology. Attackers don't need malware or stolen credentials, just a spoofed number that appears credible enough to trigger a response.
- STIR/SHAKEN verifies that a calling number hasn't been altered across trusted networks, but it doesn't authenticate caller intent and leaves gaps in international, legacy, and indirectly routed calls.
- Security teams should treat voice as part of the attack surface, evaluate how identity is verified across all communication channels, and implement controls that reduce reliance on human judgment in the moment.
- Employee and customer awareness training helps but isn't sufficient on its own, since people must make trust decisions under pressure with incomplete information in real time.
For decades, cybersecurity has centered on a single boundary: the perimeter. Firewalls, endpoint protection, network monitoring, and user awareness programs are all designed to protect what’s inside and keep threats out.
That model has matured significantly. Security teams now have greater visibility into frameworks that detect and respond to threats within their networks.
But one of today’s most critical vulnerabilities facing organizations sits outside the perimeter, within the communication channels that extend beyond their network boundaries.
Voice is one of the clearest examples.
Enterprises can closely monitor activity within their networks, but once a call moves beyond those boundaries, visibility and control are lost, leaving a gap that attackers actively exploit.
The Hidden Attack Surface
Most cybersecurity programs are built to protect systems and infrastructure, but attackers don’t always need to breach them to inflict harm. They choose to bypass them altogether.
Voice-based attacks, particularly caller ID spoofing and impersonation, exploit trust rather than technology. An attacker doesn’t need malware or access credentials. They just need to appear credible long enough to trigger a response.
Consider a simple scenario: An attacker spoofs a trusted number, such as a bank, internal help desk, or an executive, and calls a target with an urgent, believable request. Because the call appears legitimate, the recipient responds before questioning it. No systems are breached, but real damage is done.
This is why voice remains one of the most effective channels for attack. Unlike email, there is no opportunity to inspect headers or analyze links. Voice creates a sense of immediacy and authority, and people are conditioned to respond in real time, often with incomplete information. As a result, attackers continue to refine their tactics to exploit it.
How Identity is Manipulated
At its core, spoofing is not just technical; it’s an identity problem.
Many security teams think spoofing can be fixed at the network level. But its impact relies on how identity is shown to the user. If something seems trustworthy, the attack already works.
Spoofing is often the foundation for broader attacks. It enables phishing, social engineering, and fraud by establishing a false sense of trust at the outset.
Standards like STIR/SHAKEN have helped address part of the problem by verifying that a calling number has not been altered as it moves across trusted networks. This is an important step forward.
However, it does not solve the problem of identity.
STIR/SHAKEN authenticates the originating network, not the caller's intent or the full path of communication. Gaps remain, particularly across international networks, legacy systems, and indirect routing, where fraudulent calls can still reach end users. More importantly, it does not prevent impersonation attacks using legitimate but unrelated numbers.
The result: calls may be authenticated at the network level, but still deceptive in practice.
Why Training Isn’t Enough
Many organizations fall back on user awareness. Training employees and customers to spot suspicious interactions is crucial, but not enough.
People must make security decisions under pressure, with little information and in real time. Attackers exploit urgency, authority, and trust. Perfect judgment isn’t realistic in every situation.
Here, current security models falter. They protect systems, not people, especially when interactions are outside the network.
Extending Security Beyond the Perimeter
Closing this gap requires organizations to rethink security.
Security cannot end at the firewall. It must cover interactions among organizations, their employees, and their customers.
In practical terms, this means treating communications, particularly voice, as part of the attack surface. It requires applying the same principles used within networks, such as identity verification, monitoring, and control, to interactions that occur beyond them.
The aim is not just to authenticate the network, but to give users a clear and reliable way to know who they’re interacting with.
This means combining call authentication to validate call origin with methods to present verified identity to users. When identity is confirmed and displayed at interaction, organizations can better distinguish legitimate from fraudulent communications.
When a call reaches a user, they should receive clear, verifiable signals indicating whether the interaction is legitimate. Without that, every call becomes a judgment call and an opportunity for exploitation.
Next Steps for Security Teams
For many, the challenge isn’t recognizing voice fraud; it’s knowing what to do about it.
There are three practical steps security teams can take to begin closing this gap.
- Treat voice as a primary attack surface: Incorporate voice threats in threat models and risk assessments alongside traditional channels such as email and devices. Organizations must understand how these risks affect them and where they are exposed.
- Evaluate how identity is verified across communications:This includes examining voice platforms, collaboration tools, and service providers, to understand existing capabilities and where they fall short. Identity should not be assumed simply because a number appears familiar.
- Implement operational controls to reduce reliance on human judgment: Security shouldn’t depend solely on individuals to determine what’s legitimate. Organizations should establish mechanisms that provide clear identity signals and distinguish trusted interactions from fraudulent ones in real time.
The Risk of Inaction
The biggest risk in ignoring this issue isn’t a single breach or major event, but the gradual erosion of trust is a problem. Voice fraud often evades incident detection. It causes financial loss, customer harm, and reputational damage over time.
When attackers can convincingly speak as your organization to your employees or customers, the consequences extend far beyond any single interaction.
This is fundamentally a cybersecurity issue, not just a telecom one.
A New Definition of the Perimeter
Security strategies that focus solely on protecting systems will continue to leave gaps where identity can be exploited.
The next phase of cybersecurity expands the perimeter beyond infrastructure to include the interactions organizations have with employees and customers.
If the conversation can be compromised, so can the organization.
Security no longer stops at the firewall. It travels with every connection.
About Tiffany Pressler
Tiffany Pressler is Senior Product Manager, Security at First Orion, a leader in branded calling and call authentication, working with top global carriers including T-Mobile, Deutsche Telekom, and Vodafone.
