By Sagar Shankaran, Founder of CallSphere
What an SBC actually does, why AI voice deployments still need them in 2026, and how Oracle, Ribbon, AudioCodes, and Cisco fit into modern stacks.
Key takeaways
Session Border Controllers are the unglamorous workhorses of voice security. In 2026 they are also where STIR/SHAKEN, fraud control, and AI traffic shaping converge. If you operate at scale, you have an SBC; if you do not, you eventually will.
flowchart LR
Phone["PSTN caller"] --> Carrier["Carrier"]
Carrier -- "SIP INVITE" --> SBC["Session Border Controller"]
SBC -- "SIP" --> PBX["Twilio / Asterisk"]
PBX -- "RTP · Opus" --> Bridge["AI Voice Gateway"]
Bridge --> AI["OpenAI Realtime"]
AI --> Bridge
Bridge --> PBXA Session Border Controller is a network element that sits at the edge of a SIP network. Its job is to make incoming and outgoing voice traffic survive the rest of the world: NAT traversal, codec transcoding, encryption, denial-of-service protection, fraud filtering, STIR/SHAKEN signing and verification, regulatory compliance, and clean handoff between operator domains.
The SBC market is consolidating but expanding: from $906.7M in 2026 to a projected $2.0B by 2036 (CAGR ~8.2%). Oracle, AudioCodes, Ribbon, Cisco, and Dialogic dominate. AWS and Azure marketplace listings (Ribbon Voice Security cloud-native SBC) make on-demand deployment plausible without a hardware appliance.
For AI voice agent deployments, the SBC plays four critical roles:
Hear it before you finish reading
Talk to a live CallSphere AI voice agent in your browser — 60 seconds, no signup.
Inbound: PSTN INVITE arrives at the SBC. SBC verifies STIR/SHAKEN, applies access control lists, normalizes SIP headers, transcodes if needed, and forwards a clean INVITE to your internal voice plane (Twilio, Asterisk, FreeSWITCH, AI agent).
Outbound: AI agent initiates a call. Internal voice plane sends INVITE to the SBC. SBC signs STIR/SHAKEN, applies outbound rate limits and DNC scrubbing, transcodes to whatever the carrier expects, and forwards to the upstream trunk.
Modern SBCs (Oracle SBC 5G IMS, Ribbon SBC, AudioCodes Mediant Cloud) include AI-driven anomaly detection that flags unusual traffic patterns: a sudden burst of short-duration calls to the same area code, registration attempts from new IP ranges, or unusual call-fail patterns. Oracle issued a major security update in January 2026 with 337 new patches for 5G IMS environments. Ribbon launched the Acumen AIOps platform in February 2026 for AI-driven voice modernization.
CallSphere does not operate its own SBC; it leverages Twilio's edge network, which provides SBC-equivalent functions (STIR/SHAKEN signing, fraud detection, codec normalization, rate-limiting). For BYOC customers and on-premises customers who terminate to their own infrastructure, CallSphere is compatible with Oracle, Ribbon, AudioCodes, and Cisco SBCs at the SIP boundary.
The Healthcare AI receptionist on FastAPI :8084 to OpenAI Realtime, the Sales Calling AI with five concurrent outbound on Twilio (SBC enforces the per-tenant concurrency cap), and the After-Hours AI with simultaneous call plus SMS and 120 second timeout all rely on Twilio's edge SBC for STIR/SHAKEN and fraud control. The 37 agents, 90+ tools, 115+ database tables, HIPAA and SOC 2 controls, and pricing tiers ($149/$499/$1499 for 1/3/10 numbers) include this baseline.
<!-- Pseudo-config: SBC dial-peer for AI tenant with rate limit -->
<dial-peer tag="ai-agent-tenant-acme">
<transport>tls</transport>
<ip-allowlist>10.42.0.0/24</ip-allowlist>
<codec-list>opus,G722,PCMU</codec-list>
<stir-shaken attestation="A" certificate="ref:vault/sti-cert"/>
<rate-limit calls-per-minute="120" max-concurrent="50"/>
<session-timer min="900" max="1800"/>
<inbound-rewrite uri-from="acme.callsphere.local" uri-to="agent@sbc.acme.com"/>
</dial-peer>
Do I need an SBC if I only use Twilio? No. Twilio's edge handles SBC functions. You may want one for BYOC, on-prem PBX, or specialized fraud control.
Still reading? Stop comparing — try CallSphere live.
CallSphere ships complete AI voice agents per industry — 14 tools for healthcare, 10 agents for real estate, 4 specialists for salons. See how it actually handles a call before you book a demo.
Cloud SBC or hardware SBC? Cloud SBC (Ribbon Cloud, Oracle Cloud, AudioCodes Live) is the 2026 default for new deployments. Hardware persists where regulatory or latency requirements force on-prem.
Does the SBC affect AI latency? A well-configured SBC adds 5 to 20 ms. A misconfigured one (with transcoding loops) can add 100+ ms.
How does the SBC interact with STIR/SHAKEN? It is usually the signing and verification point; certificate management lives there.
What is the cheapest viable SBC? Self-hosted FreeSWITCH with mod_sofia and STIR/SHAKEN modules, or a Kamailio + RTPengine combination, for teams with telecom expertise. Cloud SBCs from a marketplace start around hundreds of dollars per month for entry-tier capacity.
Start a 14-day trial on Twilio defaults, see pricing for 1, 3, or 10 numbers, or contact us about BYOC and on-prem SBC options.
Written by
Sagar Shankaran· Founder, CallSphere
Sagar Shankaran is the founder of CallSphere, where he builds production AI voice and chat agents deployed across healthcare, hospitality, real estate, and home services. He writes about agentic AI, LLM engineering, and shipping voice agents that handle real calls in production.
See how AI voice agents work for your industry. Live demo available -- no signup required.
An honest 2026 guide to VoIP desk phones. Hardware vs softphone, top picks, when an internet phone is worth it, and where AI voice agents fit.
The best business phone app in 2026 is the one with an AI agent attached. Compare options, costs, and what an AI phone app actually does for a small business.
A founder's guide to business phone systems in 2026. Cloud vs on-prem, AI voice agents, small business pricing, and what actually works for under 100 seats.
Where every millisecond goes between caller and AI: PSTN, carrier, STT, LLM, TTS, and back. The component-level targets that ship in 2026 and how to hit them.
STIR/SHAKEN, branded calling, opt-in lists, carrier reputation. How CallSphere builds outbound trust vs Vapi defaults. Real-world spam-flag remediation.
DTMF tone capture during agent speech, IVR-style menus, key suppression. How CallSphere handles DTMF via Twilio + custom logic vs Vapi defaults.
© 2026 CallSphere LLC. All rights reserved.