By Sagar Shankaran, Founder of CallSphere
If your AI voice gateway leaks Via headers, internal IPs, or model server hostnames, you have published your attack surface. Here is the SBC topology-hiding playbook for AI voice in 2026.
Key takeaways
A SIP trace from your AI voice agent should look like an opaque box. If an attacker can read your private IPs, SBC vendor, or which AI model handles which DID off the Via and Record-Route stack, you have made their reconnaissance free.
flowchart TD
Out[Outbound campaign] --> Twilio[Twilio Voice API]
Twilio --> STIR[STIR/SHAKEN attestation]
STIR --> Carrier[Originating carrier]
Carrier --> Term[Terminating carrier]
Term --> Recipient[Recipient phone]
Recipient --> Webhook[/voice webhook/]
Webhook --> Agent[AI sales agent]Topology hiding is the SBC function that strips internal-network information from SIP messages crossing the access or peering boundary. It rewrites or removes Via, Record-Route, Path, History-Info, Service-Route, and the SDP o= and c= lines so internal IPs and hostnames never appear in upstream signaling. The function exists because SIP was designed for transparency and proxies are obligated to record every hop they touch; topology hiding intentionally breaks that transparency at the trust boundary.
For AI voice gateways the stakes are higher than for traditional PBX SBC deployments. Your media servers are GPU-attached, expensive, and often run a homemade WebSocket bridge. Leaked hostnames invite targeted DoS, model fingerprinting, and SDP-based attacks on the bridge itself.
A typical un-hidden Twilio-to-AI bridge SIP trace looks like:
Hear it before you finish reading
Talk to a live CallSphere AI voice agent in your browser — 60 seconds, no signup.
INVITE sip:+19175551212@bridge.callsphere.ai SIP/2.0
Via: SIP/2.0/UDP edge-2.callsphere.ai;branch=z9hG4bK-abc
Via: SIP/2.0/UDP 10.42.7.91:5060;branch=z9hG4bK-def
Record-Route: <sip:edge-2.callsphere.ai;lr>
Record-Route: <sip:10.42.7.91:5060;lr>
Contact: <sip:bridge@10.42.7.91:5060>
That trace tells an attacker the bridge runs on 10.42.7.91 inside the private VPC. After topology hiding by the SBC the same INVITE looks like:
INVITE sip:+19175551212@bridge.callsphere.ai SIP/2.0
Via: SIP/2.0/TLS sbc-edge.callsphere.ai;branch=z9hG4bK-anon
Record-Route: <sip:sbc-edge.callsphere.ai;lr;tls>
Contact: <sip:bridge-anon@sbc-edge.callsphere.ai;tls>
Internal Via and Record-Route are coalesced or replaced; the Contact and SDP origin point to the SBC's public address. The SBC keeps the dialog state mapping internally so in-dialog requests still route correctly.
# Kamailio 6.0 example using topoh module
modparam("topoh", "mask_key", "callsphere2026rotateme")
modparam("topoh", "mask_ip", "1.1.1.1")
modparam("topoh", "uparam_name", "line")
modparam("topoh", "uparam_prefix", "tx_")
modparam("topoh", "vparam_name", "branch")
modparam("topoh", "vparam_prefix", "z9hG4bK.")
The Kamailio topoh module mask-encrypts internal hostnames into a token that the same node can decrypt on response, achieving topology hiding without breaking dialog routing.
CallSphere terminates every leg on Twilio Programmable Voice across all six verticals. Twilio's edge acts as our SBC; their *.twilio.com and *.pstn.twilio.com hostnames are the only addresses external SIP traces see. Behind Twilio our FastAPI :8084 Healthcare bridge, OpenAI Realtime endpoints, and the WebSocket bridges run on private VPC IPs that never appear in any SIP message. For Sales Calling AI's 5 concurrent outbound calls per tenant we set a custom From header through Twilio's API but rely on their SBC to strip everything internal. After-Hours AI uses Twilio simul call+SMS to on-call staff with a 120-second timeout where the SBC layer also enforces caller ID consistency. Across 37 agents, 90+ tools, 115+ DB tables, HIPAA + SOC 2 alignment, $149/$499/$1499 pricing, and the 14-day trial, no internal name resolves from a customer-side SIP trace.
User-Agent and Server headers; advertising "Asterisk 22.0.0" or "FreeSWITCH 1.10.11" is reconnaissance gift-wrapping.Does topology hiding break call recording or transcription? No, recording happens internally before or after the SBC and is not signaled in customer-facing SIP messages.
Still reading? Stop comparing — try CallSphere live.
CallSphere ships complete AI voice agents per industry — 14 tools for healthcare, 10 agents for real estate, 4 specialists for salons. See how it actually handles a call before you book a demo.
Will it break SIP REFER transfers? Properly implemented, no. The SBC has to mask and unmask Refer-To URIs, but every commercial SBC and Kamailio's topoh module handle this.
Is it required by HIPAA or SOC 2? Not by name. SOC 2 CC6 and HIPAA Security Rule 164.308 cover access controls; topology hiding is one specific control that supports the principle of minimum disclosure.
What about IPv6? Same rules. Strip internal IPv6 addresses as carefully as IPv4. The leak surface is identical.
Does Twilio do this automatically? Yes for inbound to your origin server. The hostname Twilio presents on the SIP trace is the public Twilio edge, not your private bridge.
Start a 14-day trial on a hardened SIP edge, see pricing, or contact us about SBC topology hiding for regulated AI voice deployments.
Written by
Sagar Shankaran· Founder, CallSphere
Sagar Shankaran is the founder of CallSphere, where he builds production AI voice and chat agents deployed across healthcare, hospitality, real estate, and home services. He writes about agentic AI, LLM engineering, and shipping voice agents that handle real calls in production.
See how AI voice agents work for your industry. Live demo available -- no signup required.
A founder's guide to the female voice generator landscape: AI female voices, Japanese voices, robot voices, and how CallSphere ships 57+ voices live.
MOS 4.3+ is the band where AI voice feels human. Drop below 3.6 and conversations break. Here is how to measure, improve, and alert on MOS in production AI voice using G.711, Opus, and the underlying packet loss / jitter / latency math.
Texas SB 1188 requires US-resident EHRs from January 1, 2026; Nevada's consumer-health-data law constrains health data; Colorado AI Act takes effect June 30, 2026. AI voice agents must architect for state-by-state data localization.
When your AI voice agent gets one-way audio, missed DTMF, or codec mismatch, sngrep and Wireshark are still the fastest path to root cause in 2026. Here is the playbook.
PCI DSS 4.0.1 future-dated requirements went mandatory March 31, 2025. AI voice agents that take card payments on behalf of healthcare providers — copays, deductibles, payment plans — must meet 12 requirements with DTMF masking and scope reduction.
Transcoding RTP to WebSocket is more CPU-intensive than people expect. For AI voice in 2026, where you place the transcode (edge near the carrier vs central near the model) decides your cost-per-minute.
© 2026 CallSphere LLC. All rights reserved.