Hardware & Endpoints
Session Border Controller (SBC)
By Myroslav Orshak · operates licensed carrier infrastructure · Updated September 2026
A session border controller (SBC) is a device or service that sits at the edge of a network and controls phone calls crossing it — in practice a firewall built specifically for voice, which an ordinary firewall handles badly.
How it works
It sits between your phone system and the outside world, and every call in or out passes through it. It checks that calls come from somewhere allowed, limits how many run at once, and handles the encryption. It also translates between the different dialects of SIP that different systems speak, since two vendors implementing the same standard rarely agree on every detail.
It also solves the audio problem that ordinary firewalls create. Because voice splits signaling from the audio stream, a normal firewall sees an inbound audio stream nobody requested and drops it. An SBC understands that the two belong to the same call, which is why it fixes one-way audio that a general-purpose firewall causes.
Why it matters
The strongest argument is money. A phone system exposed to the internet gets found by automated scanners within days, and a compromised extension can place thousands of dollars of international calls overnight. An SBC is what enforces the limits — where calls may come from, how many at once, which destinations are permitted — that turn a catastrophic bill into a blocked attempt.
The practical question, though, is whether you need one at all, and for most businesses the answer is no. If you buy a hosted phone system, your provider already runs SBCs at their edge and it is included in what you pay. You need your own when you run your own phone system on your premises, connect SIP trunks directly, or have a compliance requirement to control voice traffic at your own boundary.
Own PBX on site plus direct SIP trunks: yes. Hosted or cloud phone system: no — your provider operates them and the cost is inside your subscription. The middle case is a hybrid deployment, where it depends on who owns the connection to the carrier.
Related terms
Ready to pick a provider?
Compare SIP trunk providers →Frequently asked questions
Do I need a session border controller?
Only if you run your own phone system on your premises and connect SIP trunks to it directly. If your phone system is hosted in the cloud, your provider already operates SBCs and the cost is inside your monthly price. Most small businesses will never buy one.
Is an SBC just a firewall?
It is a firewall that understands phone calls, which an ordinary one does not. A general-purpose firewall sees the audio stream as unrequested inbound traffic and blocks it, causing the classic one-way-audio fault. An SBC knows the audio and the signaling belong to the same call.
What does an SBC cost?
It varies enormously, from software on a server you already own to dedicated hardware costing thousands. Cloud SBC services are billed per simultaneous call. Before pricing any of it, confirm you actually need one, because for hosted phone systems the answer is usually no.
Can an SBC stop toll fraud?
It is one of the main defenses, though not the only one. It enforces where calls may originate, how many run at once and which destinations are allowed, which caps the damage from a compromised extension. It does not replace strong passwords, which is what stops the extension being compromised in the first place.