Voice Security for Webex Calling: From Call Reputation to Policy-Driven Protection

Executive Summary

Webex Calling customers now have a more powerful way to protect the enterprise voice channel. Mutare Voice Security for Webex Calling brings real-time call reputation intelligence, automated risk-based enforcement, and precise policy control together in a solution built specifically for, and fully integrated with, Webex Calling.

Mutare brings decades of enterprise voice expertise and a longstanding relationship with Cisco protecting voice communications across Unified Communications, Contact Center, Collaboration, and Cloud environments. As a leading provider dedicated to enterprise Voice Security, Mutare is extending that experience directly into Webex Calling to help organizations address a channel increasingly exploited by vishing, social engineering, impersonation, spoofing, and AI-powered attacks.

The Mutare Voice Security solution provides a broad-based reputational trust analysis for every inbound call. Users define threat-level thresholds that direct which calls should be Allowed, Challenged, or Blocked based on where they fall within the threshold allowances. Custom Rules then add precision to the process, enabling custom-tailored overriding policies to Allow, Block, or Challenge specific calling numbers, called numbers, or combinations of both that are unique to that organization’s business needs and environment. 

The result is purpose-built Voice Security for Webex Calling that moves organizations beyond identifying suspicious calls to actively controlling what happens next.

Article Highlights

• Mutare brings enterprise Voice Security directly into Webex Calling, building on a longstanding Cisco relationship protecting UC, Contact Center, Collaboration, and Cloud communications.
• Webex Calling customers can move from call reputation to policy-driven protection, combining real-time intelligence and Reputation Thresholds with Custom Rules for broad protection and precise control.
• Voice Security is an essential enterprise cybersecurity control, reducing the opportunity for vishing, social engineering, impersonation, and other voice-based attacks to reach the human endpoint.

Voice Is More Than a Communications Channel

For decades, enterprise voice has primarily been managed as a communications service. Keep the phones working. Maintain call quality. Route callers to the right destination. Make sure employees, customers, partners, and other legitimate callers can connect.  These requirements have not gone away. But the security environment around them has changed.

Voice provides something attackers value enormously: direct access to people. Vishing and impersonation attacks exploit human trust, while social engineering attempts to persuade employees to divulge information, surrender credentials, approve authentication requests, or take other actions that can compromise the organization. Generative AI further increases the challenge by making impersonation and automated attacks easier to execute and scale.

This creates an important cybersecurity distinction. An organization can invest heavily in protecting networks, endpoints, identities, email, and applications while leaving an entirely different path to the employee comparatively open: the phone.  Bottom Line:  Voice Security needs to be part of the broader enterprise security conversation.

The objective is not to interfere with legitimate communications. Effective Voice Security should help legitimate callers connect while reducing the likelihood that nuisance, suspicious, or malicious traffic reaches employees and other voice endpoints.

Call Reputation Is Intelligence. Protection Requires Action.

Call reputation provides an important foundation for making better security decisions. Mutare analyzes inbound calls to Webex Calling and assigns each a dynamic reputation score on a scale from 0 to 5. That score provides an indication of caller legitimacy and potential risk, giving organizations a quantified way to distinguish higher-risk traffic from questionable calls and higher-confidence callers.

But a score by itself does not protect anyone. The more important question are:

• What should happen next?
• Should the call be allowed to proceed?
• Should it be challenged to provide additional verification?
• Or does the risk justify blocking the call before it reaches its intended destination?

This is where call reputation becomes actionable Voice Security rather than simply another source of information. Webex Calling administrators can establish Reputation Thresholds that automatically determine how inbound calls are treated according to their reputation score. Higher-confidence calls can be allowed to proceed. Questionable calls can be challenged. Higher-risk traffic can be blocked.

Instead of relying solely on an employee to determine whether a caller should be trusted after answering the phone, organizations can apply a technical control before the interaction occurs. That represents an important shift in Voice Security: from identifying risk to acting on risk.

Broad Protection: Establish Risk Policy at Scale

Enterprise security controls work best when they translate organizational risk tolerance into consistent policy.

For Webex Calling, Reputation Thresholds provide that foundation. Administrators establish policies within Webex Control Hub that determine when inbound calls should be Allowed, Challenged, or Blocked based on their reputation score.

The goal, however, should not be to choose arbitrary thresholds and immediately begin blocking calls. A more deliberate approach begins with visibility. Organizations can initially observe inbound traffic while Mutare scores each call, allowing administrators to understand their unique voice environment before enforcing policy. By monitoring scoring patterns, administrators can better understand normal versus anomalous traffic, identify higher-risk clusters, and establish a baseline for their environment.

The Mutare client portal provides further insight into inbound call activity and allows administrators to model how different threshold decisions would affect call treatment before those policies are enforced within Webex Control Hub. That progression is important:

Visibility informs intelligence. Intelligence informs policy. Policy drives enforcement.

It also creates a more deliberate and defensible approach to Voice Security. Rather than treating call filtering as a static configuration or relying on generic defaults, organizations can establish policies informed by actual traffic patterns and their own risk requirements. But organization-wide thresholds also have an inherent limitation. Not every caller, destination, or business process is the same. That is where the next layer of control becomes particularly important.

Precise Control: Not Every Call or Destination Carries the Same Risk

Consider the different ways voice is used across a large enterprise. A main line may be designed to accept calls from virtually anyone. A reception desk may regularly interact with unknown members of the public. An IT help desk can be a particularly sensitive destination because of its role in supporting user access and technology. An executive line may warrant tighter protection. A call queue may have entirely different requirements based on its purpose and expected callers.

Applying broad, risk-based policy across the organization establishes an important baseline. But there will always be legitimate reasons to handle particular callers or destinations differently.

Custom Rules provide precision.

Within the Mutare client portal, administrators can create Custom Rules based on a specific calling number, called number, or combination of both. They can then determine whether matching calls should be Allowed, Challenged, or Blocked, overriding reputation-based treatment when organization-specific knowledge or requirements call for a different action. This creates a wide range of practical possibilities.

An organization may know that a particular business partner or vendor should be trusted. A known malicious number or number range may warrant blocking. A questionable caller may require verification regardless of its reputation score. Or a sensitive destination, such as an executive line or help desk, may require different handling than the organization-wide policy. The important point is that Custom Rules are not intended to replace reputation intelligence with an ever-growing list of manually maintained rules. They complement it.

Reputation Thresholds protect at scale. Custom Rules control the exceptions.

This distinction is central to the expanded Voice Security approach for Webex Calling; see our latest Press Release. Automated reputation intelligence provides broad protection across inbound traffic, while Custom Rules allow the organization to apply its own knowledge and security requirements where greater precision is needed.

Broad Protection. Precise Control.

Bringing robust capabilities together creates a more complete approach to Voice Security. Reputation intelligence provides an understanding of risk across inbound traffic. Reputation Thresholds turn that intelligence into broad, automated policy. Custom Rules add organization-specific precision when a particular caller, destination, or circumstance requires different treatment.

Together, these enable administrators to make more deliberate decisions about which calls get through and under what conditions. Importantly, that control includes more than simply Allow or Block. Questionable calls can be Challenged using voice CAPTCHA, creating an important middle ground between allowing suspicious traffic to proceed and potentially blocking a legitimate caller. Suspicious callers can be asked to validate themselves before connecting, helping organizations filter automated traffic while preserving access for legitimate human callers.

Ultimately, this empowers a more purposeful and effective security model. High-confidence calls can flow. Higher-risk calls can be stopped. Uncertain calls can be challenged. And specific callers or destinations can receive different treatment when the organization knows something that reputation intelligence alone cannot…policy-driven Voice Security.

From Voice Management to Cybersecurity Control

The most important change may ultimately be how organizations think about protecting their Webex Calling environment. Voice Security should not be treated simply as another telephony feature. Reducing nuisance calls is valuable, but the security opportunity is much greater. Voice is also used for vishing, social engineering, impersonation, credential harvesting, and other attacks designed to reach and manipulate employees. Protecting the voice channel therefore contributes directly to protecting the human attack surface. That requires the same discipline organizations increasingly expect from other cybersecurity controls. 

Policies should be informed by visibility. Thresholds should reflect organizational risk. Custom Rules should have a business or security rationale. Policies should be monitored and periodically reevaluated as callers, business relationships, traffic patterns, and threats change.

Custom Rules, in particular, should not become “set and forget” exceptions. A trusted vendor relationship can end. Phone numbers can change ownership. A blocked range can eventually serve legitimate callers. Rules should be documented, governed, and periodically reviewed alongside the broader reputation policy. The result is a more mature model for enterprise Voice Security: visibility, intelligence, policy, enforcement, governance, and continuous improvement.

Built for Webex Calling. Backed by Enterprise Voice Security Expertise.

Technology integration matters, particularly when security controls are being introduced into a business-critical communications environment. Mutare Voice Security is integrated directly with Webex Calling as a Certified Call Reputation Provider. Webex Calling customers can activate Mutare through the Caller Reputation Service within Webex Control Hub, without introducing additional hardware or complex infrastructure changes.

But the relationship between Mutare and Cisco goes well beyond this latest capability. Mutare has a longstanding relationship with Cisco protecting enterprise voice communications across Unified Communications, Contact Center, Collaboration, and Cloud environments. That experience matters because Voice Security cannot come at the expense of the communications businesses depend on every day.

As the industry-leading enterprise Voice Security provider, Mutare brings decades of voice technology experience to that challenge. The objective is not simply to identify unwanted traffic. It is to introduce effective security controls while preserving legitimate communication and fitting naturally within the communications environments organizations already operate.

For Webex Calling customers, that means Voice Security does not need to become another technology silo. It is an integrated layer of protection within the Cisco environment they already depend upon.

Protect the Human Before the Conversation Begins

Cybersecurity teams spend enormous effort helping employees become more resistant to social engineering. Awareness and training remain important, but every malicious interaction that reaches an employee still creates an opportunity for the attacker. Voice Security provides another line of defense: reduce the opportunity for dangerous interactions to occur in the first place.

For Webex Calling customers, real-time reputation intelligence establishes what is known about an inbound call. Reputation Thresholds translate that intelligence into broad policy. Custom Rules provide precision for the callers and destinations requiring different treatment. Allow, Challenge, and Block turn those decisions into action.

The progression is straightforward:

Know the risk. Establish the policy. Control the exceptions. Protect the human.

As voice-based social engineering, impersonation, and AI-powered attacks put greater pressure on the human attack surface, identifying suspicious calls is no longer enough. Organizations need the ability to act on that intelligence before the caller reaches the intended target.

For Webex Calling customers, that is the promise of a more complete approach to Voice Security: broad protection, precise control, and an integrated technical defense around the people attackers are trying to reach.