What Is SD-WAN? How Software-Defined WAN Works and Its Security
Your three branch offices still send all internet traffic back to head office, and Microsoft 365 crawls every afternoon. So what is SD-WAN? It is software that connects your sites over any mix of links, such as MPLS, broadband and 5G, and steers each application down the best path. It also adds new things to secure.
What Is SD-WAN?
SD-WAN (software-defined wide area network) is a technology that uses software and a central controller to connect branch offices, data centers and cloud apps over any mix of links. It routes traffic by application, choosing the best path in real time, which improves performance and cost. Key features include:
- Central management of every site from one console
- Encrypted tunnels between sites over any internet link
- Application-aware routing and automatic failover
- Built-in or integrated security functions
SD-WAN Full Form and Meaning
SD-WAN stands for software-defined wide area network. “Software-defined” means routing decisions come from central software policy rather than being configured box by box.
How the WAN Evolved Into SD-WAN: A Short Timeline
SD-WAN makes sense once you see what came before it.
- Leased lines and frame relay (1990s): private circuits linked sites point to point. They were reliable, slow to change and expensive.
- MPLS (2000s): Multiprotocol Label Switching, standardized by the IETF in RFC 3031 (2001), let carriers run private, predictable networks between many sites. Applications lived in the head office data center, so routing everything there made sense.
- Cloud and SaaS (2010s): applications moved to Microsoft 365, Salesforce and cloud platforms. Backhauling branch traffic through head office to reach the internet added delay and filled expensive MPLS links.
- SD-WAN (mid-2010s onward): software overlays let businesses use cheaper broadband and 5G alongside MPLS, and break traffic out to the internet directly at each branch.
- SASE (2019 onward): the term secure access service edge, introduced by Gartner in 2019, describes combining SD-WAN networking with cloud-delivered security.
- 2026: CISA’s Emergency Directive 26-03 (February 2026) ordered US federal agencies to patch and hunt for compromise in exploited Cisco SD-WAN systems, a reminder that the SD-WAN control layer is now a prime target.
Each step solved the previous step’s problem and added a new security question. SD-WAN solved backhaul, but moved internet exposure out to every branch.
How Does SD-WAN Work?
Overlay vs Underlay
The underlay is the physical transport: MPLS circuits, broadband, fiber and 4G or 5G. The overlay is a virtual network of encrypted tunnels, usually IPsec, built on top. Applications see one network, whatever links sit underneath.
Control Plane, Data Plane and the Central Orchestrator
The data plane is the edge appliance at each site that forwards traffic. The control plane decides routes and shares policy between edges. The orchestrator, or manager, is where administrators set policy for every site at once. Because one console controls the whole network, it is also the most valuable thing to protect.
Application-Aware Routing and Dynamic Path Selection
The edge identifies traffic by application and measures each link’s delay, jitter and packet loss. Video calls might take the cleanest path, backups the cheapest and, if a link fails, traffic moves to another automatically.
SD-WAN Architecture and Deployment Types
On-Premises, Cloud-Delivered and Hybrid SD-WAN
Management and gateways can run in your own data center, be delivered from the vendor’s cloud, or combine both. Cloud-delivered options suit businesses with many small sites and heavy SaaS use.
SD-WAN as a Service (Managed SD-WAN)
A provider designs, runs and monitors the SD-WAN for a monthly fee. This suits businesses without network engineers, but you still own security decisions, so confirm who patches the edge devices and controllers and how fast.
Benefits of SD-WAN
- Better performance for cloud and SaaS apps through local internet breakout
- Lower link costs by adding broadband and 5G alongside or instead of MPLS
- Automatic failover between links
- Faster new-site setup through zero-touch provisioning
- Consistent policy across every site from one console
Is SD-WAN Secure?
SD-WAN can be secure, but it is not security by default. It encrypts site-to-site traffic and can segment networks, yet sending internet traffic directly from each branch means each branch now needs internet-grade protection, and the central controller becomes a high-value target.
Built-In Security: Encryption, Segmentation and Firewalling
Most SD-WAN platforms encrypt overlay traffic with IPsec, separate traffic types into segments (for example, guest Wi-Fi away from payment systems) and include basic stateful firewalling.
Main SD-WAN Security Risks
- Local internet breakout: each branch is now directly exposed to the internet and needs filtering and threat protection there.
- Misconfiguration: one bad central policy can apply to every site at once.
- Edge and controller vulnerabilities: CISA’s February 2026 directive covered actively exploited flaws, including CVE-2026-20127, an authentication bypass in Cisco Catalyst SD-WAN that let attackers add a rogue device to the control plane. CISA, the NSA and partners including the UK NCSC published joint hunt guidance for it.
Basic SD-WAN vs Secure SD-WAN
Basic SD-WAN focuses on routing with simple firewalling. Secure SD-WAN builds a next-generation firewall (NGFW), intrusion prevention (IPS) and URL filtering into the edge, or hands branch internet traffic to a cloud security service.
SD-WAN Security Best Practices
- Put the management and controller interfaces on a separate, restricted network, never directly on the internet.
- Require MFA and named accounts for every administrator, and log all policy changes.
- Patch controllers and edges quickly, and track vendor advisories and the CISA Known Exploited Vulnerabilities catalog for your product.
- Inspect local internet breakout traffic with NGFW features or a cloud security service.
- Segment traffic so guest, IoT and payment systems never share a path.
- Send SD-WAN logs to your monitoring tools, and alert on new or unexpected peer devices joining the overlay.
- Follow your vendor’s hardening guide and review it after each major upgrade.
SD-WAN vs MPLS vs VPN
| SD-WAN | MPLS | Site-to-site VPN | |
|---|---|---|---|
| Transport | Any mix: MPLS, broadband, 5G | Carrier private network | Internet |
| Management | Central, policy-based | Carrier-managed | Device by device |
| Application-aware routing | Yes | Limited (QoS classes) | No |
| Encryption | IPsec overlay | Not by default (private, not encrypted) | IPsec |
| Typical cost | Lower link costs, software subscription | Higher per-site circuits | Low |
SD-WAN uses VPN-style tunnels, but adds central control and application-aware path selection. Many businesses keep MPLS for some sites and add SD-WAN on top.
SD-WAN and SASE: How They Fit Together
SASE combines SD-WAN with security service edge (SSE) functions delivered from the cloud: secure web gateway, cloud access security broker (CASB), zero trust network access (ZTNA) and firewall as a service. SD-WAN handles the networking. SSE handles the security. You can adopt SD-WAN first and add cloud security later, or buy both from one vendor as single-vendor SASE.
Is SD-WAN Right for Small and Midsize Businesses?
SD-WAN pays off when you have several sites, heavy SaaS use or expensive MPLS circuits. A single office with one internet link gains little. A practical decision rule: if you have three or more sites, or branch staff complain that cloud apps are slow because traffic backhauls to head office, compare a managed SD-WAN or SASE service against your current costs.
US and UK Considerations (CISA, NIST, NCSC, Cyber Essentials)
In the US, CISA’s ED 26-03 and its supplemental hunt and hardening guidance apply directly to federal agencies, and CISA urges all organizations using affected Cisco SD-WAN systems to follow them. NIST SP 800-207 (2020) describes the zero trust principles that SASE builds on. In the UK, the NCSC co-authored the 2026 SD-WAN hunt guidance, and Cyber Essentials requires firewalls at internet boundaries, secure configuration and updates within 14 days, which applies to every branch with local breakout.
What Is SD-WAN Without Security? Your SD-WAN Checklist
What is SD-WAN worth to your business? Faster cloud apps and cheaper links, if the new exposure is managed. Before or after rollout, confirm:
- Controllers and management interfaces are off the public internet
- Every admin uses MFA, and changes are logged
- Patching for edges and controllers has a named owner and deadline
- Branch internet traffic is inspected
- Guest, IoT and payment traffic are segmented
If you would like help checking an existing deployment, Cyber Security Solutions Ltd offers a free network security assessment through our contact page.
FAQs
Not exactly. SD-WAN usually builds encrypted IPsec tunnels between sites, much like a site-to-site VPN, but adds central management, application-aware routing and automatic failover across multiple links. A VPN creates a secure tunnel. SD-WAN manages many tunnels and decides which link each application should use at any moment.
No. SD-WAN is primarily a networking technology that routes traffic between sites and the cloud. Many products include basic firewalling, and "secure SD-WAN" products add next-generation firewall features, but a basic SD-WAN edge is not a full firewall. Branches with direct internet access still need proper inspection and threat protection.
It can, but it does not have to. Some businesses replace MPLS entirely with broadband and 5G under SD-WAN control. Others keep MPLS for sites or applications that need predictable performance and use SD-WAN to add cheaper links and manage everything together. The choice depends on cost, performance needs and contract terms.
Software-defined networking (SDN) separates network control from forwarding hardware, usually inside a data center or campus. SD-WAN applies the same idea to wide area connections between sites and the cloud. SDN manages switching within a network, while SD-WAN manages routing across many links between locations. SD-WAN is often described as an application of SDN ideas to the WAN.
Costs depend on the number of sites, bandwidth, security features and whether you buy appliances, a subscription or a managed service. Vendors and providers price differently and change list prices often, so request quotes based on your own site count and links, and compare them with your current MPLS and support costs.
The main risks are unprotected local internet breakout at branches, misconfigured central policies and vulnerabilities in edge devices and controllers. CISA's 2026 emergency directive on exploited Cisco SD-WAN flaws showed attackers targeting the control plane itself. Keep management interfaces private, patch quickly and inspect branch internet traffic.
