What Is SD-WAN?

Software-Defined Wide Area Networking (SD-WAN) is a technology that applies software-defined networking (SDN) principles to enhance wide-area network (WAN) performance. It connects branch offices and users to enterprise applications, dynamically routing traffic across multiple WAN connections based on real-time latency, jitter, and packet loss.

Ideal for multisite deployments, this approach improves resource usage and simplifies WAN management by eliminating the need to configure and maintain separate routers, firewalls, and VPNs at each data center, cloud, or branch location.

Traditional WAN

Legacy WAN architectures were built for a time when branch users accessed applications hosted on servers in the data center over fixed Multiprotocol Label Switching (MPLS) circuits. Backhauling that traffic through a central hub is no longer efficient in a cloud-centric world, as it adds latency that degrades application performance and increases bandwidth costs.

Today, most organizations run a large share of their workloads in public clouds, and traffic patterns are predominantly branch-to-cloud and user-to-SaaS. A 2025 State of the Cloud Report reveals that cloud spending is projected to grow by 28% in the coming year, driven by ongoing cloud migration and new cloud workloads.

SD-WAN addresses this shift by providing organizations with a more cloud-ready, cost-efficient network model for connecting users to applications, ensuring reliable performance without sacrificing security or data privacy.

Key Components of SD-WAN Architecture

An SD-WAN architecture is built on three core components: a centralized controller for management, edge devices at each site, and a virtual overlay that connects them. Deployments can use virtual or physical nodes, and advanced designs often add WAN optimization and integrated security to support SASE.

  • SD-WAN edge. The device or software deployed at each network location. It receives instructions from the controller on how to route or prioritize traffic, applies local policies, and measures link health in real time.
  • SD-WAN controller. The controller runs the control plane software that monitors network conditions and orchestrates traffic flow between all SD-WAN edges. Administrators define business and security policies on the controller, and the controller then directs the edges accordingly. It is typically cloud-hosted for high availability and easy access.
  • SD-WAN orchestrator. The orchestrator provides centralized management and coordination for the SD-WAN. In some architectures, it is bundled with the controller or delivered as a portal that handles device lifecycle and global configuration, while the controller makes real-time routing decisions.
  • Transport layer. The SD-WAN overlay operates on various physical connections, including MPLS, broadband, fiber, DSL, cable, 4G/5G, and satellite. Key to SD-WAN’s flexibility is its agnosticism toward transport types, enabling intelligent path selection. It can use all links actively or in a load-sharing mode, unlike traditional designs, where backup links remain idle.
  • Virtual or physical nodes. These are gateway nodes in strategic locations or cloud platforms that help extend the SD-WAN. They are critical in multi-cloud or large networks for efficient traffic distribution.

How SD-WAN Works

SD-WAN works by intelligently routing traffic based on business policies and real-time network conditions. It continuously evaluates the performance of all available network links and uses application-aware routing to steer traffic and maintain uptime.

Here’s a look at this process:

1. Deployment of SD-WAN edges

Each branch office, remote site, or data center is equipped with an SD-WAN edge device (a physical appliance or a virtual router). This device connects to all available WAN transport links at that location. For example, an MPLS circuit, one or more broadband Internet connections, and a 4G/5G LTE link. These connections form the underlying transport layer for the SD-WAN.

2. Overlay network and tunnels

The SD-WAN edges establish a secure overlay network, often using encrypted tunnels (such as IPsec VPN) over the internet and other links. Through this overlay, each SD-WAN node can communicate with others across any available path. A branch’s SD-WAN device might have tunnels to a data center hub and to cloud gateway nodes, enabling multiple traffic paths.

3. Centralized SD-WAN controller

When using SD-WAN, traffic and security policies are created centrally on the controller. For example, an administrator can set rules like “Send all Microsoft 365 traffic directly to the internet using the lowest-latency link,” or “Prioritize all voice and video traffic.” The controller then pushes those policies to every SD-WAN edge device across your network.

4. Dynamic path selection

Each edge enforces the same rules locally, monitors network conditions (latency, jitter, packet loss), and selects the best path that complies with the central policy. If a link degrades or fails, the edge device reroutes traffic to a better-performing path, ensuring consistent behavior without manual configuration at each site.

5. Application-aware routing

Unlike traditional routing, which treats all traffic equally, SD-WAN can continuously adapt to ensure critical applications get the bandwidth they need to run smoothly. Real-time voice or video traffic can be prioritized and sent over the lowest-latency path, while a bulk data backup is sent over a cheaper broadband link.

Benefits of Using SD-WAN

SD-WAN delivers tangible benefits over rigid legacy networks by optimizing application performance, reducing network costs, and simplifying WAN management for multi-site organizations.

  • Centralized management. Administrators define policies in a single interface and apply them everywhere. Troubleshooting is streamlined with end-to-end visibility of application performance across the WAN from the SD-WAN controller. This centralized management lowers the operational burden on IT teams, making it easier to scale distributed networks.
  • Cloud-centric routing. Branch sites can access Microsoft 365, Salesforce, AWS, or Azure directly via their local internet connection. This cloud-first design makes connectivity to cloud applications more efficient.
  • Improved security. All site-to-site communications are typically encrypted by default. SD-WAN also enables network segmentation to limit the blast radius of an attack. Centralized control means security policies can be updated network-wide in seconds.
  • Cost efficiency. Instead of relying on costly private MPLS circuits, SD-WAN enables you to build a hybrid network. You can combine your high-priority MPLS line with low-cost, high-bandwidth broadband and 5G. This reduces your carrier costs while improving network resiliency.
  • Better user experience. SD-WAN uses real-time traffic monitoring and quality-of-service (QoS) policies to ensure critical applications perform well. Users experience fewer drop-outs on calls, faster SaaS application responses, and more reliable connectivity.
  • Scalability. Setting up a new site can be quick and straightforward. Typically, you ship an edge device, connect it, and it automatically configures itself. Companies can expand to new branch locations or support mergers and acquisitions much faster than with legacy WAN setups.
  • SASE readiness. Many providers are evolving their platforms into Secure Access Service Edge (SASE) offerings, enabling your SD-WAN solution to integrate with or upgrade to include features such as Zero Trust Network Access (ZTNA) and Next-Generation Firewalls (NGFW).

What Are the Different Types of SD-WAN Deployment Models?

The main deployment models for SD-WAN are defined by who owns, hosts, and manages the network’s core components, specifically the SD-WAN controller and edge devices. Choosing the right deployment model will depend on your organization’s needs and resources.

1. DIY SD-WAN

The enterprise purchases or licenses an SD-WAN product and manages the entire deployment in-house, including setting up policies and handling ongoing maintenance. In a DIY model, you can tailor the SD-WAN to your specific requirements and change providers if needed. However, it also requires the most expertise and effort.

2. Fully managed SD-WAN

A telecom carrier or managed service provider supplies the SD-WAN technology (their choice of vendor or their platform), deploys the devices, and manages everything from configurations to monitoring and maintenance. Fully managed SD-WAN can sometimes cost more than DIY, but it may be a good option for organizations with limited IT staff or those who prefer to focus on core business rather than network management.

3. Hybrid managed SD-WAN

SD-WAN responsibilities are split between your team and the provider. The provider may handle initial deployment and underlying connectivity, but your IT staff retains control over defining routing policies or making configuration tweaks via a management portal.

Alternatively, the provider might handle routine monitoring and firmware updates while you handle day-to-day policy changes.

4. Managed CPE SD-WAN

The provider is responsible for managing the physical customer premises equipment (CPE) at each site. It removes the burden of device lifecycle management, such as replacements and patches, from your IT team while maintaining control over network policies.

5. SD-WAN as a service

SD-WAN capabilities are delivered via a subscription-based cloud service with minimal hardware on-site. Similar to the Network-as-a-Service (NaaS) model, companies can benefit from SD-WAN without deploying large controllers or managing infrastructure. This model uses a pay-as-you-go approach, shifting expenses from capital expenditure to operating expenditure.

What Are the Challenges Associated With SD-WAN?

While SD-WAN adoption solves many legacy problems, it trades the challenge of managing hardware for new complexities in policy and security. IT teams must now secure a dissolved network perimeter, troubleshoot performance across a dynamic multi-path network, and manage the physical underlay connections from multiple providers.

1. Security and visibility gaps

SD-WAN is designed to enable direct internet access from branches, thereby dissolving the traditional “castle-and-moat” security perimeter. This creates a perfect environment for shadow IT to flourish, as employees can bypass central security. The loss of visibility also means IT teams must integrate complex, branch-level security (like SASE) and deploy new tools to monitor SD-WAN traffic.

2. Troubleshooting

In a legacy network, a static path made it clearer where a problem might be. In SD-WAN, a user’s traffic might take different paths at different times, complicating root cause analysis. If an application is performing poorly, determining whether the problem lies with the underlay, the overlay’s policy, or the app itself can be tricky without strong diagnostic tools.

3. Managing network providers

While SD-WAN manages traffic, it doesn’t control the physical network links (underlay), so all provider management (from provisioning new circuits to troubleshooting an outage) remains a slow, manual process outside its control. IT teams must still manage the relationships and contracts for a complex hybrid mix of broadband, 5G, and private MPLS.

SD-WAN and Zero Trust

SD-WAN delivers incredible speed by giving branches a direct path to the internet, but that very path bypasses your primary firewall, leaving you with a much larger and more complex attack surface to defend.

Since you can no longer trust a user just because they are on the network, SD-WAN adoption almost always requires a move to a Zero Trust security model. Zero Trust operates on a “never trust, always verify” principle, enforcing granular controls for every access request by verifying user identity, checking device posture, and granting least privilege access.

However, a Zero Trust architecture is only as effective as its visibility. With traffic now distributed, security teams must be able to monitor all traffic (including local internet breakouts and east-west communications) for signs of compromise. This requires an Extended Detection and Response (XDR) platform that can correlate signals across the entire network for automated threat detection and response.

Secure Your SD-WAN Deployment with Group-IB

A report published by Gartner found that 72% of organizations identify security as their top concern when it comes to SD-WAN adoption. With threat actors actively exploiting the implicit trust of flat, distributed networks, securing these environments demands strong detection and response capabilities.

Group-IB offers comprehensive visibility and threat mitigation designed for the distributed nature of SD-WAN. Here’s how our cybersecurity solutions complement your deployment:

  • Attack Surface Management continuously scans and maps your organization’s external attack surface, including websites, public cloud resources, network endpoints, and potential Shadow IT services. The platform then provides alerts and analysis on vulnerabilities or misconfigurations in those assets and prioritizes fixes with guided remediation. As you deploy new SD-WAN sites, those external-facing elements are added to the monitoring.
  • Managed XDR ingests logs from SD-WAN controllers or uses APIs to pull telemetry, ensuring that even the network events in the SD-WAN fabric, like unusual traffic patterns, are fed into the detection engine. It uses advanced analytics and Threat Intelligence to detect signs of intrusion or malicious activity, providing 24/7 oversight and automated response.
  • Our security experts help break down the silo between networking and security. We can perform Vulnerability Assessments on your SD-WAN while also working with your team to baseline traffic flows. This process defines “normal” behavior, making anomalies stand out and improving threat detection.

This unified approach ensures your network deployment becomes fully integrated with security operations, enabling continuous monitoring and response rather than functioning as a standalone tool.

Get in touch with Group-IB experts today to discuss how we can achieve this security posture for your SD-WAN.