CISOs should join a WAN edge transformation at the start because the project decides where traffic is inspected, who can reach what, and who owns the logs. Those are security decisions made inside a networking project. Retrofitting them after the contracts and routing designs are signed is slower and costs more than writing them in as requirements.
What is changing at the edge?
A WAN edge project usually replaces fixed branch routers and private circuits with software-defined routing over ordinary internet links, often with cloud-delivered security services. Traffic that once flowed back through a central data center may now leave directly from each branch to the internet and to cloud applications.
That moves the perimeter. The NIST zero trust publication, SP 800-207, describes the broader trend: it defines zero trust as moving defenses from static, network-based perimeters toward users, assets and resources, with no implicit trust based only on network location. It cites remote users, bring-your-own-device and cloud-hosted assets outside an enterprise network as the trends driving it. A WAN edge redesign is where that principle becomes either a design or an accident.
What goes wrong when security arrives late?
Constructed example: a retail chain picks an edge platform on price and performance. Branches get direct internet breakout. Months later, the security team asks where web filtering and outbound inspection happen, and learns that the licensed tier excludes them for the branch devices. Adding them means a new contract, new configuration at two hundred sites, and a gap period. None of this was malicious. Nobody asked early.
Typical late discoveries:
- Management planes exposed to the internet, or shared administrator accounts.
- Flat connectivity between branches, so one compromised store can reach another.
- Logs kept for days at the device and never sent to your monitoring.
- Encrypted traffic that nothing inspects, with no documented decision.
- Unclear ownership between network and security teams when an alert fires.
What should the CISO bring to the table?
Requirements, in plain terms. NIST SP 800-41 on firewalls recommends establishing firewall policy and covers selecting, configuring, testing, deploying and managing firewalls. Its advice predates cloud-delivered security, so use it for the discipline of writing the policy first.
Bring these questions:
- Segmentation: which sites, device types and applications must be separated?
- Identity: how are administrators authenticated, and is multi-factor required?
- Inspection: what is inspected, where, and what is explicitly out of scope?
- Visibility: which logs are exported to which system, retained for how long?
- Resilience: what happens to security enforcement if a cloud service is unreachable?
- Supply chain: how does the vendor deliver and sign updates, and handle vulnerability disclosure?
- Exit: can you export configuration and move away?
Who owns what?
Decide this before go-live. A common split: network engineering runs routing and the platform, security sets policy and reviews changes, and an on-call rota covers both. Document who approves a rule change, who responds to an edge device alert, and how emergencies are handled.
Record the shared view of risk too. CISA's Cross-Sector Cybersecurity Performance Goals, aligned with NIST CSF 2.0, start with maintaining an asset inventory of all assets with an IP address, updated at least monthly, and with a single leader accountable for cybersecurity. Edge devices belong on that inventory from day one.
How to check or apply this
- Ask to join the project steering group before vendor selection.
- Write security requirements as acceptance criteria, in the request for proposal.
- Draft the traffic and segmentation policy before the design, and review the vendor's design against it.
- Require MFA, role-based access and no internet-exposed management.
- Decide log export, retention and alerting before pilot sites go live.
- Run a pilot with a tabletop exercise: an edge device is compromised, what happens?
- Add edge devices to the asset inventory and the patching process with named owners.
- Review the design after six months and adjust.
Where does Safeguard fit?
Safeguard is not a network or edge security product. It can help the same program on the software side by scanning the applications and automation code, such as infrastructure scripts, that surround the edge platform.
Quick check
Is WAN edge a networking project or a security project?
Both. It changes routing and the security perimeter at once, so decisions on inspection, segmentation and logging belong in the same plan.
What is the first thing a CISO should ask for?
A seat in vendor selection and a written list of security requirements, so that inspection, identity and logging are part of the buying criteria and not later add-ons.
Sources
- NIST SP 800-207, Zero Trust Architecture
- NIST SP 800-41 Rev. 1, Guidelines on Firewalls and Firewall Policy
- CISA, Cybersecurity Performance Goals
Last reviewed: 18 October 2026.
