Choose DIY SD-WAN when you have network and security engineers on call and want control of policy and data. Choose managed SD-WAN when you have many sites, few staff and need someone else to carry operations. The deciding factor is rarely features. It is who answers the pager and who holds the keys.
What does an SD-WAN do?
NIST's guide to securing enterprise networks (SP 800-215) lists the design goals common to all SD-WAN offerings. They include extensive connectivity, securely joining users anywhere to applications anywhere over any WAN transport such as MPLS, broadband, 4G, LTE or 5G. They include application awareness, where the system monitors traffic and chooses a path based on traffic type and network load. And they include integration of security and networking functions, sometimes with a single management console for the network and the security appliance at a branch.
NIST also describes an integrated services model, SASE, in which networking and security are delivered together as a cloud service through points of presence. It names four primary functions: traffic optimization, access control, threat prevention and uniform security policy with centralized visibility.
Whether you run this yourself or buy it as a service, these are the jobs to be done. The question is who does them.
What does DIY really involve?
You choose hardware or virtual appliances, run the controller or orchestrator, write policy, keep every edge device patched, monitor path quality, manage certificates and keys, and handle circuit problems with carriers. In exchange you have direct control over configuration, logs and data paths, and your costs are visible line by line.
The hidden costs are on-call coverage and the skills gap. A branch network that fails on a Friday evening needs someone who can read the controller, the carrier ticket and the firewall policy at the same time. DIY also makes you responsible for patch speed on the edge devices, which sit on the internet.
What does managed involve?
A provider operates the overlay, often the underlay circuits as well, and gives you a portal and a service agreement. You gain operational capacity and faster rollout across many sites. You also give up some visibility and some control, and you add a party with privileged access to your network.
That last point matters for security. The provider's staff, tools and own supply chain become part of your trust boundary. Ask what access they have, how it is logged and how you would remove it.
How do you decide?
These questions separate the cases. They are our reasoning, not a standard.
How many sites, and how fast will it change? Dozens of small sites with few engineers lean managed. A handful of large sites with strong network staff lean DIY.
Who can respond at 2 a.m.? If the answer is a person who also runs email, lean managed or hybrid.
How sensitive is the traffic, and where must logs live? Strict data residency or log ownership requirements push toward DIY or a managed service with customer-held keys and exportable logs.
How do you want to handle security services? If you plan to bundle firewalling and web filtering in the same service, check who runs the policy, because shared policy ownership is a common source of gaps.
What is the exit? Ask how you take configuration and logs with you, and how long migration takes.
A constructed example
A retailer with 60 small stores and a three-person IT team prices both options. DIY looks cheaper per site but needs a second network engineer and an on-call rotation it cannot staff. They choose managed, with contract terms that require named administrators, log export to their own storage, and a notice period for any change to the service's own access. After a year they keep the overlay managed but move firewall policy ownership in-house, because the stores' needs change faster than the provider's change process.
How to check or apply this
- Count sites, engineers and the hours of coverage you can actually staff.
- List the security functions you need at the edge and decide who owns each policy.
- For managed, ask for provider access, logging and incident notification terms in writing.
- Require log and configuration export, and test it during the trial.
- For DIY, plan patching of edge devices and the controller on a schedule, with a rollback.
- Pilot at three sites, including a failure drill, before committing the rest.
- Reassess yearly. Hybrid arrangements are common and legitimate.
Quick check
Is managed SD-WAN more secure than DIY?
Not automatically. A good provider may patch and monitor better than a small team, but you add a privileged third party. Judge it by the terms, access controls and your own ability to verify.
Does SD-WAN replace a firewall?
Some offerings integrate firewalling and other security functions, as NIST describes, but you still need to decide who writes and reviews that policy.
Sources
Last reviewed: 18 October 2026.
