Hybrid SD-WAN combines more than one kind of underlying link, typically a private service such as MPLS plus broadband internet and sometimes cellular, under a single software controller that steers each application over the best path. It makes sense when you need predictable performance for some traffic and cheaper capacity for the rest.
What does hybrid mean here?
The "hybrid" is in the underlay, the physical or provider links. An overlay of encrypted tunnels, commonly IPsec, runs across them. The controller applies policy, such as sending voice over the private circuit and bulk backups over broadband.
MPLS layer 3 VPNs are defined in RFC 4364, and provider-provisioned VPN terminology is set out in RFC 4026. Those services are private by contract and routing separation, not by encryption. The broadband side crosses the public internet, so tunnels there must be encrypted. NIST SP 800-77 Rev. 1 is the reference for IPsec design choices.
Why not just one link type?
All-MPLS is predictable but expensive per megabit and slower to deploy. All-broadband is cheap and fast to deploy, but quality varies. Hybrid lets you move the traffic that cares about quality to the better path and keep the rest on cheap capacity. It also gives you a failover when one carrier has an outage.
A constructed example
A retailer has 120 stores. Payment traffic and inventory sync go over a private circuit at each store. Guest Wi-Fi, software updates and video training go over broadband. When the private circuit drops, payment traffic fails over to an encrypted tunnel over broadband and an alert opens a ticket. The store stays open, and the finance team sees in the logs exactly when it switched.
What are the security tradeoffs?
Two paths, two trust levels. Private circuits carry less exposure to the open internet, but they are not encrypted by default. Decide whether you also encrypt traffic over them.
Local internet breakout. Sending cloud traffic straight out at each site saves latency, but each site now needs protection, since a central firewall no longer sees that traffic. This is the same inspection trade you face with VPN split tunneling.
Controller risk. The central controller can change routing and policy for every site, so protect its administrator accounts, use MFA, and log every change.
Segmentation. Keep payment, corporate and guest traffic in separate segments across the overlay, so one site compromise does not open the whole network. NIST SP 800-207 argues for access decisions that do not depend on network location alone.
Device lifecycle. Branch devices are on the edge of the network. Keep their firmware current and watch advisories for your product.
When does it not make sense?
For a company with three offices and mostly cloud apps, a direct internet connection with a secure access model may be simpler. Hybrid pays off with many sites, strict uptime needs or traffic types that really differ.
How do you measure success?
Pick a few numbers before the rollout: time to bring up a new site, application response time at each site, minutes of outage per quarter, and cost per megabit by link type. Compare them after six months. If failover works and costs fall but outages are unchanged, the underlays are not the weak point and the effort should go elsewhere.
How to check or apply this
- List applications by their needs for latency, loss and availability, and decide which need the better path.
- Choose underlays per site based on availability of private circuits and the cost of a second link.
- Encrypt overlay tunnels everywhere and decide whether private circuits also carry encrypted tunnels.
- Define segments and policies for payment, corporate, guest and device traffic.
- Decide where internet breakout occurs and what inspection happens at that point.
- Protect the controller with MFA, role separation and change logs.
- Test failover by pulling a link at a pilot site and measuring what the user sees.
Quick check
Is SD-WAN a security product?
No. It is a routing and policy system. Some products add security features, but you still need segmentation, inspection and access control.
Does MPLS need encryption?
MPLS VPNs separate customers by routing, not encryption. Whether to add encryption depends on your data and your trust in the carrier.
Sources
- RFC 4364, BGP/MPLS IP Virtual Private Networks
- RFC 4026, Provider Provisioned VPN Terminology
- NIST SP 800-77 Rev. 1, Guide to IPsec VPNs
- NIST SP 800-207, Zero Trust Architecture
Last reviewed: 18 October 2026.
