Managed SD-WAN is a service in which a provider designs, operates and monitors a software defined wide area network that links your offices, data centers and cloud services. You gain simpler operations and traffic steering. You also hand a third party control over routing and policy, so visibility and access terms matter.
What does it replace?
Traditional branch networks sent most traffic back to a central data center over fixed circuits. As applications moved to cloud services, that path became slow and costly. NIST SP 800-215, the guide to securing the modern enterprise network, describes the pressures: access to multiple cloud services, the geographic spread of IT resources and the move to microservices have changed the enterprise network. It also discusses the evolving wide area network and integrated security frameworks such as zero trust network access and secure access service edge.
SD-WAN separates the control layer from the forwarding devices. A central controller sets policy, such as which application uses which link, and branch devices apply it. Traffic can use cheap internet links alongside private circuits, and shift automatically when one degrades.
What does "managed" add?
A provider runs the controller, handles configuration, monitors links and often bundles connectivity and security functions. For small teams without network engineers that is a real benefit. The tradeoff is dependency: you rely on their staff, tools and processes for something that carries all your traffic.
What are the security questions to ask?
Who has administrative access? The provider's engineers can change routing and policy. Ask how their access is authenticated, logged and limited, and whether you can see an audit trail of every change.
Where are the keys and certificates held? Tunnels between sites are encrypted. Know who generates, stores and rotates the keys, and what happens at contract end.
What is the segmentation model? Can the guest network, point of sale devices and corporate users be kept in separate segments end to end, with rules you can review?
What do you see? Insist on access to logs and flow data, not just a monthly report.
Is traffic inspected, and where? If security services run in the provider's cloud, your traffic passes through their systems. Check data handling, location and retention.
What happens when the controller fails? Edge devices should keep forwarding with the last good policy. Ask for failure behavior in writing.
Constructed example: a retail chain
A chain with 80 shops adopts managed SD-WAN. Each shop gets a device, and card payment terminals are placed in a separate segment. During a review, the retailer asks for the change log and finds that a provider engineer had added a temporary rule allowing a shop's guest segment to reach the payment segment during a troubleshooting call, and never removed it.
Nothing malicious occurred, but the exposure existed for months. The retailer now requires change approval through its own ticket system, a monthly rule export, and an alert on any rule touching the payment segment.
How do the pieces fit with zero trust?
SD-WAN solves connectivity. It does not decide who may access which application. Pair it with identity based access controls, so a user on a branch network gets no more trust than one at home. NIST SP 800-207 on zero trust architecture makes this point: no implicit trust based on network location.
How to check or apply this
- Write down the traffic you carry, which applications matter and which segments you need.
- Ask the provider for its administrative access model, logging and change process in writing.
- Require exports of configuration and logs you can store independently.
- Keep the encryption key and certificate handling clear in the contract, including exit.
- Define segmentation rules yourself and review them monthly.
- Test failure behavior: unplug a link, and test the controller outage plan.
- Layer identity based access on top, instead of trusting the branch network.
Quick check
Does SD-WAN replace a firewall?
Not by itself. Some products bundle firewall features, but you should confirm what is included and who manages the rules.
What is the main risk of managed service?
Dependency and access. The provider can change routing and policy, so you need audit logs, change approval and clear exit terms.
Sources
- NIST SP 800-215, secure enterprise network guide
- NIST SP 800-207, Zero Trust Architecture
- NIST SP 800-41 Rev. 1, Guidelines on Firewalls and Firewall Policy
Last reviewed: 18 October 2026.
