SD-WAN did what it promised. Circuits got cheaper, provisioning got faster, and traffic steering became something you control rather than something you request.
What went less discussed is where the complexity went. It did not disappear. It moved from the carrier's operations team to yours.
The operational load you inherited
Under MPLS, the carrier owned path selection, quality of service, and the pager at 3am. Under SD-WAN you own the policy, the overlay, and the diagnosis when an application is slow for one branch.
That is a genuine improvement in control. It is only an improvement in outcome if someone has the time and the skills to exercise it.
Where it goes wrong
- Policy written once at deployment and never revisited as applications change
- No baseline, so "the network is slow" cannot be confirmed or refuted
- Internet breakout enabled per site without the security controls that assumed a central egress point
- One person who understands the overlay, and no documentation
The security assumption that quietly broke
Local internet breakout is most of the cost saving. It also removes the central chokepoint your security stack was built around. If inspection, filtering, and logging did not move with the traffic, the savings were partly funded by a reduction in visibility.