What happens when SD-WAN traffic bypasses the data centre without equivalent controls?

Why bypassing the data centre changes the security model

When SD-WAN traffic takes a direct path instead of hairpinning through the data centre, the network may be faster and simpler, but the control model changes with it. The old hub often acted as the place where inspection, filtering, logging, and segmentation were assumed to happen. If those functions are not re-created at the edge or in-line, the design still works, but the security posture no longer matches the original trust model.

That is why the issue is not whether packets can reach their destination. The issue is whether the organisation still has equivalent control over what is allowed, what is visible, and what can be separated. In practice, bypass architectures force teams to decide which protections move with the traffic and which protections were only present because everything passed through the centre.

What control assumptions are most likely to break

The most common breakage is a silent gap between connectivity and enforcement. A branch, cloud workload, or remote site may continue exchanging traffic normally while the inspection point, segmentation boundary, or policy checkpoint has been removed from the path. NIST Cybersecurity Framework 2.0 is useful here because it forces the question of whether protect, detect, respond, and recover functions still exist after the routing change.

Another common failure is policy inconsistency. If the data centre used to centralise controls, teams may discover that the same traffic type is now handled differently depending on location, tunnel type, or exit point. That can create uneven enforcement, incomplete telemetry, and gaps in incident investigation. CIS Controls v8 is relevant because inventory, secure configuration, logging, and access control all become harder to trust when the network path changes but the control inventory does not.

In more mature environments, the right comparison is not “hub versus no hub”, but “equivalent control versus assumed control”. NIST Cybersecurity Framework 2.0 and CIS Controls v8 both support that shift in thinking, because the design question becomes whether monitoring, policy enforcement, and recovery can still be executed at the point where traffic now exits.

What good looks like when traffic no longer hairpins through the hub

Good design means the bypass path is not treated as an exception. Inspection, segmentation, and logging should be deliberately redistributed so they follow the traffic or are enforced at equivalent points of control. Where the bypass is to cloud services or SaaS, the equivalent guardrails may need to be at the branch, in the edge platform, or in the cloud security stack rather than in the legacy centre.

The practical test is whether an administrator can answer three questions quickly: what is allowed, where is it enforced, and how would we prove it worked during an incident? ISO/IEC 27001:2022 Information Security Management fits this scenario because it ties control selection to managed risk rather than to a specific network topology. If the topology changes, the controls must still be selected, owned, and tested for the new path.

NIST Cybersecurity Framework 2.0 also helps organisations judge whether the new routing model preserves detection and recovery, not just throughput. If a bypass design cannot show equivalent visibility, equivalent segmentation, and equivalent response evidence, it should be treated as a redesign problem, not a performance optimisation.

Risk and Threat Considerations

When traffic bypasses the data centre without equivalent controls, exposure increases because security functions can disappear from the path while business connectivity remains intact. That creates a false sense of safety: the system appears healthy, but trust boundaries, telemetry, and containment are weaker than before.

Failure mechanism: The organisation removes a central inspection or segmentation point without replacing its enforcement at the edge, so traffic flows normally even though policy checks are no longer consistently applied.

Impact: Unauthorised movement, reduced detection fidelity, and wider blast radius become more likely because compromised or misrouted traffic can traverse the bypass path with fewer obstacles.

Practitioner Guidance

What to verify: Confirm where inspection, segmentation, and logging now occur for each major traffic class. If the answer is “somewhere else”, require evidence that the new control point is equivalent in scope and enforcement before accepting the design.

Decision rule: If a bypass path removes a control that used to be relied on for containment or monitoring, treat the path change as a security architecture change, not a routing change. The implementation is only acceptable when the equivalent control set is explicitly documented and tested.

Practitioner takeaway: The goal is not to preserve the old hub, but to preserve the old security outcomes. If the new path is faster yet materially less observable or less enforceable, the organisation has traded away control for convenience.

Related resources from NHI Mgmt Group

• How should security teams enforce data residency controls for application traffic without adding operational complexity?
• What happens when biometric authentication is deployed without strong data protection controls?
• What happens when an MCP server is connected to an AI client without tight command and data controls?
• What happens when sensitive data is shared without proper redaction controls?