SD-WAN for Mid-Sized Companies with Multiple Sites: 2026 Field Report

A manufacturing company from Traunstein with around 120 employees opened a second site in Salzburg in spring 2026 — 45 workstations, its own production line, its own server room. The link back to headquarters initially ran over a classic site-to-site VPN connection based on a leased MPLS line. That worked fine as long as only email and one ERP terminal had to get through. As soon as the quality-assurance video system was running alongside, the connection dropped regularly. The case shows fairly precisely where classic site coupling hits its limits in the mid-market — and why we now recommend SD-WAN in almost every project like this.

Why classic site coupling runs out of headroom

An MPLS link is stable but rigid. Bandwidth is fixed and booked, every change needs an order placed with the carrier with lead times of several weeks, and all traffic runs over a single physical path. If the line fails, the site is offline — redundancy costs noticeably extra with MPLS. In the Traunstein/Salzburg case, usable bandwidth was 50 Mbit/s, sized for a business that by now generates far more traffic than was planned when the contract was signed four years earlier.

We see this pattern regularly in companies that grow or add locations: the network architecture was built for a state the company has long since outgrown. Retrofitting rigid lines is expensive and slow. This is exactly where SD-WAN (Software-Defined Wide Area Network) comes in — it bundles several internet connections (DSL, fibre, LTE/5G as backup) into one virtual, software-controlled network and dynamically routes traffic over whichever path is currently best.

SD-WAN in practice: what actually changes

For the switch in Traunstein we kept the existing fibre connection as the primary path and added a second, independent internet line as an active secondary path, plus an LTE backup for emergencies. The SD-WAN appliance prioritises traffic by application: video conferencing and the ERP system are routed preferentially over the most stable path, while large backup transfers are shifted to off-peak hours and the cheaper path. Total usable bandwidth rose from 50 to an effective 500 Mbit/s, at lower monthly cost than the old MPLS lease plus backup line combined — a saving of roughly 18 percent alongside higher resilience.

The real gain shows up in day-to-day operation, though: if one path fails, the system switches to the next within seconds, without employees noticing. In the six months following the migration, neither site experienced a noticeable connection outage — before that we were looking at an estimated four to five hours of downtime per quarter, spread across individual but operationally awkward incidents during video calls with customers.

Security cannot be an afterthought in the switch

One point that often gets too little attention in SD-WAN projects: as soon as several internet connections are actively in use, the attack surface grows compared with a single, fixed leased line. We therefore never deploy SD-WAN in isolation — always together with a next-generation firewall at each site and consistent network segmentation. Production network, office operations and guest access stay strictly separated, as recommended by the BSI IT-Grundschutz compendium in module NET.1.1 on network architecture and design. All traffic between the sites is additionally encrypted, regardless of which physical path it happens to take.

For companies already covered by NIS2 or looking to take out cyber insurance, this is not an optional extra. Documentation of network segmentation and failover concepts was part of the paperwork the insurer requested before signing the contract in the Traunstein/Salzburg case. Anyone planning an SD-WAN project should build in security from day one, not bolt it on afterwards — something we cover as part of our IT security & cybersecurity services.

What a switch actually costs and delivers

The migration itself took about three weeks in this project, from requirements gathering to both sites running in production — including a test phase in which both network architectures ran in parallel to avoid the risk of a hard cutover. The effort typically pays off from two sites upward, or as soon as a single site depends on one line whose failure would genuinely threaten operations.

Not every company needs SD-WAN. A single site with a stable fibre connection and no redundancy requirement is often better served by a classic firewall setup — the complexity of an SD-WAN deployment has to be worth it. But with multiple sites, growing bandwidth needs, or cloud services that depend on stable connectivity, the calculation tips quickly in SD-WAN's favour. Companies that plan their network infrastructure with growth in mind, rather than simply extrapolating the current state, typically avoid exactly the retrofit projects that end up costing more than a flexible architecture built in from the start. We support the planning and implementation of such network architectures as part of our IT networks & infrastructure services.

Site coupling is therefore no longer purely a technical matter but a business decision about how much downtime a company is still willing to accept — and how quickly it can respond to growth without starting from zero again at the next location.

---