Every few years we see a slew of opinions claiming that SD-WAN is dead. The latest version of this argument says that AI agents drive traffic across the network in a different way to humans, and that SD-WAN deployments weren’t designed for this brave new world. That may be true, but SD-WAN still has an essential role to play within a broader digital infrastructure that delivers what AI inference needs: connectivity with guaranteed performance, cloud-delivered security, and unified visibility and control.
It’s Not Just People on the Network, and AI Uses It Differently
SD-WAN was designed to connect employees to cloud and SaaS resources, replacing expensive MPLS circuits and hub-and-spoke configurations that weren’t equipped to cope with this new model of consumption.
But now it’s not just staff using the network. Systems are talking to systems without a human in the mix, and AI agents are starting to gain autonomy. On average, organizations now have 109 non-human identities (NHIs) for every human user.
This matters because AI places different demands on the network. It’s using a lot more bandwidth, but it’s also profoundly changing the behavior of network traffic.
The Direction and Shape of Traffic Flows Is Shifting
In the past, when most traffic was created by human users accessing the cloud, networks were built around a download-centric, North-South model. But as AI resources are increasingly distributed across clouds, data centers, and the edge, East-West traffic is growing and bandwidth use is starting to become more symmetrical. Already, 9% of AI flows carry more upstream than downstream traffic, compared to just 0.5% for typical web traffic.
At the moment, AI-generated traffic can be bursty, but that may change as inference traffic grows. Cisco estimates that a quarter of total network traffic will be from AI inferencing by 2035, and notes that these flows have smoother and more persistent throughput, lasting twice as long as regular web transactions.
SD-WANs Weren’t Deployed With AI in Mind, but That Doesn’t Make Them Redundant
Many SD-WAN deployments were sized and configured around shorter-lived application sessions, download-heavy SaaS traffic, and relatively predictable site-to-cloud patterns. They make decisions based on sites, tunnels, applications and paths.
While that’s still important, it’s no longer enough for autonomous, identity-driven workflows. And without reliable connectivity between centralized models, edge AI functions, distributed data sources and business applications, real-time inference can fail and workflows can stall.
Already we’re seeing bottlenecks. For example, cloud on-ramps are often connected with asymmetric broadband links that were a great low-cost option for SaaS. But they can’t provide the performance to support distributed AI workloads that are sending a lot more upstream traffic than we’ve previously seen.
When global organizations try to scale, the problem becomes even more pronounced. Patchworks of connectivity across different sites, clouds, regions, and vendors create a level of complexity and fragmentation that makes it hard to provide the deterministic connectivity that AI needs.
That doesn’t make SD-WANs obsolete. In fact, the demands of AI mean there’s an even greater need for availability, application-aware routing, dynamic traffic management, and guaranteed network performance – it’s just that these requirements are beginning to take a different shape. And there are new control and security challenges to overcome as well.
Visibility and Security Controls Also Need Rethinking for AI
Organizations need to be able to identify which agent or workload is acting, what authority it has, and whether that specific action should be allowed – and to apply the right policies and responses when behavior changes.
Control starts with visibility, and for many enterprises, that’s a fundamental gap. AI doesn’t create a completely new packet type, so it’s not always easy to see what it’s doing on the network.
Now that AI agents and other digital entities are initiating activity across distributed data stores, applications, and security boundaries, the challenges become:
- How can we tell whether activity is coming from humans, agents, or bad actors?
- How do we manage identities, privileges, and permissions across these immensely complex environments?
- How do we distinguish different types of activity so they can be prioritized appropriately on the network?
Security that’s been stacked on top of an SD-WAN can’t solve these problems. Bolted-on protection increases complexity and tool sprawl, risks leaving blind spots and vulnerabilities, and struggles to effectively secure NHIs.
Instead, the situation demands a deep level of security integration: built-in cloud-based security and centralized controls for least privilege connectivity, rather than enforcement that’s spread across many different tools and systems.
SD-WAN Is an Essential Element of a Secure, Unified, and Elastic Architecture
SD-WAN is evolving to become part of a bigger picture – one where AI changes traffic patterns and creates new threats, and the challenge is how to provide the consistent performance and security it needs when the network is complex, vulnerable, and fragmented.
Instead of being a standalone connectivity layer, SD-WAN is an essential component of cloud-delivered security fabrics such as secure access service edge (SASE). In the SASE model, the network is part of a wider architecture built around zero trust principles like continuous verification and authentication, and helps to enforce consistent policies and revoke suspicious sessions.
In a similar vein, the WAN must become part of a single control plane that manages connectivity in all directions – between agents, systems, users, clouds, data centers, sites, and the internet – and extends application-aware routing and policies across all of it. This also provides the visibility for threat detection and response across the entire network fabric.
SD-WAN is also likely to co-exist with other ways of consuming connectivity, like Network-as-a-Service (NaaS), rather than being replaced by it. NaaS provides a cloud-like model of consumption with elastic capacity that allows the network to adjust in real time to the demands of the applications and workloads running over it. NaaS offerings are often built on SD-WAN and frequently include managed SD-WAN services.
Tackling the Packet Visibility Question
If AI-driven packets look much like any other traffic, how can organizations work out what applications are using the network, what user or entity is driving that activity, how it should be prioritized, and whether it represents a risk?
This is where traffic classification tools come in, which use various clues like application signatures and protocol decoding to work out this information. They provide the visibility to apply fine-grained controls and policies, route traffic according to its time sensitivity and importance, and revoke individual application sessions for specific users or agents without affecting others.
An AI agent handling a time-sensitive customer support ticket, for example, can be given priority so there are no delays that might hold up downstream workflows. An employee using ChatGPT to rewrite an email, on the other hand, will be fine with best-effort performance.
Forget the Eulogy – Start Planning Instead
As AI pushes deeper into production, traffic is shifting from ‘people to application’ flows to ‘system to system’ flows, and the network must evolve accordingly. SD-WAN still has an essential role to play in managing this underlying connectivity as part of a bigger need for infrastructure that’s secure and flexible, and operates as a coherent whole.
Achieving that isn’t easy. The reality is messy: most organizations are operating with legacy elements and a mix of providers, SD-WAN platforms, clouds, and security controls. The first step is in many ways the most important – building enough visibility to understand what’s running over the network, where the dependencies are, what the capacity usage is like, and where the risks and vulnerabilities lie.
Once organizations have a clear view of how their current set-up can cope with the shift in traffic, they can begin planning for an inference-ready infrastructure – and that picture will continue to include SD-WAN for some time to come.