The decision in 2026 looks different than it did in 2020
Five years ago, the SD-WAN vs MPLS conversation was about whether SD-WAN was ready for enterprise production. That argument is over — SD-WAN is mature, supported by every major networking vendor, and operating in production at thousands of Saudi enterprises. The conversation now is about which workloads belong on which transport, and how to design hybrid networks that combine both. The blanket recommendations of three years ago no longer apply.
What SD-WAN actually does (and the marketing fluff to ignore)
SD-WAN is a software-defined approach to wide-area networking that abstracts the physical transport (internet, MPLS, LTE, 5G) from the policy layer. The branch device — a Cisco Viptela Edge, Fortinet FortiGate, Versa CSG, or VMware VeloCloud appliance — connects to multiple transport circuits simultaneously and routes traffic dynamically based on application policy.
What this delivers in practice: real-time failover between circuits when one degrades, application-aware routing (Microsoft 365 traffic prefers internet, on-premise application traffic prefers MPLS), and centralised orchestration of branch policy without per-site configuration.
What it doesn’t deliver: magic. SD-WAN doesn’t make a 50 Mbps internet circuit perform like a 100 Mbps MPLS link. It makes better decisions about what to send where.
What MPLS still does well
MPLS gets dismissed too quickly in 2026 conversations. It still does several things better than commodity internet: predictable latency, contractual quality of service guarantees, and operator-managed end-to-end troubleshooting. For latency-sensitive applications — voice, video conferencing, real-time industrial systems — MPLS predictability remains valuable.
The challenge is cost. MPLS in Saudi Arabia from STC, Mobily, or Salam typically costs 3-5x equivalent internet bandwidth. For modern application portfolios where most traffic is cloud-bound (SaaS, public cloud), paying MPLS prices to push traffic that ends at internet endpoints is economically inefficient.
The Saudi context: STC, Mobily, Salam carrier dynamics
The KSA carrier landscape shapes the SD-WAN vs MPLS decision. STC Business has the deepest fibre footprint and best MPLS reach into smaller cities; Mobily has competitive enterprise fibre in major metros; Salam is increasingly competitive in fibre-served urban areas. For multi-site enterprises with a mix of urban and remote locations, you typically need at least two carriers for redundancy — and SD-WAN gives you the flexibility to mix providers transparently.
Beyond the major carriers: Saudi Network Information Center (SaudiNIC) and dedicated cloud-connect providers offer specialised connectivity that complements SD-WAN designs, particularly for organisations operating across Vision 2030 mega-projects.
Cost model — typical 5-site KSA enterprise compared
Take a 5-site KSA enterprise with a Riyadh HQ, three branches in major metros, and one remote site in a giga-project zone:
Pure MPLS: Monthly cost ~SAR 35,000-50,000 for 50-100 Mbps tiers, depending on carrier and contract length. Operational simplicity is high. Application performance is predictable.
Pure SD-WAN over commodity internet: Monthly cost ~SAR 12,000-18,000 for equivalent capacity from internet providers. SD-WAN appliance cost amortised: ~SAR 3,000/month. Lower total cost; performance variability higher; operational complexity moderate.
Hybrid SD-WAN + MPLS: ~SAR 25,000-35,000/month — keep MPLS for the latency-sensitive paths (HQ to data centre, voice traffic), use SD-WAN over internet for the rest. Best total cost-to-performance ratio for most multi-site enterprises.
Security implications (Zero Trust meets WAN)
SD-WAN intersects naturally with Zero Trust networking. Modern SD-WAN vendors integrate firewalling, secure web gateway, and SSE/SASE capabilities into the same platform — the SD-WAN edge becomes the security edge for branch traffic. Fortinet’s FortiGate-as-SD-WAN, Palo Alto’s Prisma SASE, and Cisco’s SSE products represent this convergence.
For NCA ECC-aligned organisations, this is significant: applying consistent security policy at every branch through software-defined config eliminates the historical drift of per-site firewall rules.
The hybrid model that wins for most orgs
The pattern that consistently performs in KSA mid-market and enterprise environments: SD-WAN as the unifying overlay, with MPLS retained for specific high-performance paths (typically HQ-to-data-centre and primary voice paths), commodity internet for cloud-bound traffic, and 4G/5G LTE as automatic failover for branch resilience.
Migration risks and timeline
A 5-site SD-WAN migration over MPLS typically runs 12-16 weeks: 4 weeks design and procurement, 4 weeks pilot at one site, 6-8 weeks phased branch rollouts. The risks centre on cutover sequencing — running both transports in parallel during the transition is essential to avoid business-impacting outages.
For a written network architecture proposal sized to your specific multi-site environment, book a networking discovery call. Pair networking with unified communications, cyber security, and cloud computing for an integrated infrastructure strategy.
