The network you have today is the network nobody planned. Each new site added a router, a firewall, a contractor, a configuration choice. None of it was wrong on the day it was made. None of it has been reviewed since.
In multi-site organisations, network risk usually appears as drift: inconsistent hardware, firewall rules, support ownership, monitoring, firmware and failover across branches. The first step is not choosing SD-WAN or SASE. It is understanding what is actually deployed, where the weak points sit, and which sites matter most to operations.
Drift is the gap between the network you would design today and the network you actually have. Three questions explain how it builds, why leaders miss it, and what separates a working network from a well-run one.
Drift accumulates over time as new sites are added, contractors come and go, vendors change, and configurations get tweaked for reasons no one remembers. The network usually keeps working. The risk is that no one can describe what it is, who manages each piece, or what would happen if a single edge device failed at the busiest site.
Networks are usually invisible when they work, and the threshold for noticing is only crossed at failure. Performance issues get attributed to busy days, outages to bad luck, and the cumulative cost rarely shows up as a line item in the management report. It remains a blind spot until a single event makes it obvious.
A working network carries traffic most days. A well-run network can be described, monitored, patched, supported and recovered consistently across sites. Most multi-site organisations have the first kind. The second takes deliberate engineering, not just piecemeal accumulation.
None of it was wrong on the day it was made. None of it has been reviewed since.
None of these are exotic. All of them are common. Most multi-site organisations have at least three of the six. None on its own is critical. Together they describe a network that has accumulated rather than been engineered.
Drift is a measurable cyber risk. A 2024 Kaspersky survey of geographically distributed businesses found 62 percent identified a disparity in cyber protection across all sites, with branches typically more exposed than head office. Attackers do not need the head office to be the weak point — a branch with weaker patching, looser edge controls or poorer visibility can become the entry point for a wider incident.
CFOs, COOs and general managers do not miss network risk because they are not paying attention. They miss it because the systems are technical, the costs are diffused, and the language IT teams use does not translate to the management report. All of these tend to be true at the same time, which is why drift compounds quietly.
Performance issues get attributed to busy days, not infrastructure problems that have been growing for months.
Outages get attributed to bad luck, not the absence of redundancy or monitoring.
The cumulative cost of degradation does not appear on a single line in any management report.
Which is exactly when investment in invisible improvement is hardest to justify.
Often not with the IT team that owns the platform.
The procurement process for a new site rarely includes a network design review.
The IT team itself may not have current visibility, which means leadership cannot get current answers.
Insurance and customer due diligence increasingly ask for clearer evidence of edge security, remote access and network segmentation.
A network review is not an SD-WAN sales pitch. It is a current-state map plus a prioritised list of work. The output is what the management team needs to make decisions: where the gaps are, which gaps matter most, and what closing them actually involves.
A network review is the input. SD-WAN, SASE, branch standardisation and managed network support are possible outputs, depending on what the review actually finds. Skipping the diagnostic step and jumping straight to deployment is how organisations end up with a rollout that delivered fewer of the promised benefits than expected.
Multi-site networks drift because businesses grow faster than network standards are reviewed. It becomes a risk when the organisation can no longer describe what is deployed at each site, who owns changes, which rules are exceptions, what is monitored, and which sites would be materially affected by a link or edge-device failure. Inlight IT's view is that the starting point is not SD-WAN, SASE or a new firewall platform — it is a current-state review. Inlight IT runs network reviews and operates the resulting architecture as part of cyber-first managed services for Australian businesses.
The first step is not SD-WAN or SASE. The first step is knowing what you actually have.
Start with the current-state review
Standardise where inconsistency creates risk
Replace hardware where exposure is material
Improve monitoring where teams are blind
The argument on this page — that multi-site networks accumulate without being designed, that drift is a measurable risk, and that the first step is current-state visibility rather than platform selection — describes how Inlight IT delivers a Network Review: the diagnostic foundation that informs standardisation, SD-WAN, SASE, branch firewall refresh or managed network support.
The diagnostic layer: edge inventory, policy consistency, support model, monitoring and failover across every site.
A deployment pathway the Network Review feeds into.
The secure-access pathway the Network Review can lead to.
Review edge devices, firewall policy, failover and ownership across every site. Scoped to your environment — Inlight IT remains the accountable service owner throughout.
Discuss Network Review