Replace MPLS with SD-WAN and SASE: the migration guide

That world has changed. Critical applications now live in the cloud. Employees connect from home as often as from the office. The data centre is no longer the gravitational centre of network traffic. MPLS continues to deliver predictable performance, but to the wrong destinations.

This article covers the TCO comparison between MPLS, SD-WAN and full SASE; the reasons MPLS no longer fits cloud-first operations; the five-step migration approach Cato and Momentum EMEA use; and the NIS2 driver that turns this from a cost decision into an architectural mandate. For broader context, see our SASE guide for international organisations.

MPLS vs SD-WAN vs SASE: the TCO comparison

The simple version: MPLS has the highest direct cost per Mbps, the lowest flexibility, the longest provisioning time and no integrated security. SD-WAN reduces cost per Mbps by 40 to 60 percent, adds flexibility and faster provisioning, but adds operational complexity if security stays separate. SASE delivers SD-WAN's connectivity advantages plus integrated security, with a single operating model.

The financial logic depends on three variables: how many sites, how much bandwidth and how high the security overhead currently is. For multi-site international operations with growing cloud traffic, SASE typically delivers 30 to 50 percent lower three-year TCO compared with MPLS plus separate security tools.

We unpack the financial detail in our article on Cato cost and ROI, including the Forrester TEI 2026 figures that put ROI at 235% over three years.

Why MPLS no longer fits cloud-first reality

Three concrete mismatches make MPLS structurally unsuited to current operations.

Traffic destination mismatch. MPLS optimises site-to-data-centre traffic. Modern traffic is overwhelmingly site-to-cloud. Backhauling cloud traffic through the data centre via MPLS adds latency and uses bandwidth twice (site to DC, then DC to cloud).

Provisioning lag. A new MPLS site takes weeks to provision. New site opens, MPLS contract negotiated, hardware shipped, circuit lit. SD-WAN and SASE provisioning is days, sometimes hours, with zero-touch deployment.

Cost-per-Mbps mismatch. Cloud applications consume more bandwidth than legacy applications. MPLS cost scales linearly; broadband and 4G/5G alternatives have dramatically lower cost-per-Mbps. The cost-per-application unit is becoming uneconomic.

"The customers who delay MPLS migration the longest are not the ones with the best performance. They are the ones with the longest contracts. Three-year and five-year MPLS contracts that auto-renew are the real obstacle. The migration discussion needs to start two years before contract end, not at renewal time."

Momentum EMEA, EMEA's leading Cato Networks implementation partner

The migration in five steps: how Cato and Momentum EMEA execute

A pragmatic MPLS-to-SASE migration follows five steps, with the timeline driven by contract structure and site complexity rather than technical limitations.

Step 1: assess and design. Map sites, MPLS contracts, application traffic patterns and renewal timing. Produce a target architecture with site-by-site migration sequence.

Step 2: parallel deployment. Install Cato Sockets at target sites alongside the existing MPLS. Configure SD-WAN with multi-path routing across broadband, 4G/5G and (optionally) MPLS as a backup path.

Step 3: phased cutover. Start with a non-critical site to validate. Run on the new path for one to two weeks with the old MPLS available as fallback. Validate performance, support load and audit visibility. Then proceed to the next batch.

Step 4: MPLS retirement. Once all sites have SD-WAN performance proven, retire MPLS contracts in alignment with their renewal cycle. The MPLS budget freed up either covers Cato licensing or reduces total network spend, depending on the financial logic of the specific organisation.

Step 5: continuous optimisation. Path selection policies evolve as application mix changes. Monitoring identifies suboptimal routing and the platform adjusts. This is care-phase activity, not a one-off implementation.

Carrier-neutral working: the Momentum EMEA advantage

A critical detail in MPLS migration is what replaces it. SD-WAN works over any internet connection, but not every internet connection is equal. Carrier-neutral working means selecting the best provider per site based on availability, performance and cost, rather than being locked into one carrier globally.

Momentum EMEA aggregates carrier-neutral connectivity across EMEA and beyond. A site in Hamburg gets the best German provider; a site in Stockholm gets the best Swedish provider; a site in Singapore gets the best regional provider. All of it under one contract with one SLA and one support team. This is the underlay-plus-overlay proposition: the connectivity (underlay) and the Cato SASE platform (overlay) from a single source.

For organisations migrating from MPLS, this matters because the alternative is sourcing internet connectivity from each local carrier separately. The administrative overhead can offset the cost savings of MPLS retirement.

NIS2 as an extra reason to migrate now

The Cybersecurity Act (Cyberbeveiligingswet), the Dutch transposition of NIS2, requires demonstrable security controls including encryption in transit, access control and audit trails. MPLS as a connectivity-only service does not produce that evidence; SASE produces it by default.

Organisations that postpone MPLS migration past NIS2 enforcement (Q2 2026) accept two costs: the architectural cost of running legacy connectivity, and the compliance cost of bolting security evidence on top of MPLS rather than getting it as a byproduct of SASE. We unpack the broader compliance story in our article on NIS2 compliance with one platform.