Most large networks carry costs nobody actually meant to approve forever.
Those “temporary” circuits are still alive. The firewall stack you built to solve one of Gary’s performance problems is now a permanent monument. SaaS traffic takes the scenic route because “that’s how we’ve always routed it.”
You’re not wasting money because you’re careless. You’re wasting it because nobody cleaned up after the last five projects.
Put off shoveling the driveway long enough, and the snow becomes a wall of ice you’re not getting through. Same thing here, just with invoices.
The quiet problem
Network costs aren’t a single line item. It’s a thousand small decisions that never got revisited:
- duplicated links “just in case”
- overlapping security tools that all claim they’re the one you can’t live without
- branch exceptions that turn every site into a special case
- contracts that auto-renew because nobody wants to be the person who breaks something
The common root cause is still the same: weak visibility and weak patterns. If you can’t explain what something does, you can’t defend paying for it.
None of this is incompetence. It’s what happens when business pressure and real-world constraints collide without a stable pattern underneath. Then Gary changes roles, the ticket never gets closed and everyone gets religion about touching the one thing nobody fully understands anymore.
How to close the wallet
Pair SD-WAN and security from the start.
Treat SD-WAN and SSE as one design motion, not two fiefdoms. Performance and security aren’t separate problems in a branch office, they’re the same user experience seen from two angles. Whether you’re running Cisco Meraki, HPE Aruba EdgeConnect (yes, the one people still call Silver Peak), Fortinet, or a mixed stack that grew organically, the goal is the same: one repeatable pattern that doesn’t rely on screenshots and folklore to operate.
We deliver this through patterns that work across Cisco Catalyst SD-WAN or Meraki, HPE Aruba EdgeConnect, Fortinet Secure SD-WAN, or Palo Alto Prisma SD-WAN and Prisma SASE, depending on what fits your environment. The architecture stays consistent either way, and ISM runs the whole thing so you’re not stuck translating between vendors when it’s already on fire.
Standardise where it matters.
You don’t need every branch identical, but you do need a small set of patterns that are predictable. Build three patterns. Use them. Stop inventing a new one on a Thursday night.
Make exceptions expire by default.
Gary’s exceptions aren’t evil. Permanent exceptions could be. If a rule is worth breaking, it’s worth revisiting on a calendar.
Microsoft Entra ID conditional access policies can enforce device health, location restrictions and MFA before granting network access. If your world runs on Okta, Duo, Ping, or something older and crankier, the principle’s the same: access gets decided up front, not argued about later. This kills the whole “just open this port for Gary” problem that multiplies until you’ve got 200 Garys and nobody remembers why.
Use vendor scale without becoming a reseller.
Kyndryl’s scale and alliances matter when you need deep vendor expertise, fast escalation paths and buying power. ISM turns that into local execution that actually works with Canadian carriers and Canadian constraints.
Those alliances cover the usual suspects, Cisco, HPE Aruba Networking and Fortinet. The point isn’t the logo, it’s getting real escalation paths and proven patterns without turning your team into a part-time procurement department.
What gets better
This is where the money starts showing up in ways finance understands:
- retired circuits and reduced backhaul patterns
- fewer point tools and less overlapping licensing
- fewer failed rollouts, fewer rollbacks, fewer weekend “surprises”
- a cleaner baseline that makes every future change cheaper
It’s not glamorous. It’s just less waste.
What to fix first
Catalogue what you have Tie circuit spend, tools and services to owners and dependencies.
Build privacy into daily work SSE and identity controls generate data. Decide where it lives and who can access it. When that data routes through a foreign vendor’s cloud, you’ve created a sovereignty question on top of a cost question.
Operationalise governance Make standards real, enforceable and reviewable. Patterns win when they’re mandatory.
Secure the data itself If data can move anywhere, cost and risk follow it. Control the movement, not just the perimeter.
A lot of network spend is fear in a trench coat.
Fear of removing the wrong circuit. Fear of touching the one branch config that “only works if you don’t look at it.” Fear of admitting three tools are doing the same job because nobody wants to start the retirement conversation.
So the environment grows. Costs creep. Everyone shrugs. Then finance asks why the bill went up again, and the only honest answer is “because we’re afraid to delete anything.”
If you’re running SD-WAN, SASE, SSE, or whatever the acronym of the week is, the question isn’t whether you have the right ingredients. It’s whether anyone has the scars to turn them into a repeatable operating model. ISM does the architecture and delivery locally, using the same partner ecosystems you already rely on. Kyndryl brings alliance depth and proven patterns across Cisco, HPE Aruba, Fortinet, and when it fits, Silver Peak. The goal is boring, in the best way: fewer snowflakes, fewer surprises, and a network bill you can explain without needing a seance.
