When an office, warehouse or industrial site has an aging network, the first refresh decision often sounds simple: replace the cabling or replace the switches? In practice, the answer depends on what is failing, what https://seo.edu.rs/blog/what-is-poe-and-why-does-it-matter-for-network-design-11222 the network needs to do next, and what happens at 2am when something breaks.
It is tempting to treat cabling as “just plumbing” and focus on the equipment with status lights and configuration menus. That is a mistake. Physical infrastructure is part of cybersecurity, not a separate concern. Faulty cables can cause outages, conceal device activity and undermine the controls you expect from firewalls, endpoint detection platforms and network segmentation.
The right sequence is not always “cables first” or “switches first”. It is to assess the physical layer and switching together, then prioritise the work that reduces the most operational and security risk. This guide explains how to make that decision, build a practical infrastructure refresh plan and avoid paying to replace the wrong thing.
Start with evidence, not age alone
Age is useful context, but it is not a diagnosis. A ten-year-old switch may still meet requirements and be supported, while a much younger one could be overloaded, unmanaged or unsuitable for the environment. Likewise, an older cable run may be perfectly serviceable, but a damaged connector or poor patching job can create intermittent faults.
Before ordering equipment, build a basic picture of the network:
- Record switch models, support status, software versions, port counts, uplink speeds and power-over-Ethernet (PoE) requirements. Identify cable types, approximate installation dates, routes, termination quality and any known test results. Map critical links and devices, including access points, cameras, building systems, servers and operational technology (OT). Review incidents: link flaps, CRC errors, failed negotiations, packet loss, unexpected outages and repeated port changes. Check whether production depends on unmanaged switches, undocumented daisy chains or unknown devices.
Look for patterns rather than one-off symptoms. Errors concentrated on a particular cable run suggest a physical problem. Congestion, exhausted port capacity or a lack of VLAN support may point to switching limitations. If both appear, replacing one layer in isolation may simply move the failure somewhere else.
Why the physical layer is a security concern
Security controls rely on a network that carries traffic predictably and gives you enough visibility to understand what is connected. Physical layer faults can create both outages and security blind spots.
Intermittent links may cause devices to disconnect and reconnect, disrupting monitoring or leaving operators with incomplete logs. A device plugged into an undocumented switch may sit outside the intended segmentation design. Poorly managed patching can also make it difficult to confirm which wall outlet leads to which switch port. That uncertainty complicates incident response: when a suspected device needs to be isolated, responders first have to work out where it is connected.
That is why mystery cables are more than a housekeeping problem. They can indicate weak change control, unclear ownership and a lack of reliable network documentation. Labels on both ends of a cable and accurate patch-panel records are modest investments compared with the time lost tracing a circuit during an incident.
Physical access matters too. A switch or patch panel in an unsecured area can provide a route to connect an unauthorised device, bypassing assumptions made in the network design. Network security therefore includes cable routes, cabinets, ports and access procedures—not just policies on a firewall.
When to replace the cabling first
Prioritise cabling when there is evidence that the physical medium is the limiting factor or is creating an unacceptable operational risk.
- Persistent physical errors: CRC errors, packet loss, link flaps or poor test results recur on specific runs, even after known-good patch leads and switch ports are tried. Insufficient capability: Existing cable types or installation quality cannot reliably support the speeds, PoE loads or distances required by planned equipment. Physical deterioration: Cables or terminations show damage, water exposure, excessive bends, unsuitable routing or other signs that reliability is at risk. Unverifiable history: There are no dependable records or test results, and critical services rely on undocumented or poorly terminated runs. Site changes: A fit-out, new production line, additional wireless coverage or equipment move makes the current routes impractical or unsafe.
A cabling lifecycle plan should consider the whole path: cable, termination, patch panel, patch lead and switch port. Replacing a horizontal run while leaving a damaged patch lead or badly labelled panel in place may not fix the fault. Where a new installation is warranted, specify suitable cable for the environment, use qualified installers, test the completed runs and retain the results. Plan for growth, but avoid paying for capacity that has no clear use case.
In industrial settings, ordinary office cabling assumptions may not apply. Temperature, vibration, dust, electrical noise and the consequences of a production outage can all influence the choice of media and installation method. Vendors such as MOXA provide industrial networking equipment; the important point is to match equipment and cabling to the environment and operational requirements, rather than treating a plant floor like a meeting room.
When to replace the switches first
Prioritise switching when the cable plant is tested and fit for purpose, but the switches cannot support a secure, manageable design or meet operational needs.
- Unsupported or vulnerable equipment: the the manufacturer no longer provides security updates, or known vulnerabilities cannot be addressed through supported software. No effective management: Production relies on unmanaged switches where you need configuration control, monitoring, access controls and reliable troubleshooting. Segmentation is missing or fragile: The switching estate cannot implement the required VLANs, access controls or network boundaries consistently. Capacity is exhausted: Port density, uplink bandwidth, PoE budgets or performance are insufficient for current or planned workloads. Visibility is limited: The equipment does not provide the logging, telemetry or management features needed to understand network behaviour and investigate incidents.
Managed switching is more than a convenience. It gives operators a way to configure ports consistently, separate traffic, monitor link health and control access. The capabilities required will depend on the design, but a refresh is a good opportunity to standardise configurations and remove unmanaged devices from production.
Segmentation depends on capable switching and correct design. A switch that supports VLANs does not, by Essential Eight itself, make a network secure. VLANs need a clear purpose, consistent configuration and appropriate controls at the points where traffic crosses between them. For example, a camera network, user network and OT environment should not be treated as equivalent simply because they connect to the same cabinet.
Organisations may use equipment from vendors such as Cisco or Garland, among others. Choose based on support lifecycle, required features, compatibility, environmental suitability and the team’s ability to operate the platform—not the logo alone.
What ACSC guidance means for network foundations
Australian Cyber Security Centre (ACSC) guidance promotes layered security, visibility, controlled access and sound network architecture. These outcomes assume that the underlying network can be understood and operated reliably. A security design cannot compensate for undocumented cabling, uncontrolled switches or a topology that nobody can confidently map.
This does not mean that every organisation needs a large enterprise network or an immediate replacement programme. It means the foundation must be good enough to implement and maintain the controls you have chosen. If you cannot identify where a device connects, determine which network it belongs to or reliably isolate it, your security plan has a practical gap.
As part of an infrastructure refresh, check that the proposed design supports your security requirements. Confirm how management access is restricted, how changes are recorded, how devices are monitored and how network boundaries are enforced. Keep the design and asset records current; otherwise, the documentation will drift away from reality as soon as the first emergency patch is installed.
A practical decision table
What you find
Likely priority
Next step
Repeated errors on specific runs; switch capacity is adequate
Cabling
Test the complete channel, repair or replace the affected run, then verify and label it.
Sound, tested cables; unsupported or unmanaged switches
Switches
Introduce supported managed switching and migrate ports with a documented configuration.
Unknown patching and unmanaged switches in critical areas
Discovery and risk reduction first
Map connections, remove unauthorised devices and prioritise the highest-risk segments for refresh.
Think about it: new devices need higher speeds or poe, but cable capability is uncertain
Test both layers
Validate cable performance and switch capacity before committing to a design.
Both layers are unreliable or undocumented
Co-ordinated refresh
Plan a staged replacement that preserves service and validates each area before cutover.
How to stage an infrastructure refresh
Replacing everything at once can be risky and expensive. A staged plan lets you address urgent weaknesses while keeping services running.
Set priorities by risk and service impact. Identify systems where a failure would affect safety, production, customer services or incident response.
Document what is actually there. Map cabinets, patch panels, uplinks, switch ports, cable routes and connected devices. Treat uncertain links as uncertain until they are tested.
Define the target design. Decide what segmentation, speeds, PoE capacity, monitoring and physical access controls are needed. Include the firewall boundaries and the visibility required by endpoint detection platforms.
Test before replacing. Use appropriate cable certification or diagnostic testing and review switch health, error counters and utilisation. Keep the results with the asset records.
Migrate in controlled stages. Trial the design on a lower-risk area, document rollback steps and verify that services and monitoring work after each change.
Close out the work properly. Update diagrams, port descriptions, labels, configuration backups and support details. Test the recovery process, not just the normal operating state.
Each stage should answer the operational question: what happens at 2am when this fails? Can an on-call engineer find the correct cabinet, identify the port, understand the intended configuration and restore service without guessing? If not, the refresh is not finished.
So, what should you replace first?
Replace cabling first when testing shows the physical layer cannot reliably support the service. Replace switches first when the cables are sound but the equipment is unsupported, unmanaged, overloaded or incapable of delivering the required segmentation and visibility. If the evidence is mixed, test both layers and plan a co-ordinated refresh rather than betting on one component.
The best answer is usually a risk-based sequence, not a blanket rule. A well-managed switch cannot fix a damaged cable, and a new cable plant cannot create secure segmentation on its own. Good network foundations combine sound cabling, supported managed switching, accurate records and a design that matches the environment.
That is what turns an infrastructure refresh into a security improvement: fewer unexplained outages, fewer blind spots and a network your team can understand when it matters most. Keep the cables labelled, remove the mystery connections, and make sure the physical layer is treated as part of the security architecture.