The Five-Tier Stack Audit: Finding the Waste Hiding Between Your Content Delivery Contracts
Photo: Shixart1985, CC BY 2.0, via Wikimedia Commons
Ask a CTO how many CDNs the company runs and the answer is usually one. Ask the infrastructure team and the honest answer is closer to five: a browser-side caching layer, an edge delivery tier, a mid-mile or transit arrangement, a security and bot-management service, and an origin acceleration product — often from three different vendors, each with a separate contract, SLA, and support portal.
None of these layers is inherently wasteful. Each was added, presumably, to solve a real problem. The waste accumulates in the gaps between them: overlapping functionality nobody owns, metrics that double-count the same delivery event, and capabilities paid for twice because no one mapped the full stack end to end.
Layer One: Browser and Client-Side Caching
The first layer isn't a vendor at all — it's the cache headers, service workers, and client-side storage policies your own engineers configure. It's also the cheapest performance lever you have, and the most commonly neglected. Before renewing any contract, confirm your Cache-Control and ETag strategy is current. Every request served by the browser is a request none of your paid tiers must handle.
Layer Two: The Edge Delivery Tier
This is the layer most people mean when they say "our CDN" — the distributed points of presence that serve content close to users. Its value is real and measurable: reduced latency, origin offload, absorption of traffic spikes. The audit question here is coverage versus usage. If your analytics show 90% of traffic served from a handful of metro regions, you may be paying for a global footprint your audience doesn't use.
Layer Three: The Mid-Mile and Transit Layer
Between your origin and the edge sits the middle of the network — transit providers, backbone arrangements, and sometimes a second vendor whose entire job is moving data efficiently between regions. This layer is frequently invisible in dashboards and therefore frequently duplicated: some edge providers include mid-mile optimization in their base service, making a standalone transit contract redundant. Map the actual path a request travels. If two contracts describe the same hop, one is negotiable.
Layer Four: The Security Perimeter
DDoS mitigation, WAF rules, and bot management increasingly ship as add-ons to edge platforms — and just as often exist as standalone contracts from a security vendor. The audit test is functional overlap. If your edge provider already filters at layer 3 and 4 and your security vendor does the same upstream, decide which layer should own the job and terminate the other arrangement. Running both isn't defense in depth; it's paying twice for the same filtering with added latency between them.
Layer Five: Origin Acceleration
The newest and least understood tier: products that optimize the path between edge and origin through connection reuse, prefetching, and route optimization. It delivers genuine value for dynamic and uncachable content — but only if the origin actually needs it. Teams that invested in origin scaling and database caching sometimes discover their origin accelerator is solving a problem they already fixed.
Running the Audit
A practical five-tier audit takes roughly a month:
- Inventory every contract touching delivery, including line items buried in cloud provider bills.
- Trace real requests through the stack with distributed tracing, documenting which tier touches each request and what it contributes.
- Compare overlapping metrics. If two vendors both report cache hit ratios or request counts, reconcile them — discrepancies reveal duplicated work.
- Score each layer on marginal value. What breaks, measurably, if this contract ends tomorrow?
- Renegotiate from evidence, not habit. Vendors respond very differently to renewal conversations backed by request-level data.
The goal is not to strip the stack down to one vendor. Best-of-breed layering is often the right architecture. The goal is that every layer earns its invoice — and that you can prove it.
