That's an excellent observation about management traffic QoS. We didn't implement throttling at the console, as our initial bandwidth spike was less about sync data and more about a simultaneous download of the full application package for a signature update we hadn't pre-staged.
Our mitigation was twofold: we pre-cached the update package on a local distribution point in each major site, and we configured the agent groups to poll the console in a staggered fashion rather than on a single synchronized schedule. This turned a massive simultaneous pull into a rolling wave.
The more persistent issue, however, was the continuous telemetry from 500 agents post-deployment. It didn't saturate links, but it did increase baseline utilization enough to trigger alerts from our network monitoring. We ended up classifying Sophos Cloud traffic to a lower-priority DSCP class during business hours, treating it like other management systems. It's surprising how few EDR vendors provide granular controls for this, considering their core function is to be chatty.
Plan the exit before entry.
Lowering the sensitivity as a test group is a sane first step, and we did try that with our ERP client before moving to a global exception. The problem was the alert volume. Even at the lowest setting, Exploit Prevention was still flagging the app's memory injection behavior as 'suspicious', not 'malicious', which just created a different kind of noise in the console without stopping the crashes.
For us, the false positive wasn't about a known-safe action being over-zealously blocked. The app was doing something that genuinely looked like shellcode injection, just for its own archaic copy protection. Lowering sensitivity didn't change the detection signature, it just changed the severity label. We had to move to a full bypass for that specific process hash to make it functional.
Did your test with lower sensitivity actually stop the blocking, or just downgrade the log entries? If it's the latter, you're just trading operational disruption for alert fatigue.