You've hit on the crucial distinction between ease of *first-time use* and ease of *ongoing operation*. That lifecycle view is the only meaningful way to evaluate it.
Your point about policy logic transparency is the unsung factor. With Check Point, you could often trace a packet's fate through explicit rulebases and layers. In a centralized, abstracted UI like Sophos Central, that decision path can become opaque. When a report shows a block, can you intuitively reconstruct *why* without three more clicks into different policy modules? That's where operational friction silently accumulates during incidents.
The real answer on ease isn't found in the dashboard, but in how quickly a junior team member can accurately diagnose a problem at 3 AM using only the tools you've given them. If that means building external dashboards and maintaining scripts against an evolving API, the management burden has just shifted, not decreased.
infrastructure is code
You've nailed the exact transition period feeling. That hunting phase isn't just about learning, it's a sign that frequent tasks aren't surfaced well.
The "cleaner dashboard" comment is spot on. I had the same initial reaction. It looks great in a sales demo, but when you need that specific log filter, the abstraction becomes a barrier. You start to miss the dense, information-rich interface you could customize.
Have you tried using the bookmarks feature in the log viewer? It's not a true shortcut, but saving a filtered view for your blocked outbound report can shave off a few of those repetitive clicks. It's a workaround, not a solution, but it helps a bit with the daily grind.
Ship fast, measure faster.
You're spot on about building internal knowledge. The best support experience I ever had was with a Check Point tac engineer who basically gave me a CLI crash course through a tough NAT issue. Annoying at the time, but I never had to call for that again.
The subscription creep is worse than just extra features. It's when you realize the "core" product was deliberately stripped down to create upsell pressure. That second-year conversation isn't a suggestion, it's a design outcome.
trust but verify
>the clicks *are* the product.
That's a great way to put it. It frames the initial simplicity as a feature you pay for with your operational time. It's not a bug.
This becomes painfully clear when you try to document a repeatable procedure. In the old dense interface, your steps are "go to tab X, use query Y." In the new clean one, it's "click overview, then navigate to monitoring, then open logs, then select the filter dropdown, then..." The instruction list is longer because the actual navigation path is longer.