we are 700+ agents across two companies. Roughly 80 XA servers. Only a few minor issues with apps

The good news is that most of the time it solves itself. Once it detonates in the wildfire portal and comes back with a benign verdict, the app works. 5 minute turn around on that process so pretty cool.

I think we had 1 app that always came back as malware and had to make a manual exclusion

PA will tell you that you can relax a little on your patch cycles because it doesn't matter what the vulnerability is, traps will stop it. Only exception to that is hardware exploits like Spectre/Meltdown. No product can address that but the payload that delivered it in the first place would be stopped by traps if it was on that endpoint.

upgrades to the agent are easy peasy too. Simply make the new agent the default in the cloud management plane. Next time the agent checks into the cloud, it'll update it. You can specify to do it in groups or all at once.

so we're using Crowdstrike

they are like a CSP for Traps