I do not like the user interface in Sophos Central.
I do not feel like there is useful information found in the available reports. Devices with a "Bad status" could be one that just turned on, and hasn't updated yet, or a full infection. When I sort devices by status, and drill down to see what is happening, and navigate back, I want the sort to still reflect the status. On the dashboard, I see the Web Stats say "## Web Threats Blocked", but when I click on it, I don't see ANY actionable info.
I agree, the random alerts I get as well as the bad and medium status are very vague. I think Sophos Central is a little too picky when it marks something as bad. You should be able tune those alerts.