We've seen a lot of great questions asked so far of Dr. Dorit Dor, answers for which will be revealed on Monday. Have you got your question in yet?
The R80 Management API makes this much easier to do than it was in R77.x with dbedit.
You can leverage the R80 Management API and the cprid_util to remotely execute commands on all your Check Point gateways.
How do "arp" for a translated address that's not on your local subnet, particularly when you don't have control over the upstream router? You do something similar to what's described in this thread.
One thing the Pre-Upgrade Verifier does not do is check the validity of your rules. Which, due to a validation bug in R77.20, caused a problem when upgrading to R80.10.
In some releases, it is possible to enable ICAP Server support. This will allow you to use a third party web proxy to send traffic to Check Point Threat Emulation.