How does Defender Experts integrate with a mature internal SOC in a large healthcare environment, particularly when responding to high-confidence threats where automated containment may need to be balanced against clinical system availability and patient-care operations?