We secure networks from the cable up: physical and out-of-band access, device and control-plane hardening, management-plane isolation, firewall policy, and routing security with RPKI and strict filtering.
For DDoS, we design layered mitigation that combines upstream scrubbing, remotely triggered blackholing and flowspec, and on-net filtering, and then test it, because a mitigation plan that has never been tested is only a hope.