three choices?
"You can prioritise blocking attacks.
You can develop processes that let you respond to attacks.
Or you can put most effort into cleaning up after an attack."
Put that way it sounds really stupid - they are not mutually exclusive. You need to do all three in just proportion all the time. Getting the balance right is the key to success, and it may not be a static balance - the priorities can change depending on what's happening right now, so you need to be continuously attuned to the threat space. Ergo, being aware of the changing threat space is always your highest priority.