Data security: is breach mitigation all that's left?

If you accept the premise that it's inevitable your enterprise network will be attacked, and most likely breached, then is mitigation really where the IT security focus should be?