Like Neil Smithline already said: if the attackers can outsmart a usually reliable DOS protection then there is nothing much you can do to protect yourself. That means that you should not focus on fighting or blocking the attack itself (leave that to the experts), but on reducing the impact of the attack. This might include:
- Reduce your attack surface by making only services public that need to be publicly available. That is don't expose your database if it is only needed as a backend for some web services.
- Have sites all over the world or have the ability to easily setup an alternative site (somewhere in the cloud) so that at least part of the sites still work even if the others are attacked. Using DNS you then can make sure that mainly the good sites are accessed by the customers.
- Make sure that attacks on public sites don't affect internal sites, i.e. it would be bad if you hosted some internal application on affected public systems and could not proceed with your internal business if public sites are attacked.
These are just some general concepts. Of course details depend on the kind of DOS attacks (bandwidth, application level DOS, flood of spam mail affecting specific recipients....), how critical all of this is for your business, which services are exposed to the public at all etc.
Patch my systems with latest updates
This will not specifically help against DOS, but of course you should keep your systems always current.