Application security modules in firewall/load-balancers. Rigourous patching cycles. Proper source control. Peer review. Functional testing. Load testing. Unit tests. Layer after layer of validation in every tier (browser, app server, database, middleware, etc). Enforced leave. Background checks. Hiring the sort of people who run and speak at white hat conferences to white and black box test applications. Separation of duties. External reviews. Not picking up every trendy programming framework at 0.1 release. Not building dependencies direct from github and rubygems. Internal security teams. Network monitoring and response in real time. Red teams.
In short, all that boring, expensive stuff a large chunk of both the bitcoin and HN community love to sneer at buggy-whip wielding by bloated, overweight entities.