The enterprise is under attack.
But it's not the site that getting hit. Rather it's not the site that's taking the punishment directly. It's not a denial a service or a hacking threat on your server.
In fact, your server is not even involved.
The attack is on your ranks. One of the perils of high ranks for a large enterprise is the value that others see in those ranks. And there are those willing to steal them if the search engines can't stop them. And they can't.
So it's up to you to spot the attackers when they first cross the perimeter. If you think you can wait them out, you're going to be very surprised to find you site gone from the ranks, and the wait for reconsideration is painful.
How to deal with the insurgents:
Pay attention to Google's index. Even though Google can't always stop them, you can use the tools to look for the evidence of warfare.
Regularly vet the inbounds for signs that the enemy is planting links in bad neighborhoods. Information on how to vet inbounds is here: link vetting