Attacks on your organisation are inevitable. You are at risk whether you're part of a small company.
Security Innovation and The Ponemon Institute conduct a regular study, called The State of Application Security. This study investigates the difference in application security beliefs between developers, security professionals and company executives. The results are pretty shocking.