I work with everything from small local businesses to Fortune 100 and FTSE 100 companies and one of the things I do find is that all sizes of company are trying to do something about security. Sure, the extent to which a small company can implement some security controls is limited by budget, but there certainly isn't a 100% correlation with big corporates doing it better than small companies.
Often small financial companies (150 employees say) are the best at this - implementing full information lifecycle management functionality including secure code development all the way through to secure destruction at end of life. For OWASP's top ten, there is nothing there that is out of reach of a company of this size. What it will come down to is what there motivation is:
- If they are regulated, they will do what is required to pass audit
- If they store personal information they will try to make sure they meet data protection requirements wherever they are
- If they hold valuable intellectual property they will place controls to protect it