Here’s the uncomfortable truth: attackers don’t discriminate by company size. They discriminate by vulnerability.