While large enterprises may afford advanced defences, smaller businesses remain especially vulnerable