Every business is on the list
Phishing, password reuse, and unpatched systems do not care whether you have five people or five hundred. If your business runs on email, banking, and customer data, it is worth attacking, and the tools attackers use are cheap and tireless.
