Executive explanation: Small sites are the most vulnerable.
Small sites are the most vulnerable to bad guys you know.
Big sites are the most vulnerable to bad guys who don't care about you.