When it comes to cyber risk, company size doesn’t matter