How to Make Security Work for Small Companies

I've worked for small companies that tried to do something extremely rapidly and extremely quickly. And it just meant that, you know, they would push that day off a year or two when they would have to face the security challenges. Nowadays we have structured logs and really good systems and I love it. So is security handled any differently whether you're a small group or a large group? It's really just a matter of when you're going to pay the price.