We're not tiny (6000 employees or thereabout) and we do software as our primary business, so it's not like we're unfamiliar with the technology. I think we just have conservative management.
I would guess that the reason our management is conservative about this is for a couple reasons. First, a while back we had a ransomware attack that cost an unknown [to employees, at least] amount of money to resolve, which completely rearranged our viewpoint on security. Second, we are a well established software company and already claim something like 3/4 of the addressable market. So instead of a drive to go for additional customers, a fair amount of the focus seems to be on retaining what we have. Our customers are largely non-technical businesses not eager for new software features, they judge success by uptime.