Let me start by saying that security is always a cost versus risk choice. Saying that the companies you have been with are ?not prime targets? leaves off the understood ?YET?. In this day and age you only need to upset a few people (employees or outsiders) to become targeted so you assume that you have no unhappy employees, no unethical competitors and no confidential information. The fact that you are a non web-presence intense company has little to do with the risk of an attack.