Small and mid-size businesses are unlikely to have the skills or money to establish and maintain effective IT security measures. However, a far bigger risk is the people inside the firewall. Many companies, large and small, are at risk from disgruntled or malicious system administrators - more so if their systems are in house. That requires very smart countermeasures, but few companies have them, still recruiting sysads on technical qualifications and then hoping they're ethical people.

SaaS does concentrate the target for malicious behaviour, but it also concentrates the resources to protect them, at least if the SaaS vendor has scale. I am concerned however that too many SaaS start-ups lack the IT security smarts and resources to provide the necessary countermeasures.

You put your money in a bank for a good reason, but the bank has to have a sound and solid reputation. A small neighbourhood bank is an easier target than a national major. So too with SaaS.