Yes, probably — though the tier you need is different from a 50-person firm. The threats that managed IT defends against don't scale with your headcount. Ransomware doesn't check how many employees you have before encrypting your files. The FBI IC3 data consistently shows that small businesses are disproportionately targeted precisely because attackers assume they're underprotected.

What changes at smaller sizes is cost and complexity. A 10-person business doesn't need a SOC. They do need MFA enforcement, monitored backups, EDR, and a helpdesk. That's achievable at a reasonable price point.