Most companies use mixed mode, as performing administrative tasks really benefits from the sa SQL login, and becomes difficult if not provided.  Mixed mode provides both SQL login and Windows authentication.   Just because one is a small company doesn't mean they should skimp on security.