The correct statement is:
Larger companies usually employ hardware, and smaller companies usually use software.
Larger companies typically manage greater amounts of traffic and require more robust, dedicated hardware firewalls, while smaller companies often utilize software firewalls that can be sufficient for their needs.