In the framework of risk assessment for flash floods, vulnerability is a key concept to assess the susceptibility of elements at risk. Vulnerability is defined as expected degree of loss for an element at risk due to a hazard impact of a defined magnitude and frequency. Besides the increasing number of studies on flash floods available, in-depth information on vulnerability was missing so far. In order to close this gap, a vulnerability model was created for micro-sized enterprises exposed to flash floods in Greece. This model was based on a nonlinear regression approach using data from four different events. By means of bootstrapping, different functions were fitted to the data, and a modified Weibull distribution was found to represent the relationship between process magnitude and degree of loss best. Moreover, there is no need to distinguish between different business sectors when computing vulnerability for buildings exposed. The model can be applied on a local scale and may serve as a basis for flash flood risk management.