My guess would be closer to 50 to 100 involved in the planning and at least 3 to 4 for each plane.
You need at least 1 to pilot, perhaps 2 in case the first is incapacitated. Then you need 1 or 2 to control the passengers while the pilot flies.
While it's true that airport security is hardly airtight, think of the planning it took to get all four teams in place. We have not heard of any teams of terrorists who were prevented from getting onboard. Until we do, we must assume that only 4 were planned and all 4 were succesful.
The amount of planning for something like this must be staggaring. They took planes from 2 different airlines and 2 (3?) different airports. Each airline and each airport would have differences in security procedures which would have to be scouted throroughly.
This has been in the works for months. And it would be easy to just say that someone in the counter-terrorist community screwed the pooch. However, the alternative is even more frightening. What if they did their job? What if the bad guys either found a whole in the system or maintained such security that we had no way of seeing it?
Money, time, planning, skills to fly a 757, willingness to die, knowledge of airport security, coolness to get aboard the planes, timing and coordination in the extreme, and the list goes on. This is not the work of a bunch of whackos with a cheap alarm clock and some dynamite. This was a professionally done attack.