At a security conference in 2002, after citing statistics that indicated that less than 0.0025 percent of corporate revenue on average is spent on information-technology security, Clarke was heard to say, "If you spend more on coffee than on IT security, then you will be hacked.