Episode 14 of The Security Podcast of Silicon Valley came out on March 1, 2022, with Jon McLachlan hosting. The guest was Biff Clark, co-founder of Coefficient Technologies, a cybersecurity firm for small and midsize businesses (Podbean, Apple Podcasts, Spotify, LinkedIn, Coefficient). The episode is called “Biff Clark, Cybersecurity Specialist and Owner of Coefficient Technologies, Frontiers of Cyber Security.”
Biff’s case is that security keeps the revenue a business has already earned. The rest of the talk is about how a smaller company can buy that protection: managed security by subscription, a CISO on demand, honest scoping, and insurers who, in Biff’s view, will set the bar.
This page follows the conversation in order: a section for each part of it, twelve figures, nine clips from the tape, a post from Biff’s LinkedIn, the full transcript, and five tools: a quiz, a scorecard for a cyber insurance renewal, a calculator for what an outage costs, a timeline, and a to-do list. Where the decodes of the tape disagree on a word, the transcript puts its best guess in brackets, and the page doesn’t quote or retell those words.
From the business side
Jon introduced Biff as co-founder of Coefficient Technologies, around since 2004, and as chair of the board of directors at the Hidden Genius Project. Biff came to security through the business side, with a background in marketing and sales.
“it was a passion later in life.”
Biff Clark, at 0:50
The first career was in the pharmaceutical industry. Biff was fast-tracked and moved to a new department every 18 to 24 months. LinkedIn lists 12 years at Block Drug Company and GlaxoSmithKline, from senior sales representative and trainer in 1992 to sales director (LinkedIn). Wikipedia describes Block Drug as a maker of dental care products, bought by GlaxoSmithKline for $1.24 billion in 2001 (Wikipedia).
Then Biff left the industry to start over. A friend talked about technology, and the two of them mapped the skills that carried over. Cybersecurity came next, once Biff saw how hard it would be for people to identify threats and protect their assets.
You can’t outsource understanding
Jon asked what Coefficient does. Biff called the team cybersecurity specialists whose job is to help customers understand security. A customer can roll out a tool or check a box, and it still has to understand what it bought.
“You can’t outsource the requirements around cybersecurity.”
Biff Clark, at 4:07
The customer has to know how to protect its employees and users, its data and its systems. Biff added that the answer is often a smart solution that addresses a concern and shifts behavior, more than a complicated one.
“if you can get some behavior modification, sometimes you can address some of the biggest threat issues that would be in front of you.”
Biff Clark, at 4:34
Jon agreed: the goal is to understand how the money helps the bottom line and the top line, more than to throw money at a problem.
Revenue retention
Biff added a second element. Most people treat security as a cost. Coefficient treats it as a way to keep the revenue a business already earns, because security protects the business an owner spent a life building.
“it’s sad that it can be taken away from you in less than three days”
Biff Clark, at 5:16
The threat in that sentence is a ransomware attack, with no experts nearby to answer it. Wikipedia defines ransomware as malware that holds a victim’s data hostage until a ransom is paid (Wikipedia). Everything a company worked for, and the families it feeds, can be lost.
Plug the gaps, then hand it over
Coefficient’s answer is the managed services model. Wikipedia describes managed security services as network security services outsourced to a provider, a managed security service provider, or MSSP (Wikipedia). Coefficient lays its tools over a customer’s environment to plug the weak spots. Then it transfers knowledge, so the in-house IT team or security staff learn the products while the gaps stay covered.
“if they need you to stay, you stay.”
Biff Clark, at 6:09
If not, the service works on demand: the customer pays a monthly or annual subscription, and Coefficient becomes a trusted advisor. Biff described three roles in one firm: a reseller of security tools, a managed services provider and a consultancy.
A CISO on demand
Jon compared it to the vCISO role, for companies too small to justify a full-time chief information security officer but big enough to need help. Wikipedia describes a CISO as the senior executive responsible for the strategy and program that protect an organization’s information assets (Wikipedia).
Biff pointed to salaries on both coasts. A network administrator, a security analyst and a CISO are significant investments, and a company has to ask whether it has enough work to keep them busy. A company in growth mode may want its money in research and development. Coefficient fills the gap until the company is ready to hire.
“a CISO on demand service, because we understand the industry, understand the environments, and understand the threats.”
Biff Clark, at 7:59
Reinvented twice
Jon noticed that Coefficient is an LLC, which suggested no outside investors. Biff confirmed there were none so far, and said outside money might be the quickest way to grow a managed services business, which needs a lot of bandwidth. The LLC dates to the early 2000s, when much of the work was subcontracting on open-ended contracts that grew through referrals and networking.
Then the recession hit, around 2008 and 2009. Wikipedia dates the Great Recession from late 2007 to mid-2009 (Wikipedia). Around 2009, Coefficient partnered with a company that did a lot of commercial business and had no service arm, and worked with it for about three years. When that company shifted toward federal work and managed services gained ground, Biff and a business partner restarted their own company.
“we reformed in 2014 and started pushing the managed service option.”
Biff Clark, at 10:20
LinkedIn dates Biff’s current role as co-owner of Coefficient to August 2014 (LinkedIn). Jon liked how the company moved with the market, like water.
Security by subscription
Jon called subscriptions the magic word for investors. Biff described how the model bends to a customer’s strategic plans. Coefficient supports the tools a customer already has and rolls them into its security operations center. Wikipedia describes a security operations center, or SOC, as the function that protects an organization against threats (Wikipedia).
Biff gave two cases. A company loses a security person and can only hire someone junior, so Coefficient lays its tools over the top, for a year or for 18 months. Or a company acquires another facility with significant vulnerabilities and needs stronger tools in place fast.
“It’s a lot easier than saying, hey, I’ve got to lay out this fee for three years in advance”
Biff Clark, at 12:14
Wikipedia notes that managed services are typically delivered under a subscription model (Wikipedia). Jon liked seeing subscriptions applied to services delivered by people.
A partner you can read
Jon noticed the “we” and asked about a business partner. Biff’s partner is Dennis Moore, a long-term friend. They reconnected years later, and with Dennis already working in cybersecurity, they went into business together.
Jon pointed out that the trust was there from the start. Biff agreed, and added that two people who have known each other that long still have brother fights. They work through them.
Jon’s view: honest, direct people make for a textured relationship, and that’s where a team becomes better than the sum of its individual parts, trying on each other’s perspectives like a pair of sunglasses. Biff added that you still remember an old friend’s habits from years back.
Coefficient was a team of five at the time, with two additional engineers, a sales and business development team, and an enterprise salesperson. For deeper expertise, Biff described a consortium of subject matter experts, since a lean company can’t keep every specialist on staff.
“I couldn’t have a better friend or partner.”
Biff Clark, at 16:53
Biff credited Dennis’s military background with the high integrity that matters in security: say what you mean, deliver on the services, and keep the focus on the customer.
Called in when it’s already bad
Biff’s aim is to be the trusted advisor a customer can ask anything, even about services Coefficient doesn’t offer. Sometimes the answer is a referral to someone else.
“we fight every day to become a trusted advisor”
Biff Clark, at 17:35
Jon tied it to leadership: relationships need trust, trust needs integrity, and integrity lets people have vulnerable moments without being taken advantage of. Biff’s life lesson was to treat people the way you want to be treated, which includes honesty about a learning curve or an availability problem.
Then Biff described the work itself.
“it’s similar to policing in some regards”
Biff Clark, at 19:13
Nobody calls to say everything’s fine and ask for a check against a gold standard. The call comes during an incident, when intensity is high, people are suspicious and questioning why things happened, and nobody knows the final cost. The firm has to show it’s trustworthy and get things done at an affordable price.
“a couple hundred dollars, that could be a couple thousand dollars, it could be a couple hundred thousand dollars”
Biff Clark, at 20:20
A hard sell when things are calm
Jon named the problem for anyone selling proactive security: when everything is peachy, the risk analysis gets pushed to next quarter, or next year, until the day it’s needed.
“That’s why I pushed the phrase, you know, revenue retention”
Biff Clark, at 20:49
Customers see security as a capital expense. Biff listed what an incident takes instead: a hit to the brand, a hit with employees who no longer feel the environment is stable, and a hit to revenue.
“your whole objective is to make sure you make more money year over year”
Biff Clark, at 21:17
The alternative, in Biff’s words, is $2 or $3 million snatched out of the coffers because a company didn’t want to pay for a solution, or for a person to lay out a real strategy.
Most people are good people
Jon asked a standing question: what’s the one truth that most people miss?
“I believe that most people want to do the right thing, and most people are good people.”
Biff Clark, at 21:59
Biff tied it to the crisis calls. A company waits too long on a refresh and has 30 days to choose a solution. Or privileges are lost, or someone misplaces a fob that gave access to highly sensitive information. Leaders want to do the right thing, and something holds them back today. Coefficient’s work is to help them decide sooner, and to think past this quarter about how to protect the organization and the people who handle sensitive data.
Every thank-you is a best day
Jon asked about Biff’s best day at Coefficient. The first answer was the day the company launched and Biff signed the document that made it official.
“It’s a continuum for us.”
Biff Clark, at 28:56
Every customer thank-you brings the same feeling back, especially after a switch from one solution to another, when a customer wonders whether it will work as promised, or after a network comes back up. Jon liked that the best day could come again tomorrow. Biff invoked Groundhog Day. Wikipedia describes the 1993 film as the story of a weatherman trapped in a time loop, reliving February 2 (Wikipedia).
“I’m always overjoyed when someone’s happy with the work that we do.”
Biff Clark, at 30:17
Scope it before you sign it
The worst day was a story Biff had talked over with Dennis, because it was an emotional one. A friend and mentor chairing a board asked Coefficient to replace a contracted IT team that wasn’t transparent. Biff expected a scoping exercise, maybe an audit and a report with recommendations. It turned into a contract to sign, before anyone had scoped the environment.
“it was a nightmare.”
Biff Clark, at 32:14
The network had no service contracts. Solutions weren’t deployed properly. The organization was short on money and people, and staff walked off the job in the middle of a major rollout. Dennis woke at three in the morning to reset systems every day so the rollouts could go ahead. Coefficient hired a team it could stay only an hour ahead of, and third-party consultants ate much of the contract money.
When Coefficient finally found the budget for new solutions and hardware with service contracts, the client decided it couldn’t afford Coefficient anymore, and asked to hire the two engineers Coefficient had placed there. The engineers had families to feed, so Biff and Dennis agreed, kept part of what they were owed, and let the engineers stay on site.
“you have to scope an exercise, or you have to scope an environment, prior to assessing what your cost might be.”
Biff Clark, at 35:22
Coefficient had also covered some costs for the client, to do the right thing. Biff sees two goals in contract work.
“get the contract, complete the contract.”
Biff Clark, at 36:12
The client ended up with a solid team that understood its environment, and Jon called that a success. Biff’s joke for next time: when a friend calls, let it go to voicemail.
The future is now
Jon asked what a smashing success looks like for Coefficient, and how far away it is.
“Actually, I think the future is now.”
Biff Clark, at 38:08
The pandemic and the shutdown were a quantum leap. Biff recalled an old joke: people who said they didn’t believe in the cloud while sending email through Hotmail, Gmail or AOL. With everyone working remotely, managed services took off, and so did a smaller footprint, with fewer data centers, less money spent on leases and less greenhouse gas.
Biff added that managed security tools get patched around the clock. A company running its own tools waits for a patch and schedules it 30 days out.
“So we believe now that the whole managed service model is upon us.”
Biff Clark, at 39:55
One more trend helps: when the economy resets, a whole new set of companies starts, and smaller companies need more help than mature ones.
One choke point
Jon saw the same rush to managed services. Biff added a twist: a managed services provider needs managed security on top of its own environment, and that’s a new market for firms like Coefficient. Providers built big businesses around Office 365, Workday and other offerings, and they need tools to make sure they aren’t vulnerable.
“Because now it’s just one choke point.”
Biff Clark, at 41:37
If a criminal gets into a managed services provider, in Biff’s words, the attack takes down companies all around the country. Wikipedia describes such a case from July 2, 2021: attackers exploited a vulnerability in Kaseya’s VSA remote monitoring software, and ransomware hit about 60 managed service providers and their customers, with downtime for over 1,000 companies. Wikipedia calls it a form of supply chain attack (Wikipedia). Biff added that providers need cyber insurance too.
Insurance will raise the bar
Jon asked where cyber insurance goes, given the ransomware attacks and what they cost.
“it’s going to go through a level set.”
Biff Clark, at 42:14
Biff expected insurers to decide which tools count, since a simple checkbox won’t give them confidence. Coverage would come in tiers by company size, with quality products rated against certain threats. A 10-person company might buy Norton’s personal product, and the insurer would only cover the business or enterprise version. Wikipedia describes Norton AntiVirus as part of the Norton family of security products, sold since 1990 (Wikipedia).
Insurers would also check behavior: best practices, security awareness training, backups, redundancy and disaster recovery plans. Wikipedia notes that many cyber insurance policies already require an IT security audit before the carrier will bind the policy (Wikipedia). Biff’s comparison was taxes: you can do your own, and when the IRS calls, you have to answer the questions.
“Let us do your taxes. Let us do your cybersecurity”
Biff Clark, at 43:52
A small world
Jon noticed on LinkedIn that Biff knew Prakash Darji, then general manager of cloud services at Pure Storage, who had worked at SAP. Biff had met Prakash during Prakash’s SAP years, and later had a one-on-one with Prakash about presenting a product that found bugs in SAP HANA as a service to support the HANA rollout. Wikipedia describes SAP HANA as an in-memory, column-oriented, relational database management system from SAP (Wikipedia).
Prakash had been a guest on episode 6, and Jon heard the same message from both: the future is services, and those services need security. Jon had also reported up through Prakash’s chain at Pure Storage, in cloud security.
“It’s a small world, isn’t it?”
Jon McLachlan, at 46:28
Understand the why
Jon’s last question was Biff’s favorite interview question. Biff’s favorite is a question Biff likes being asked: what shaped your life? People rarely stop to reflect on the moments that shaped them, and the answer is a kind of homage to the people who helped.
Biff’s answer was a mentor. Early on, Biff wanted to work in sales, left a job to find it, and took a holiday job in retail. A customer brought in a broken high-end leather briefcase, and Biff kept the customer updated until it was fixed. The customer turned out to be a national sales director at a pharmaceutical company, who recruited Biff as a traveling salesperson who could fill an open territory within three days. That became Biff’s first sales job, and the director became Biff’s mentor.
“it’s not what someone does to you or for you, it’s why.”
Biff Clark, at 49:28
When someone gives you an opportunity, ask why they trusted you and what they’re trying to accomplish.
“Because then you can align with their mission.”
Biff Clark, at 49:52
Small victories
Jon praised Biff’s philanthropic work. Biff enjoys creating opportunities for others and exposing them to new horizons.
“You got to give back.”
Biff Clark, at 50:47
Jon talked about continuous learning and being the change we want to see. Biff noted that the work isn’t easy, and Jon offered a way to keep going.
“Small victories are still victories.”
Jon McLachlan, at 51:34
What happened after the tape
Coefficient since. LinkedIn lists Biff as co-owner of Coefficient Technologies, which now does business as Surveillent Cyber, and describes the firm as “enterprise grade cybersecurity backed by over 20 years of proven experience” (LinkedIn). The company’s site offers a 24/7 security operations center as a service and readiness work for CMMC 2.0 (Coefficient).
Giving back. LinkedIn lists Biff as past board chair and emeritus board member of the Hidden Genius Project since May 2018, and as a mentor in the SF CITI Future Grads interns program from 2013 to 2018 (LinkedIn). The project says it trains and mentors Black male youth in technology creation, entrepreneurship and leadership (The Hidden Genius Project).
Prevention as an investment. On October 20, 2026, during Cybersecurity Awareness Month, Biff made the same point in other words: “PREVENTION is an INVESTMENT and, RECOVERY is an EXPENSE.” The post invites readers to a risk assessment from Surveillent Cyber.
Biff on prevention as an investment and recovery as an expense.
Biff Clark · October 20, 2026
The same themes on this show. Episode 6 had Prakash Darji of Pure Storage on ransomware and pricing each level of security. Episode 45 had Craig Goodwin, then Bleach Cyber’s CEO, on simple security for small businesses and MSSPs. Episode 83 had Phil Howie of Sydekick on making security doable for small businesses and selling through MSPs.
Did you catch it? A seven-question quiz
Seven questions from the episode. Each answer links the moment in the transcript or its section.
Quiz · seven questions
Did you catch it?
Pick an answer to see whether you caught it.
-
Where did Biff's first career happen?
b. "I had a successful career working in the pharmaceutical industry." Transcript, 0:56.
-
What does Biff say a company can't outsource?
c. "You can't outsource the requirements around cybersecurity." Transcript, 4:07.
-
What does Coefficient call security, where most people see a cost?
a. Security protects the business an owner spent a life building. See Revenue retention.
-
What did Coefficient do in 2014?
b. "we reformed in 2014 and started pushing the managed service option." Transcript, 10:20.
-
What lesson did Biff take from the worst day?
a. A scoping job turned into a contract before anyone had looked at the environment. See Scope it before you sign it.
-
Why does Biff call a managed services provider one choke point?
b. Providers need managed security on top of their own environments. See One choke point.
-
What did Biff's mentor say to understand?
a. "it's not what someone does to you or for you, it's why." Transcript, 49:28.
Ready for your cyber insurance renewal?
Eight questions on what Biff expects insurers to check, built from the episode. Each tip links the section behind it.
Scorecard · eight questions
Ready for your cyber insurance renewal?
Answer for the business as it runs today. If two answers fit, pick the lower one.
-
Are your security tools business or enterprise editions?
- Some consumer editions
- Mostly business editions
- All business or enterprise, each with an owner
Biff's example: an insurer may only cover the business or enterprise version of a tool. See Insurance will raise the bar.
-
When did you last restore from a backup, start to finish?
- Never
- More than a year ago
- In the last quarter
Backups are on Biff's list of what insurers will check. See Insurance will raise the bar.
-
Does everyone get security awareness training?
- No
- Once, when hired
- Yes, every year
"if you can get some behavior modification, sometimes you can address some of the biggest threat issues that would be in front of you." See You can't outsource understanding.
-
Is there a written disaster recovery plan?
- No
- Written, never tested
- Written and tested
Disaster recovery plans are on the same list. See Insurance will raise the bar.
-
Do your critical systems have redundancy?
- No
- Some of them
- Yes, and we test the failover
Redundancy is on the list too. See Insurance will raise the bar.
-
How fast do critical patches land?
- On a 30-day list
- Within a week
- Within days, around the clock
Biff's case for managed tools is that they get patched around the clock. See The future is now.
-
Does your IT provider watch its own security?
- We don't know
- They say so
- Yes, and they showed us how
"Because now it's just one choke point." See One choke point.
-
If an incident hit tomorrow, who would you call?
- We'd search for someone
- We know a firm
- A firm on retainer, with a plan
Biff compares security work to policing: the call comes when there's an incident. See Called in when it's already bad.
Start with a backup you've restored and business editions of your security tools.
The basics are there. Test the recovery plan and ask your IT provider how it protects its own environment.
Keep testing, and keep the evidence where an insurer can see it.
What would a three-day outage cost?
The calculator prices an outage in lost sales, as in Revenue retention, and compares it with a monthly fee for managed security.
Calculator
What would a three-day outage cost?
Five numbers: yearly revenue, working days in a year, days down, the share of each day's sales lost while down, and a monthly fee for managed security.
At $5,000,000 a year over 250 working days, a 3.0-day outage that stops 80% of each day's sales costs about $48,000. That equals 16.0 months of a $3,000 monthly fee for managed security.
The defaults are placeholders, so swap in your own numbers. The math leaves out recovery work, ransom, legal costs and the hit to the brand, so treat the result as a floor. Biff's phrase for keeping that money is revenue retention.
From pharmaceutical sales to managed security
Biff’s path, the field around it, and this show. Filter by topic.
Timeline
From pharmaceutical sales to managed security
- Pharmaceutical sales
Biff starts at Block Drug Company as a senior sales representative and trainer (LinkedIn, on this page).
- Sales director
Biff becomes a sales director, a role LinkedIn runs to 2004 (LinkedIn).
- GlaxoSmithKline buys Block Drug
The deal is worth $1.24 billion (Wikipedia).
- Light Rock Video
Biff becomes executive producer and co-owner at Light Rock Video, into 2007 (LinkedIn).
- Coefficient Technologies
Biff founds an IT services company for small and midsize businesses (LinkedIn, Coefficient, on this page).
- The Great Recession
A downturn that runs to mid-2009 (Wikipedia, on this page).
- Miami Music Project
Biff becomes a senior advisor, into August 2010 (LinkedIn).
- A partnership
Coefficient partners with a commercial firm for about three years (on this page).
- The Hidden Genius Project
The nonprofit is founded to train and mentor Black male youth in technology creation, entrepreneurship and leadership (The Hidden Genius Project).
- Future Grads
Biff mentors in the SF CITI Future Grads interns program, into 2018 (LinkedIn).
- Coefficient, reformed
Biff becomes co-owner of the reformed company, which pushes managed services (LinkedIn, on this page).
- A board seat
LinkedIn dates Biff's board role at the Hidden Genius Project, now past chair and emeritus member, to May 2018 (LinkedIn, on this page).
- The Kaseya VSA attack
Ransomware hits about 60 managed service providers and their customers (Wikipedia, on this page).
- Episode 6
Prakash Darji of Pure Storage on ransomware and pricing each level of security (episode 6).
- This episode
Biff on the show (Podbean).
- Episode 45
Craig Goodwin on simple security for small businesses (episode 45).
- Episode 83
Phil Howie on making security doable for small businesses (episode 83).
- Prevention as an investment
Biff's post for Cybersecurity Awareness Month (LinkedIn, on this page).
What to do this week
Five things, in the order of the episode.
- Write down what you can’t outsource. Name who owns your security decisions, your data and your systems, even when a provider runs the tools, as in You can’t outsource understanding.
- Put a number on an outage. Run the calculator with your own revenue, as in Revenue retention.
- Scope before you sign. Before you take over another team’s environment, or hand yours to a provider, check the service contracts, the deployments and the staffing first, as in Scope it before you sign it.
- Ask about your provider’s security. If a managed services provider runs your IT, ask how it monitors and protects its own environment, as in One choke point. The scorecard covers the rest of an insurer’s list.
- Get help with it. Our vCISO service runs security on demand, 24/7 Monitoring & Response watches your environment, and Penetration Testing finds the gaps an attacker would. If you want to talk it through, book 15 minutes with us.