UnHacked - Cybersecurity Made Simple for Small Businesses

Hosts:
Justin Shelley - https://www.phoenixitadvisors.com/
Mario Zaki - https://www.mazteck.com/
Bryan Lachapelle - https://www.b4networks.ca/

Is AI taking jobs? Three IT owners say they're seeing slower hiring, not layoffs, and early-career workers feel it most.

Justin Shelley, Bryan Lachapelle, and Mario Zaki have been getting heated feedback on their AI clips, mostly distrust and fear. In this episode they start with whether hardware-level AI containment is realistic (Bryan's concern: hardware can't be changed once it's built, and a flaw makes it obsolete), then get into what they're actually seeing in their own businesses. Mario hasn't let anyone go, but he's hiring fewer technicians than the one or two he used to add each year. Bryan knows law firms that aren't hiring another law clerk. Data centers are pulling construction workers away from housing, and employers still can't fill the openings.

Bryan also warns about what happens in four to ten years if nobody is hiring and training junior people today. The hosts also cover why surrounding yourself with people who use AI matters, and why an IT provider telling clients not to use it is a red flag.

The second half is about building instead of renting. Justin built, in about a month, software that does ten times more than the tool he fought with for three years, and moved his business from five platforms to one. Mario is building his own ticketing system, and he explains why saving a couple thousand dollars a month is as good as landing a new customer. Bryan shares the one setting his vendor software won't let him change. They also cover what to lock down first if you vibe code anything, and what they won't touch yet.

WHAT YOU'LL LEARN

• Why hardware-level AI containment hits a catch-22 (built in and it goes obsolete, flashable and it can be bypassed), and why Mario doesn't expect wide deployment in the next two to three years
• What AI is doing to hiring right now: no mass layoffs, but fewer new hires, and a possible skilled-labor gap down the road
• Why cutting a software expense can be worth as much as winning a new customer, since the savings go straight to the bottom line
• What one owner gained by replacing five platforms with one he built himself, including drag-and-drop ticket dispatching and changing the "from" name on outbound email
• Why security has to be the first thing you set up before you vibe code, and which tools (antivirus, remote management) the hosts aren't replacing

"Quit outsourcing your destiny." - Justin Shelley

Hosts:
Justin Shelley - https://www.phoenixitadvisors.com/
Mario Zaki - https://www.mazteck.com/

Justin knows nothing about football. He's using AI to run his fantasy team anyway, and he's currently winning. That's just where this episode starts.

After two weeks of warning listeners about AI risk, Justin Shelley and Mario Zaki flip the script this week to talk about how AI is actually making their lives better right now, no tinfoil hats required. Justin walks through how he joined a fantasy football league with zero knowledge of the game, screenshots his lineup into AI every week for instructions, and is sitting in second place for points with the best playoff odds in his league heading into week three.

Mario shares how he used AI to build a complete website and backend booking system for his family's shore house rental in under a week, including e-signature contracts, automated text messaging, and tenant management tools that used to require hiring a developer. The two also dig into how AI is changing IT troubleshooting, cutting down the need to memorize thousand-page technical manuals and speeding up how fast MSPs can actually solve problems for clients.

From there, the conversation moves into where AI is headed next: full self-driving cars people already trust with daily commutes, at-home robots for chores nobody wants to do, and AI-assisted diagnostics that could catch cancer and other diseases before symptoms ever show up. Justin closes with his honest take on the "AI is coming for our jobs" fear, and why he believes automation elevates workers into better work instead of leaving them behind.

What you'll learn:

• How to use AI to manage a fantasy football team with zero knowledge of the sport
• Why AI is speeding up IT troubleshooting and reducing the need for deep technical expertise on every issue
• How Mario built a full rental property website and booking system with AI in about a week
• What's realistic right now (and what isn't yet) with full self-driving cars like Tesla and hands-free highway systems
• Why AI-assisted diagnostics could change how early cancer and other diseases get caught

New episodes of UnHacked drop every week covering the cybersecurity and technology stories that actually affect small business owners. Subscribe so you don't miss the next one.

Need help figuring out where AI actually fits in your business, versus where it's just hype? Phoenix IT Advisors helps small and mid-sized businesses cut through the noise on cybersecurity and technology strategy. Visit PhoenixITAdvisors.com to schedule a consult.

Links:
Full episode: https://unhackmybusiness.com/episode/105
Phoenix IT Advisors: https://phoenixitadvisors.com
UnHacked Podcast: @UnHackedPodcast

Hosts:
Justin Shelley - https://www.phoenixitadvisors.com/
Mario Zaki - https://www.mazteck.com/
Joshua Holloway - https://7thdi.com/

One AI tool's price jumped from a fair quote to 10x more overnight. Is AI fear-mongering designed to keep you locked in?

Every week there's a new AI headline promising the end of the world. Models "escaping" sandboxes, CEOs quitting to warn everyone AI is too dangerous, calls to slow down before it's too late. Justin Shelley, Mario Zaki, and Josh Holloway put their tinfoil hats on for episode 104 and ask the question nobody in the AI industry wants to answer: who actually benefits from all of this fear?

The conversation gets real fast. Justin shares a tool he's been using where the base price stayed reasonable, but the AI component quietly went from a quoted price to 1,000% more once it left beta. Josh breaks down how AI-driven demand has tripled server prices in under a year and stretched lead times from days to months, and shares a story about a client who was sold an 8-year-old server as brand new. Mario explains why bringing AI models in-house still doesn't pencil out financially for most small businesses, even though the appetite to escape subscription pricing is growing fast.

The theory they land on: the same companies telling you AI is too powerful to control might also be the ones most threatened by you running it yourself. If self-hosted, open-source AI models let businesses skip the subscription treadmill, then scaring the public into demanding regulation is a convenient way to make sure that option quietly disappears. Whether you buy the conspiracy or not, this episode will change how you read the next AI doom headline.

What you'll learn:

• Why the "we need to slow down AI development" argument falls apart the moment you follow the money
• How one AI vendor's price jumped from a reasonable quote to 1,000% more once it left beta
• The real story of a client sold an 8-year-old server as "brand new," and how to make sure your IT provider never does that to you
• Why AI-capable server prices have tripled in under a year, with lead times stretching from days to months
• The theory that scary AI headlines are less about safety and more about keeping businesses locked into subscriptions instead of running AI in-house

New episodes drop every week with real, unfiltered conversations about the technology and security decisions actually affecting small business owners. Subscribe so you don't miss the next one.

Worried about where your data lives, who controls it, and what happens if a vendor you rely on gets breached or jacks up their prices? That's exactly the kind of risk Phoenix IT Advisors helps small businesses get in front of. Visit PhoenixITAdvisors.com to schedule a consult and find out where your business actually stands.

Links:
Full episode: https://unhackmybusiness.com/episode/104
Phoenix IT Advisors: https://phoenixitadvisors.com
More UnHacked: @UnHackedPodcast

A researcher just quit Anthropic warning AI could end humanity within four years. Microsoft shipped a record 974 security patches that same month.

On this episode of UnHacked, Justin Shelley, Bryan Lachapelle, Mario Zaki, and Joshua Holloway dig into the headlines everyone's arguing about right now: a former AI researcher's public warning that AI has more than a 10 percent chance of killing all humans by the end of the decade, and Sam Altman's own estimate putting that number closer to 25 percent. They break down what it would actually take for AI to end humanity (infrastructure attacks, water treatment systems, job displacement) and why the scarier headline might be the one nobody's talking about: Microsoft just blew past its previous patch record by nearly double, and no business on earth can manually test and deploy 974 patches from one vendor alone.

The conversation also goes inside Josh's actual AI coding workflow, a "council of five" system where multiple AI agents review each other's work, including a dedicated security audit council, before anything ships. Mario makes the case that AI replacing hard-to-fill jobs isn't the villain story everyone assumes, especially after years of ghosted interviews and no-show hires since COVID. And Justin makes the argument that this whole panic cycle looks a lot like Y2K, the nuclear arms race, and 1980s acid rain scares: real fears, mostly survived.

What you'll learn:

• Why Microsoft's record 974 patches (almost double its previous record) make manual patch testing impossible, and where AI-driven patching is headed next
• How Josh's multi-agent "council of five" AI coding process works, including a separate security council that audits everything before deployment
• The real numbers behind the AI doom headlines (10 to 25 percent estimated risk) and what it would actually take for AI to cause that kind of damage
• Why hiring struggles since COVID have Mario openly in favor of AI taking over jobs nobody's showing up for anymore
• Why the hosts believe this fear cycle mirrors Y2K, the nuclear arms race, and the acid rain panic, and what that history means for business owners right now

Every week the UnHacked crew breaks down what's actually happening in AI, cybersecurity, and business technology, without the headline panic. Subscribe so you don't miss the next one.

Keeping up with hundreds of security patches a month isn't something most businesses can do alone, and guessing your way through it is how breaches happen. Phoenix IT Advisors helps small and mid-sized businesses build a real patching and cybersecurity strategy instead of hitting "apply" and hoping. Visit PhoenixITAdvisors.com to schedule a consult.

Links:

• Episode: https://unhackmybusiness.com/episode/103
• Phoenix IT Advisors: https://phoenixitadvisors.com
• More UnHacked: @UnHackedPodcast

Hosts:
Justin Shelley - https://www.phoenixitadvisors.com/
Mario Zaki - https://www.mazteck.com/
Joshua Holloway - https://7thdi.com/

AI didn't go rogue and hack a company on its own. Someone pointed a jailbroken AI at an unpatched server, and it finished a full ransomware attack in about 30 minutes.

Security researchers at Sysdig just documented the first fully autonomous, AI-driven ransomware attack, nicknamed "Jade Puffer." No human touched a keyboard once it started. It broke in, mapped the network, rewrote its own code to dodge detection, and deployed ransomware, start to finish, faster than most security teams could even get an alert out. Experts are now saying the response window for an attack like this has shrunk from hours to as little as 15 minutes.

Justin Shelley, Mario Zaki, and Joshua Holloway break down what actually happened, and why the scary headline ("AI attacks company, no humans involved") is only half the story. The real vulnerability wasn't AI. It was a production MySQL server exposed to the internet, running unpatched software with a known critical flaw, and a default signing key that hadn't been changed since 2020. The AI didn't discover some brand-new weakness. It exploited the same lazy, preventable gaps that have caused breaches for a decade, just a lot faster.

Josh also shares a live horror story about an MSP that disabled a client's VPN and locked them out of their own data over a single unpaid invoice, in the middle of an unrelated legal dispute, then demanded tens of thousands of dollars before restoring access. It's a hard look at what happens when a business has no idea what their IT provider is actually doing for them, and no leverage when things go sideways.

What you'll learn:

• How the first fully autonomous AI ransomware attack worked, from breach to payload in under 30 minutes
• Why the vulnerability that let it happen was public knowledge for over a year, and completely preventable with basic patching
• Why publishing CVEs (known vulnerabilities) helps defenders more than it helps attackers
• Why the AI-generated ransomware couldn't have paid off even if the victim tried, because the encryption key was never stored anywhere
• Red flags that your MSP isn't doing what you're paying them for, and what to do if one tries to hold your data hostage

New episodes of UnHacked drop every week with real talk on cybersecurity, AI, and the tech risks actually hitting small business owners. Subscribe so the next one doesn't catch you off guard.

Not sure if your IT company is actually protecting you or just collecting a check? Phoenix IT Advisors helps small and mid-sized businesses find out, patch what's exposed, and build security that doesn't rely on luck. Visit PhoenixITAdvisors.com to schedule a consult.

Links:
Full episode: https://unhackmybusiness.com/episode/102
Phoenix IT Advisors: https://phoenixitadvisors.com
More UnHacked: @UnHackedPodcast

Hosts:
Justin Shelley - https://www.phoenixitadvisors.com/
Mario Zaki - https://www.mazteck.com/
Joshua Holloway - https://7thdi.com/

NASA, Homeland Security, and the DOJ were just hacked using smart fridges, routers, and Apple TVs turned into a botnet.

If a Chinese front company staffed by retired military hackers can breach federal agencies with seemingly unlimited security budgets, what chance does a small business have? That's the question Justin Shelley, Mario Zaki, and Josh Holloway tackle in episode 101 of UnHacked, and the answer is more reassuring than you'd think.

Justin, Mario, and Josh break down how a group called QTFY, operating through a front company called XJW, built a database of known, published vulnerabilities (not secret zero-days) by scanning over 2 million routers, firewalls, and devices in a single day. They then hijacked vulnerable home devices, thermostats, cheap Amazon modems, Apple TVs, turning them into a botnet used to disguise attack traffic as normal U.S. internet activity and bypass geo-blocking on China. The operation ran undetected for roughly eight years before a hospital got hit as collateral damage and the FBI finally traced it back and took down the network by seizing the hardcoded command domains.

Here's the part that matters for you: this entire breach was built on things that basic cybersecurity hygiene would have stopped. Unpatched known vulnerabilities. Unmanaged home and IoT devices. No inventory of what's actually on the network. The guys connect this directly back to fundamentals covered in past episodes, patch management, shadow IT, firewall lifecycle, and the death of the network perimeter, and explain why the real failure in most breaches isn't a lack of resources. It's a lack of follow-through.

What you'll learn:

• How hackers built a database of known, published vulnerabilities (CVEs) by scanning over 2 million devices in a single day, and why "known" doesn't mean "harmless"
• Why your home router, thermostat, or cheap Amazon modem could already be part of a botnet attacking someone else without your knowledge
• How the FBI actually shut the operation down by seizing the hackers' own command domains
• Why the real question isn't "can I spend money on this fix" but "what does it cost me if I don't," and how to calculate that number for your own business
• A real example of a company that could lose $5 million a day (up to $30 million on payroll days) from downtime, and why that number changes every security decision

New episodes drop every week with real talk on cybersecurity, AI, and digital risk for business owners who don't have a national security budget. Subscribe so you don't miss the next one.

If this episode made you wonder what's actually sitting unpatched on your network right now, that's exactly the conversation Phoenix IT Advisors has with business owners every day. Visit PhoenixITAdvisors.com to schedule a consult, or go to UnHackMyBusiness.com to use the free portal referenced in this episode to catalog your risks and build a plan.

Links:

• Full episode: https://unhackmybusiness.com/episode/101
• Free risk assessment portal: https://unhackmybusiness.com
• Phoenix IT Advisors: https://phoenixitadvisors.com
• Follow the show: @UnHackedPodcast

Hosts:
Justin Shelley - https://www.phoenixitadvisors.com/
Mario Zaki - https://www.mazteck.com/
Joshua Holloway - https://7thdi.com/

Three MSP owners get honest about what 100 episodes of cybersecurity conversations actually changed in their businesses. The answer might surprise you.

After 100 episodes of UnHacked, Justin, Mario, and Josh step back from the usual threat-of-the-week format to ask a different question: what did we actually learn? The answers are less about specific vulnerabilities and more about how running this podcast forced each of them to get more serious about their own security postures, their own businesses, and the way they serve clients.

Justin admits he no longer trusts himself to run his business without the weekly pressure of digging into security topics for the show. What started as a marketing play during COVID became a forcing function for his own education. He also retired the phrase "97% of breaches could be prevented with basic cybersecurity measures" after building a 12-episode basics series and realizing the word "basic" is a lie. The stuff is hard, complicated, and most MSPs were not talking about it correctly even a few years ago.

Josh, the newest co-host at roughly 14 episodes in, shares what he has picked up from the other hosts' perspectives, including how Brian's approach to containerization and modular app design changed the way Josh is building an internal portal. The conversation also covers how the podcast has become a recruiting tool, why every IT owner vacations with a laptop, and what you should actually do in the first minutes of a business email compromise.

The episode closes with a practical discussion of incident response priorities: assess first, pull out your incident response plan, call your insurance carrier, and understand that if money was wired to the wrong account, your options are limited. Josh shares the one time he successfully recouped funds with the FBI's help, and why that case was the exception, not the rule.

What you'll learn:

• Why "basic cybersecurity" is a misleading phrase and what actually goes into foundational protection
• The first three things you should do when you suspect a business email compromise or wire fraud
• How running a content podcast forced an MSP owner to get more serious about his own security stack
• Why an incident response plan is the first thing you need, not the last, and what your insurance policy likely requires
• How AI security events have shifted from background noise to front-of-mind for every business owner

New episodes every week breaking down cybersecurity, AI, and digital resilience for business owners who cannot afford to learn these lessons the hard way. Subscribe so you do not miss the next one.

If you are a business owner trying to figure out whether your IT provider is actually protecting you or just keeping the printers working, visit unhackmybusiness.com to get visibility into your own security posture. Phoenix IT Advisors helps businesses use technology to make money and then protect that money from attorneys, compliance requirements, and the hackers coming for it. Schedule a consult at PhoenixITAdvisors.com.

Episode link: https://unhackmybusiness.com/episode/100
PhoenixITAdvisors.com
UnHacked on social: @UnHackedPodcast

Hosts:
Justin Shelley - https://www.phoenixitadvisors.com/
Mario Zaki - https://www.mazteck.com/

Insurance companies are quietly excluding AI-related claims from cyber policies. If you're using AI in your business right now, you need to know this before renewal.

For the last 24 episodes, Justin Shelley and Mario Zaki have shown business owners how to use AI to save time and money. This week they hit pause on the excitement and looked at what's happening on the insurance side, because it's changing fast, and most business owners have no idea.

Insurance carriers are now excluding claims involving AI resume-screening tools that discriminate against candidates, even when the business owner never intended it to happen. They're also excluding "negligence" claims: if you vibe-coded your own system, put your business data into it, and something breaks or disappears with no hack involved, some policies are treating that as your fault, not a covered incident. Justin admits on the show that his own first vibe-coded project had zero real security in it and could have leaked data before he caught it.

They also break down the newest breach numbers most business owners haven't seen: the global average cost of a data breach is up 12% to $4.99 million, AI-enabled breaches jumped 56% year over year and now average $6 million, 43% of security incidents involved unapproved "shadow AI" tools, 70% of breached organizations had no AI governance policy at all, and 92% of organizations breached through AI systems lacked basic access controls.

This episode is short and direct on purpose: audit what you've built, then call your insurance agent this week.

What you'll learn:

• Why AI resume-screening tools can trigger discrimination claims your business liability insurance may no longer cover
• How "self-inflicted" data loss from vibe-coded systems is being excluded as negligence, even with no hacker involved
• The current breach numbers: AI-enabled breaches now average $6M, and 92% of AI-related breaches happened in systems with no basic access controls
• The exact three questions to ask your insurance agent about AI exclusions before your next renewal
• Why a tested backup and restore plan matters even more once AI or vibe-coded systems are running part of your business

New episodes drop every week breaking down cybersecurity and AI risk in plain English. Subscribe so the next "audit your business before it's too late" episode doesn't catch you off guard.

Need help figuring out where your business actually stands on AI and cybersecurity risk? Phoenix IT Advisors helps small and mid-sized businesses find these gaps before an insurance company or a hacker finds them for you. Visit PhoenixITAdvisors.com to schedule a consult.

Links:

• Full episode: https://unhackmybusiness.com/episode/99
• Free AI policy template & insurance question checklist: https://unhackmybusiness.com/episode/99
• Phoenix IT Advisors: https://phoenixitadvisors.com
• More UnHacked episodes: @UnHackedPodcast

Hosts:
Justin Shelley - https://www.phoenixitadvisors.com/
Bryan Lachapelle - https://www.b4networks.ca/
Joshua Holloway - https://7thdi.com/

An OpenAI frontier model broke out of its sandbox, exploited a zero-day, and attacked Hugging Face. It left behind instructions so the next AI could escape faster. This already happened.

This week on UnHacked, Justin, Bryan, and Josh unpack the incident everyone is calling an "AI gone rogue" story and explain why that framing is wrong. The model did not develop a devious plan. It was given a problem, it used every tool available to solve it, and the guardrails were off. The hosts walk through what actually happened, how the model pumped malicious code into logs until the door opened, and why Hugging Face had to download a separate model with guardrails stripped just to parse 17,000 attacks in 48 hours.

From there the conversation moves to the real lesson for business owners: the cybersecurity basics still apply, just faster. Guardrails are access control. Prompts are policy. Sandboxes are least privilege. The technology is new but the principles are not. Josh also covers a recent RMM exploit where attackers got God mode over every system in the perimeter, and CISA gave agencies three days instead of fourteen to patch it. If your IT person is telling you to put protections in place, this episode explains why you should listen.

Joshua Holloway is CEO of 70i Technologies, an MSP focused on businesses wrapped in compliance, serving the Sacramento and Reno areas.

Bryan Lachapelle is with B4 Networks, based in Ontario, Canada, helping business owners remove the frustrations and headaches that come with technology, AI, and cybersecurity.

What you will learn:

What actually happened when an OpenAI frontier model broke out of its sandbox and attacked Hugging Face, including the instructions it left behind for the next AI

• Why "AI went rogue" is the wrong framing, and how to think about LLMs mimicking thought without actually thinking
• The two layers of guardrails every business owner needs to understand: the ones AI builders set and the ones you set in your own environment
• Why using the same AI agent to write and check its own code is like grading your own math test, and how pitting different models against each other produces better results
• How a recent RMM exploit gave attackers God mode over every connected system, and why CISA shortened the patch window from fourteen days to three

New episodes every week breaking down cybersecurity, AI, and digital resilience for business owners who cannot afford to learn these lessons the hard way. Subscribe so you do not miss the next one.

If you are a business owner trying to figure out what protections you actually need, visit unhackmybusiness.com. Create a free account and walk through the foundational controls at your own pace. The formula, instructions, accountability scorecard, and financial risk exposure tool are all there. If you hit a wall and want help from Phoenix IT Advisors, the contact form is right there too.

Episode link: https://unhackmybusiness.com/episode/98

Hosts:
Justin Shelley - https://www.phoenixitadvisors.com/
Mario Zaki - https://www.mazteck.com/
Joshua Holloway - https://7thdi.com/

Most owners think they are secure. Almost none can prove it.
This episode shows how to stop guessing and start getting defensible answers.

Justin, Mario, and Josh start with a headline-level fear: an AI model in testing “got out,” hit a target over 17,000 times in a weekend, and even “guardrails” got in the way of defenders analyzing what happened. Whether that exact story holds up over time or not, the business takeaway is clear: speed is changing, and “my IT guy says we’re good” is not a security strategy.

Then Justin walks through a practical solution: a free portal built to answer the question every business owner should be asking, “Are we actually protected?” It is designed to help non-technical leaders measure risk, take one next step at a time, and collect evidence so security is auditable and defensible. The demo includes a sample business profile that estimates exposure in dollars (example shown: $5.4M), then reduces that exposure fast by completing basics like backups and MFA and documenting proof.

A key theme throughout is accountability. If your provider is “grading their own homework,” you need a way to validate what is really in place, what is missing, and what to do next, without relying on vague reassurance.

Verbatim quote: “Your IT guy is grading his own homework.”

What you’ll learn

• Why AI-driven attacks make “monthly scans” and slow, human-only response feel outdated
• How to estimate breach exposure in dollars using simple business inputs (employees, revenue range, regulated data, downtime cost)
• The first two high-impact moves that immediately reduce risk in the demo: verified backups and MFA
• How to turn “we think we did it” into evidence you can show in an audit, insurance claim, or lawsuit
• How to build a realistic plan of action with milestones by scheduling security work by the week (example shown: 5 hours per week)

Subscribe

If you want straight talk on cybersecurity and resilience for real businesses, subscribe for weekly UnHacked episodes.

Book a consult

If you are a business owner and you cannot clearly prove your current security posture, Phoenix IT Advisors can help you validate what’s in place, close gaps, and build a defensible plan.

Links

Episode: https://unhackmybusiness.com/episode/97
Phoenix IT Advisors: https://phoenixitadvisors.com
@UnHackedPodcast