UnHacked - Cybersecurity Made Simple for Small Businesses

Hosts:
Justin Shelley - https://www.phoenixitadvisors.com/
Mario Zaki - https://www.mazteck.com/
Bryan Lachapelle - https://www.b4networks.ca/
Joshua Holloway - https://7thdi.com/

Microsoft is paying 60,000 employees to leave. A hospital attack rerouted ambulances. And your SaaS bill might be next.

This week Justin, Bryan, Mario, and Josh run through five stories from what might be the fastest-moving week in security and AI so far. First, the attack on a University of New Mexico health center: ransom messages talked through victims' speakers, ambulances got rerouted, and the whole operation went offline. Some systems were back the same day, most emergency services the next. The hosts' takeaway: that speed only happens when you already have a serious incident response plan. And the prevention advice published afterward was the same stuff your IT person has been saying for years, 2FA and unique passwords everywhere.

Then Microsoft's offer to buy out up to 60,000 employees, roughly a quarter of its workforce, to shift money toward AI. Is it a genuine pivot, a way to soften a future layoff headline, or a company raising cash to buy its way back into relevance? The guys also get into what it's actually like to partner with Microsoft today, from $500 per-incident support calls to agreements that leave MSPs on the hook for clients' Office 365 bills.

The biggest segment is SaaS be gone: why pay $500 a month for a tool you could rebuild yourself with AI? Bryan explains when it makes sense to replace a subscription with an internal app, Mario tells the story of a friend who built a working product during a single football game, and Josh lays out the catch. AI grading its own code is a student grading its own homework, maintenance never ends, litigation over reverse engineering is coming, and insurance companies may start asking whether you write your own code with AI. Plus the story of a Chinese AI model caught reaching out to a server in China after being told not to, and what Josh did when his entire AI conversation suddenly flipped to Chinese characters.

What you'll learn:

Why a hospital that rerouted ambulances had emergency services back online in about a day, and what that says about incident response planning

• The unglamorous basics that still stop most attacks, even when the headline is a massive breach
• How to weigh replacing a SaaS subscription with an AI-built internal tool, including who reviews the code, where it's hosted, and who maintains it forever
• What Microsoft's 60,000 buyout offers signal about AI, layoffs, and the software vendors your business depends on
• Why free and foreign AI models deserve extra scrutiny before you feed them company data

New episodes every week with straight talk on cybersecurity, AI, and what it all means for your business. Subscribe so you don't miss the next one.

If this episode made you wonder what's quietly exposed in your own business, Phoenix IT Advisors helps small and mid-sized businesses with cybersecurity, IT support, and technology strategy. Visit PhoenixITAdvisors.com and schedule a consult.

Full episode:
https://unhackmybusiness.com/episode/110
Free member resources (including a free device offer for new members, and free accounts are going away soon): unhackmybusiness.com
Phoenix IT Advisors: PhoenixITAdvisors.com
Follow the show: @UnHackedPodcast

🚨 BREAKING: Nearly $2.8 BILLION in cryptocurrency has moved out of Binance-linked wallets, raising fears of a massive cyberattack.
Is this one of the biggest cryptocurrency hacks in history, or is there another explanation?
In this breaking UnHacked mini-episode, we examine what we know, what remains unconfirmed, and what this developing story means for cybersecurity.

Hosts:
Justin Shelley - https://www.phoenixitadvisors.com/
Mario Zaki - https://www.mazteck.com/
Bryan Lachapelle - https://www.b4networks.ca/
Joshua Holloway - https://7thdi.com/
Barinder Hans - https://www.redrhinonetworks.com/

Seventy percent of websites run on WordPress, and a massive PHP vulnerability just exposed huge swaths of the internet. Attackers armed with agentic AI are exploiting it in hours, not days.

Recorded live from a vendor conference in Franklin, Tennessee (the first episode ever recorded with beers in hand and one shared microphone), Justin Shelley, Bryan Lachapelle, Mario Zaki, and Josh Holloway break down the wildest stretch of security news in years. The PHP compromise reaches far beyond websites: one technician patched fifteen phone servers overnight, vulnerability scanners flagged switches, and Steam reportedly went dark temporarily over the same issue. Microsoft is now seeing Chinese agents using agentic AI to attack companies at scale, which means the old patching timeline is gone for good.

Then the conversation turns to where AI itself is headed. Justin holds to his prediction that the underlying development of large language models will plateau, and the group stress-tests it: hardware limits, models feeding on AI-generated content, and the wildcard of recursive self-improvement. Meanwhile, a prediction from the conference floor says SaaS itself is dying, because businesses can now build exactly what they need with AI. Linux hardware compatibility jumped from 90 percent to basically 100 percent because AI can write missing drivers in minutes. But deconstructed software means the LimeWire era is back, and reportedly ten percent of AI skill sets are already infested with malware.

The big takeaway for business owners: IT is shifting from "protect, protect, protect" to actually making you money. Plus the cyber insurance trap nobody reads until it's too late, and how the City of Hamilton got millions in claims denied over partial MFA.

What you'll learn:

• Why the PHP vulnerability hits far more than websites: phone servers, POS systems, and network switches, and why the patching window collapsed from days to hours
• The three forces that could plateau AI models: hardware limits, running out of human content to ingest, and the recursive self-improvement wildcard
• Why businesses may soon skip bloated SaaS platforms with ten thousand settings and build custom tools with AI instead, and what that does to software pricing
• How the deconstructed-software era mirrors LimeWire and Napster, and why trusted, certified code becomes the new selling point
• The cyber insurance trap that cost the City of Hamilton millions, and why checking the MFA box in one place but not another means a denied claim

New episodes every week on the hacks, the hype, and the hands-on fixes that matter to business owners. Subscribe so the next surprise vulnerability doesn't surprise you.

Phoenix IT Advisors helps small and mid-sized businesses turn technology from a cost center into a profit driver. If you want security that actually holds and an AI plan that fits your business, visit PhoenixITAdvisors.com and schedule a consult.

🎧 Full episode:
https://unhackmybusiness.com/episode/109

🌐 Phoenix IT Advisors:
https://PhoenixITAdvisors.com

📱 Follow @UnHackedPodcast

Hosts:
Justin Shelley - https://www.phoenixitadvisors.com/
Mario Zaki - https://www.mazteck.com/
Joshua Holloway - https://7thdi.com/

A viral AI "skill" promising Apple's design secrets came loaded with keyloggers, prompt capture, and an API rug pull. Josh found it before it found him. Most people won't.

In this episode of UnHacked, Justin Shelley, Mario Zaki, and Joshua Holloway go free-form on the week in AI, and the week was wild. A new open-source tool can reverse engineer nearly any software product, and Adobe's entire suite was replicated within days. Lawsuits are coming, but nobody knows the legal ground rules yet. Meanwhile, Josh walks through a real-world discovery: a popular AI skill shared to hundreds of thousands of followers contained embedded keyloggers, captured every prompt, and was built to pull API keys and ship them off. His team now runs every skill through NVIDIA's Skill Spectre sandbox before it touches a production system, and he explains how you can too.

The guys also dig into the bigger picture: whether MSPs and IT pros will actually lose jobs to AI (Justin's answer is no, and he puts it on record), why the mass migration to vibe-coded custom software is about to make security and integration work explode, and the Blockbuster-style vendors who are about to wither on the vine because they refused to adapt. Plus Justin's closing prediction: AI development itself is about to plateau, faster than anyone expects.

What you'll learn:

• How malicious AI skills hide keyloggers, prompt capture, and API key theft inside plain-text instructions, and how to sandbox-test them before installing
• Why the new reverse-engineering tools threaten software giants like Adobe and Microsoft, and what the coming legal battles over IP could mean for your business
• Why Justin believes AI won't eliminate MSP and IT jobs, and the parallel he draws to the cloud migration panic
• How vibe-coded custom apps with zero security (like the wide-open database Justin found) are becoming the next attack surface
• Why human relationships and customer service are the real differentiators as AI commoditizes the work itself

New episodes every week breaking down the cybersecurity and AI threats facing your business, in plain English. Subscribe so you don't miss the next one.

If this episode raised questions about your own business's security posture, Phoenix IT Advisors helps small and mid-sized businesses get unhacked before it's too late. Visit PhoenixITAdvisors.com to schedule a consult.

Watch the full episode:
https://unhackmybusiness.com/episode/108
PhoenixITAdvisors.com
@UnHackedPodcast

Hosts:
Justin Shelley - https://www.phoenixitadvisors.com/
Mario Zaki - https://www.mazteck.com/
Bryan Lachapelle - https://www.b4networks.ca/
Joshua Holloway - https://7thdi.com/

Should you host your own AI so sensitive client data never leaves your building? Five security pros weigh cost, risk, and trust.

Justin Shelley admits up front that he is coming in with more questions than answers. He is fed up with vendors and wants to bring AI in-house. So he asks a panel of IT and security people whether open weight AI models are the way out. Nobody agrees, and the disagreements are where the useful parts are.

The group starts with the plain-English difference between open weight and open source models. Then they get practical. Mario Zaki describes the in-house server his team trained on its own PSA data, and why he turned down a roughly $35,000 seven-GPU build. Joshua Holloway explains why a Chinese-trained model is a compliance problem for anyone handling CUI. He also tells the story of a model that switched from English to Mandarin mid-conversation. Craig Taylor lays out why regulated data (healthcare, financial, student, defense contract) is the strongest case for private hosting. He also explains why he doesn't trust "we don't train on your data" promises from public AI vendors.

It ends on two things you can act on this week. Craig describes a law firm breach that exposed 25 years of client data, and what it would have taken to avoid it. Justin tells how something he typed into a vendor's AI chat showed up, redacted, in that vendor's social media marketing.

ABOUT THE GUEST
Craig Taylor is CEO and co-founder of CyberHoot, a security awareness training company. He has a psychology degree and built CyberHoot around rewarding good cyber behavior instead of punishing mistakes. He also runs AI Policy Scan, a tool he built to score the privacy policies of AI vendors, and he works with virtual CISO clients.

WHAT YOU'LL LEARN

• The difference between open weight and open source AI models, in plain English, and why neither is a magic privacy fix.
• What it really costs to bring AI in-house: a Tesla GPU at roughly $700, a $35,000 seven-GPU quote, about $6,000 in RAM for a small server build, and a six-month wait on one server order.
• Why Chinese-trained models are a compliance risk for CUI and CMMC, and where the group disagreed about whether hosting one locally makes it safe.
• Why Craig says public vs. private vs. hybrid AI hosting is the same debate as web hosting in the 2000s, and how a tabletop exercise firm moved to a private setup.
• The data-hygiene move that could have limited a 25-year client data breach: archive old records off your network.
• How to check what an AI notetaker or assistant does with your conversations before it joins your next meeting. Craig scored one vendor's privacy policy 3.8 out of 10.

SUBSCRIBE
New episodes every week that explain AI, cybersecurity, and digital risk in plain language for business owners. Subscribe so you don't miss the next one.

NEED HELP WITH THIS IN YOUR OWN BUSINESS?
If this episode left you wondering what your team is already pasting into public AI tools, you're not alone. Phoenix IT Advisors helps small and mid-sized businesses with IT support, cybersecurity, and technology strategy. Visit PhoenixITAdvisors.com and schedule a consult.

LINKS
Full episode: https://unhackmybusiness.com/episode/107
Phoenix IT Advisors: https://PhoenixITAdvisors.com
Craig Taylor's AI Policy Scan: app.aipolicyscan.com 

Hosts:
Justin Shelley - https://www.phoenixitadvisors.com/
Mario Zaki - https://www.mazteck.com/
Bryan Lachapelle - https://www.b4networks.ca/

Is AI taking jobs? Three IT owners say they're seeing slower hiring, not layoffs, and early-career workers feel it most.

Justin Shelley, Bryan Lachapelle, and Mario Zaki have been getting heated feedback on their AI clips, mostly distrust and fear. In this episode they start with whether hardware-level AI containment is realistic (Bryan's concern: hardware can't be changed once it's built, and a flaw makes it obsolete), then get into what they're actually seeing in their own businesses. Mario hasn't let anyone go, but he's hiring fewer technicians than the one or two he used to add each year. Bryan knows law firms that aren't hiring another law clerk. Data centers are pulling construction workers away from housing, and employers still can't fill the openings.

Bryan also warns about what happens in four to ten years if nobody is hiring and training junior people today. The hosts also cover why surrounding yourself with people who use AI matters, and why an IT provider telling clients not to use it is a red flag.

The second half is about building instead of renting. Justin built, in about a month, software that does ten times more than the tool he fought with for three years, and moved his business from five platforms to one. Mario is building his own ticketing system, and he explains why saving a couple thousand dollars a month is as good as landing a new customer. Bryan shares the one setting his vendor software won't let him change. They also cover what to lock down first if you vibe code anything, and what they won't touch yet.

WHAT YOU'LL LEARN

• Why hardware-level AI containment hits a catch-22 (built in and it goes obsolete, flashable and it can be bypassed), and why Mario doesn't expect wide deployment in the next two to three years
• What AI is doing to hiring right now: no mass layoffs, but fewer new hires, and a possible skilled-labor gap down the road
• Why cutting a software expense can be worth as much as winning a new customer, since the savings go straight to the bottom line
• What one owner gained by replacing five platforms with one he built himself, including drag-and-drop ticket dispatching and changing the "from" name on outbound email
• Why security has to be the first thing you set up before you vibe code, and which tools (antivirus, remote management) the hosts aren't replacing

"Quit outsourcing your destiny." - Justin Shelley

Hosts:
Justin Shelley - https://www.phoenixitadvisors.com/
Mario Zaki - https://www.mazteck.com/

Justin knows nothing about football. He's using AI to run his fantasy team anyway, and he's currently winning. That's just where this episode starts.

After two weeks of warning listeners about AI risk, Justin Shelley and Mario Zaki flip the script this week to talk about how AI is actually making their lives better right now, no tinfoil hats required. Justin walks through how he joined a fantasy football league with zero knowledge of the game, screenshots his lineup into AI every week for instructions, and is sitting in second place for points with the best playoff odds in his league heading into week three.

Mario shares how he used AI to build a complete website and backend booking system for his family's shore house rental in under a week, including e-signature contracts, automated text messaging, and tenant management tools that used to require hiring a developer. The two also dig into how AI is changing IT troubleshooting, cutting down the need to memorize thousand-page technical manuals and speeding up how fast MSPs can actually solve problems for clients.

From there, the conversation moves into where AI is headed next: full self-driving cars people already trust with daily commutes, at-home robots for chores nobody wants to do, and AI-assisted diagnostics that could catch cancer and other diseases before symptoms ever show up. Justin closes with his honest take on the "AI is coming for our jobs" fear, and why he believes automation elevates workers into better work instead of leaving them behind.

What you'll learn:

• How to use AI to manage a fantasy football team with zero knowledge of the sport
• Why AI is speeding up IT troubleshooting and reducing the need for deep technical expertise on every issue
• How Mario built a full rental property website and booking system with AI in about a week
• What's realistic right now (and what isn't yet) with full self-driving cars like Tesla and hands-free highway systems
• Why AI-assisted diagnostics could change how early cancer and other diseases get caught

New episodes of UnHacked drop every week covering the cybersecurity and technology stories that actually affect small business owners. Subscribe so you don't miss the next one.

Need help figuring out where AI actually fits in your business, versus where it's just hype? Phoenix IT Advisors helps small and mid-sized businesses cut through the noise on cybersecurity and technology strategy. Visit PhoenixITAdvisors.com to schedule a consult.

Links:
Full episode: https://unhackmybusiness.com/episode/105
Phoenix IT Advisors: https://phoenixitadvisors.com
UnHacked Podcast: @UnHackedPodcast

Hosts:
Justin Shelley - https://www.phoenixitadvisors.com/
Mario Zaki - https://www.mazteck.com/
Joshua Holloway - https://7thdi.com/

One AI tool's price jumped from a fair quote to 10x more overnight. Is AI fear-mongering designed to keep you locked in?

Every week there's a new AI headline promising the end of the world. Models "escaping" sandboxes, CEOs quitting to warn everyone AI is too dangerous, calls to slow down before it's too late. Justin Shelley, Mario Zaki, and Josh Holloway put their tinfoil hats on for episode 104 and ask the question nobody in the AI industry wants to answer: who actually benefits from all of this fear?

The conversation gets real fast. Justin shares a tool he's been using where the base price stayed reasonable, but the AI component quietly went from a quoted price to 1,000% more once it left beta. Josh breaks down how AI-driven demand has tripled server prices in under a year and stretched lead times from days to months, and shares a story about a client who was sold an 8-year-old server as brand new. Mario explains why bringing AI models in-house still doesn't pencil out financially for most small businesses, even though the appetite to escape subscription pricing is growing fast.

The theory they land on: the same companies telling you AI is too powerful to control might also be the ones most threatened by you running it yourself. If self-hosted, open-source AI models let businesses skip the subscription treadmill, then scaring the public into demanding regulation is a convenient way to make sure that option quietly disappears. Whether you buy the conspiracy or not, this episode will change how you read the next AI doom headline.

What you'll learn:

• Why the "we need to slow down AI development" argument falls apart the moment you follow the money
• How one AI vendor's price jumped from a reasonable quote to 1,000% more once it left beta
• The real story of a client sold an 8-year-old server as "brand new," and how to make sure your IT provider never does that to you
• Why AI-capable server prices have tripled in under a year, with lead times stretching from days to months
• The theory that scary AI headlines are less about safety and more about keeping businesses locked into subscriptions instead of running AI in-house

New episodes drop every week with real, unfiltered conversations about the technology and security decisions actually affecting small business owners. Subscribe so you don't miss the next one.

Worried about where your data lives, who controls it, and what happens if a vendor you rely on gets breached or jacks up their prices? That's exactly the kind of risk Phoenix IT Advisors helps small businesses get in front of. Visit PhoenixITAdvisors.com to schedule a consult and find out where your business actually stands.

Links:
Full episode: https://unhackmybusiness.com/episode/104
Phoenix IT Advisors: https://phoenixitadvisors.com
More UnHacked: @UnHackedPodcast

A researcher just quit Anthropic warning AI could end humanity within four years. Microsoft shipped a record 974 security patches that same month.

On this episode of UnHacked, Justin Shelley, Bryan Lachapelle, Mario Zaki, and Joshua Holloway dig into the headlines everyone's arguing about right now: a former AI researcher's public warning that AI has more than a 10 percent chance of killing all humans by the end of the decade, and Sam Altman's own estimate putting that number closer to 25 percent. They break down what it would actually take for AI to end humanity (infrastructure attacks, water treatment systems, job displacement) and why the scarier headline might be the one nobody's talking about: Microsoft just blew past its previous patch record by nearly double, and no business on earth can manually test and deploy 974 patches from one vendor alone.

The conversation also goes inside Josh's actual AI coding workflow, a "council of five" system where multiple AI agents review each other's work, including a dedicated security audit council, before anything ships. Mario makes the case that AI replacing hard-to-fill jobs isn't the villain story everyone assumes, especially after years of ghosted interviews and no-show hires since COVID. And Justin makes the argument that this whole panic cycle looks a lot like Y2K, the nuclear arms race, and 1980s acid rain scares: real fears, mostly survived.

What you'll learn:

• Why Microsoft's record 974 patches (almost double its previous record) make manual patch testing impossible, and where AI-driven patching is headed next
• How Josh's multi-agent "council of five" AI coding process works, including a separate security council that audits everything before deployment
• The real numbers behind the AI doom headlines (10 to 25 percent estimated risk) and what it would actually take for AI to cause that kind of damage
• Why hiring struggles since COVID have Mario openly in favor of AI taking over jobs nobody's showing up for anymore
• Why the hosts believe this fear cycle mirrors Y2K, the nuclear arms race, and the acid rain panic, and what that history means for business owners right now

Every week the UnHacked crew breaks down what's actually happening in AI, cybersecurity, and business technology, without the headline panic. Subscribe so you don't miss the next one.

Keeping up with hundreds of security patches a month isn't something most businesses can do alone, and guessing your way through it is how breaches happen. Phoenix IT Advisors helps small and mid-sized businesses build a real patching and cybersecurity strategy instead of hitting "apply" and hoping. Visit PhoenixITAdvisors.com to schedule a consult.

Links:

• Episode: https://unhackmybusiness.com/episode/103
• Phoenix IT Advisors: https://phoenixitadvisors.com
• More UnHacked: @UnHackedPodcast

Hosts:
Justin Shelley - https://www.phoenixitadvisors.com/
Mario Zaki - https://www.mazteck.com/
Joshua Holloway - https://7thdi.com/

AI didn't go rogue and hack a company on its own. Someone pointed a jailbroken AI at an unpatched server, and it finished a full ransomware attack in about 30 minutes.

Security researchers at Sysdig just documented the first fully autonomous, AI-driven ransomware attack, nicknamed "Jade Puffer." No human touched a keyboard once it started. It broke in, mapped the network, rewrote its own code to dodge detection, and deployed ransomware, start to finish, faster than most security teams could even get an alert out. Experts are now saying the response window for an attack like this has shrunk from hours to as little as 15 minutes.

Justin Shelley, Mario Zaki, and Joshua Holloway break down what actually happened, and why the scary headline ("AI attacks company, no humans involved") is only half the story. The real vulnerability wasn't AI. It was a production MySQL server exposed to the internet, running unpatched software with a known critical flaw, and a default signing key that hadn't been changed since 2020. The AI didn't discover some brand-new weakness. It exploited the same lazy, preventable gaps that have caused breaches for a decade, just a lot faster.

Josh also shares a live horror story about an MSP that disabled a client's VPN and locked them out of their own data over a single unpaid invoice, in the middle of an unrelated legal dispute, then demanded tens of thousands of dollars before restoring access. It's a hard look at what happens when a business has no idea what their IT provider is actually doing for them, and no leverage when things go sideways.

What you'll learn:

• How the first fully autonomous AI ransomware attack worked, from breach to payload in under 30 minutes
• Why the vulnerability that let it happen was public knowledge for over a year, and completely preventable with basic patching
• Why publishing CVEs (known vulnerabilities) helps defenders more than it helps attackers
• Why the AI-generated ransomware couldn't have paid off even if the victim tried, because the encryption key was never stored anywhere
• Red flags that your MSP isn't doing what you're paying them for, and what to do if one tries to hold your data hostage

New episodes of UnHacked drop every week with real talk on cybersecurity, AI, and the tech risks actually hitting small business owners. Subscribe so the next one doesn't catch you off guard.

Not sure if your IT company is actually protecting you or just collecting a check? Phoenix IT Advisors helps small and mid-sized businesses find out, patch what's exposed, and build security that doesn't rely on luck. Visit PhoenixITAdvisors.com to schedule a consult.

Links:
Full episode: https://unhackmybusiness.com/episode/102
Phoenix IT Advisors: https://phoenixitadvisors.com
More UnHacked: @UnHackedPodcast