UnHacked - Cybersecurity Made Simple for Small Businesses

Mario Zaki (00:04)
You

Justin Shelley (00:06)
Mm-hmm.

Mario dancing a solo today. I d I didn't even join in. I get shy now that we've started calling ourselves out on our dance moves.

welcome every to episode 99 of

Mario Zaki (00:22)
Okay, go.

Justin Shelley (00:23)
Unhacked, broadcasting live from Egypt. Mario, tell everybody

Mario Zaki (00:25)
Yep, yep.

Justin Shelley (00:29)
what's going on. you are not home. What's up?

Mario Zaki (00:33)
No, I am on week three of my four week amazing vacation in seriously like the real beautiful, you know, Egypt. You know, I always said beautiful New Jersey, New Jersey can't hold a candle to this

Justin Shelley (00:48)
Yeah.

Mario Zaki (00:48)
country. We've been here for three weeks and I think we've probably seen one cloud the entire

Justin Shelley (00:55)
Whoa.

Mario Zaki (00:56)
three weeks. is, hot, but it's, it's amazing.

The weather is beautiful. The people are amazing. The food. I don't even want to tell you how much weight I've gained.

Justin Shelley (01:12)
Jealous, man. I'm jealous. One of these

Mario Zaki (01:13)
I'll

Justin Shelley (01:14)
days we're gonna have to bring everybody down there and do a full live,

Mario Zaki (01:18)
Yeah.

Justin Shelley (01:18)
live episode from Egypt. That would be that would be pretty cool. Didn't you buy a house down there or you're in the in the process?

Mario Zaki (01:22)
That'd be awesome. are,

we did, they're actually still building. We're probably about anywhere from 18 months to 24 months before getting delivery.

Justin Shelley (01:35)
That takes a long time to build a house down there.

Mario Zaki (01:37)
Well, they're building a whole compound. I

Justin Shelley (01:40)
Okay. Okay.

Mario Zaki (01:41)
think it's something like 360 units. So we're one of something like that. So they're building the whole compound, pools, lagoons, beachfronts, hotels on the compounds. It's huge. It's going to be like a little mini city. That's why it's not just a house that they're building. They're building a whole compound there.

Justin Shelley (02:07)
All right, well I don't wanna get too far ahead of myself, but once that opens up, I'm I'm gonna say let's let's build us a little mobile studio over there and

Mario Zaki (02:15)
Yep.

Justin Shelley (02:17)
we'll come crash your place and and r and record live. We'll have to broadcast

Mario Zaki (02:19)
Yeah.

Justin Shelley (02:22)
live. So we have to do it like what at midnight or something? I don't know.

Mario Zaki (02:25)
Well,

it's it's right now as we're recording it's 10 10 p.m. and you're what? What time is it by you? Yes

Justin Shelley (02:36)
On the West Coast, it's noon. On the East Coast,

it's 3 p.m. So yeah, you're you're

Mario Zaki (02:41)
Yeah, I'm seven hours ahead of East Coast.

Justin Shelley (02:43)
other side of the world. Crazy stuff. Well, I appreciate you being here for reals. I know you're on vacation. you can see, guys, look around the room. For those watching on on video, it's just the two of us. the guys who are not on vacation aren't here. Josh Bryan calling you out. Anyways, let's go ahead and dive in. Mario, episode 99. So we've just spent

you know, we spent 12 weeks talking about cybersecurity basics. Then we spent about 12 weeks, give or take, talking about AI and all the cool things we can do with AI. And as I was sitting here thinking, all right, what are we gonna do next? I did a little research and I learned something I did not know. And I'm a little bit embarrassed about this. Insurance is changing as well it should.

Mario Zaki (03:26)
See what you're-

Justin Shelley (03:27)
but that's what we're gonna talk about today

how do we apply, take the basics because the cybersecurity basics we talked about were not specific to AI. Then we just opened up the whole can of worms. Like here's everything you can do with AI, you know, as of these recording dates, because it changes every day. And now we're going to bring that back to really applying the basics. So Mario, I I tasked you with doing a little bit of research on

What insurance is up to these days. Tell me what you found.

Mario Zaki (03:54)
Yeah, I mean, so there's a couple different things that insurance companies are starting to exclude from policies. And a lot of it has to do with what we've been saying from day one. You're going to do this. You're going to vibe code. You got to do it in a secure manner. You got to be careful what you're putting in to the system because you don't know what it's going to do and be careful with what it's going to write.

so one of the things that, they're excluding, which I, to me actually like, you was very, big was, discrimination cases involving AI resume screening. So I know, you know, there's, a couple of different people that have designed stuff like they want to.

be able to upload the resumes and here's my criteria so that I am hiring, you I want somebody that's doing this, this and this and this. And you know, the AI, it may just read too deep into what you're entering and it could discriminate against certain candidates. And as a result, you know, you could end up having a lawsuit and then.

If you have certain types of insurances that cover you against that, like business liability insurance, they may not cover

Justin Shelley (05:19)
Yeah,

that's that's something that wasn't on my radar at all. you know, as as we've just talked about vibe coding, we have talked about security. We we keep bringing that back. but this is something that's also kind of new is they're excluding if if we do something, leave something open, right? And and data gets leaked, which is what always happens, somebody gets a hold of data they're not supposed to get a hold of,

Mario Zaki (05:44)
them.

Justin Shelley (05:45)
then that is causing exclusions in insurance payouts as well.

so it it's just time to like really go back and audit, review, however you wanna look at it, everything that we've talked about, everything that we do in in our business, where technology touches it or where data is is accessible.

Mario Zaki (06:03)
Yeah, and I mean, you know, we see some clients either doing it on their own, we're also trying to help them. you know, we're we're when we do it for clients, we're doing it in the most secure manner. But what another thing that companies or insurance companies are excluding is if you're you know, you have five coded your own system, you've put in your own data in there and you're operating out of it. But you haven't

Obviously, you know, you miss something, AI miss something, and all your data is missing, you know, not necessarily like a ransomware type of situation, but the end result is still the same, you can't operate your company. They're excluding that, they're like, well, you know, we're not covering your negligence, essentially.

Justin Shelley (06:53)
And and I'm gonna I'm gonna rat on myself a little bit here. I've I've debated whether I should publicly admit this. but when I go back when I first started vibe coding, and now admittedly nothing nothing was published, nothing was no no real data was at stake. But the first thing that I built, there I while I I I thought there was security in it, there was nothing.

There were there was just no security. This thing almost got released, almost leaked data, or or potentially could have, which is the same thing by the way. If it could have been accessed, you just have to assume it was. and and the the very first thing that I vibe coded would have exposed all kinds of stuff that I didn't want exposed. And you know, I'm I'm just saying that because I I was at a networking meeting a while back.

And I'm talking to people that are vibecoding that have no background whatsoever in technology. And it is amazing the things. We just spent 12 episodes talking about the really cool stuff you can do, the ROI that you can turn out using these tools. They're incredible tools. But we've got to get really serious about the security side of it. So I'm going to read some statistics. Everybody loves statistics. These are there was a an IBM just released a cost of data breach report or something like that. So

Global

average cost of a breach is up twelve percent. Doesn't sound like much. It's four point nine nine million. That number doesn't really mean anything to me because it's it's specific to the company size, right? And if you go to unhackmybusiness.com, you put in your company profile and we do all the math so that these numbers actually are relevant to your specific business. So I highly recommend going that route. but regardless, we're up 12%. The the breaches are costing more and more. malicious breaches that were AI enabled.

are is a 56% jump over last year. So going up like 56%. That that's huge.

Mario Zaki (08:54)
Wow

Justin Shelley (08:57)
Average cost of those AI enabled breaches, 6 million. So 1 million more than the non-AI attack, or in percentages, you're looking at about 20% increase. If the ones that are AI enabled. Security incidents involved

Mario Zaki (09:09)
Okay.

Justin Shelley (09:15)
unapproved AI tools.

Shadow AI, right? We've talked about this a lot. 43%, which is roughly double the previous year. Breached organizations with no AI governance policy in place. Want to take a guess at this? How many do you think? you got it. Seven out of ten. Had nothing

Mario Zaki (09:32)
75 %

Justin Shelley (09:36)
in place, no AI governance whatsoever. And spoiler alert: go to unhackmybusiness.com and

Go to this episode 99, and I'm gonna put together and and make available a free AI policy template. All right. So, like just start somewhere. I'm gonna have a checklist, I'm gonna have a policy template, just get started somewhere. where was I? Or organizations breached through AI systems that lacked basic access controls. Wanna guess the percentage on this?

Mario Zaki (10:07)
Hmm, I don't know. What is it? Wow

Justin Shelley (10:09)
92%.

Guys, these are the basics. This is the whole point. This is everything I've been talking about from episode one of this podcast. Is the basics aren't getting put into place. So AI is just accelerating it. This shouldn't be a surprise. It's kind of what we've been saying. It's new technology, but really we're we're just doing a different version of the same thing that we've always been doing.

Mario Zaki (10:35)
Yeah, and a lot of it can be self-inflicting.

Justin Shelley (10:40)
Well, tell me more.

Mario Zaki (10:42)
I mean, it's, you know, we in prior to AI, we've always, you know, tried to dot the I's cross the T's, make sure that you're, you know, putting the right firewall in place, right protection in place, you know, making sure, know, nobody's clicking on stuff. And trying to, you know, we've set it up maybe 10 million times on the show, we try to keep the bad guys out. You know,

But this time we're the ones pretty much, we could end up being the bad guys. We could end up doing something that destroys the data, that releases the data out

in the open. So in

Justin Shelley (11:22)
Right. Okay. Yep.

Mario Zaki (11:24)
a way we're almost our own bad guys because we're just not doing what we're supposed to. We're not following the basics like you just said.

Justin Shelley (11:32)
Yeah. Yeah. I mean I think what you're saying is we're well, like I said, we we can unintentionally expose our own data. And then a step farther, because we've mentioned a couple of times there was the incident where one of these AI agents deleted an entire production database with no backups. So yeah, is I think that's what you're saying, right? We become our own bad guys.

Mario Zaki (11:54)
Yeah

Justin Shelley (11:55)
We're like shooting ourselves in the foot without really thinking through any of this. So

Listen, I I am Mario, because you're on vacation, because we have two no shows to get today, we're gonna make this one really short because I just want to drive this one point home, right? One point is with all the things we just handed you guys the keys to the kingdom. We sh we showed you how to do it. We've got downloadables, we've got lessons, instructions, case studies of how to use AI. This is something that we all have to take super serious now. We have to turn around and go back through everything that we've built.

And I'm gonna put a check, I'm not gonna read it on the air because it's technical, it's boring. but I'm gonna have a list of things that you need to go back and if you've done any vibe coding, go back and chest check these things. if you have built custom projects or custom chat GP GPTs, whatever they're called, where you're in doing integrations, like go back and check all of this stuff. And then the number one thing, this is this is if you do nothing else, audience, this week, call your insurance company.

Make sure A that you have a good cyber policy in place and then make sure that they are covering AI. And I've got let's see, I had I had a note if I can find it, of the questions that you should be asking them. mm mm mm mm mm.

Maybe I'll go out and delete the pause later. Here we go. does my current policy contain an artificial intelligence or generative AI exclusion? If so, read it to me. Okay, that's the first question. Then ask if an employee uses an AI tool I never approved and it causes a data loss, is that covered? Question number three At renewal, what are you going to ask me about our AI use? And what answers do I need to have ready?

Right? I'm putting all this together on a downloadable. Go to unhackmybusiness.com, download this stuff, call your insurance agent. If you do nothing else, call your insurance agent and find out what what you need to do to make sure that you're you're still covered. Mario, that's like in 14 minutes and 50 whatever seconds. That's what I wanted to talk about today. Do you have anything that you want to add that we need to go over before we close out?

Mario Zaki (14:09)
Yeah, I want to add is the fundamentals that we've been talking about for the last few years is still in play. know, especially number one on the list backups, you know, you want to still have at least one point, you know, one, you know, source of backup, if not more, you know, on site and remote in the cloud, you know, closed gap, because it

You know what I always tell like some prospects is what would happen if this data if your actual data your ERP or you know your bookkeeping system it's the disappearing you can never touch it again. What's plan B. OK. This is the same thing. You know if you're going to vibe code and you're putting your operating your company with this new system that you put in place that may have saved you. You know I don't know what we've said 10 X 50 X you know stuff.

What happens if that system goes down, disappears, gets blown up or just is not functioning anymore? You know, how could you restore? have to have a plan B. have to have, you yes, it may, you may be down for a day. You may be down for more than, you know, a day, but it cannot close down your company. You need to make sure that you are able to easily recover because you have that.

data and it's not the old system that you're using that's obsolete. Your existing stuff, back it up. If you are vibe coding, put in stuff in place like, I want you to do a daily backup, I want you to do daily export, stuff like that.

Justin Shelley (15:49)
No, you you bring up a good point as far as data backups go. It's it's so common, at least it was. I think we're getting a little bit better about this in the industry, of making sure that we're backing up the proper data. Like you have to go through and I I know the word audit can s be it's almost like a vulgarity, but you really need to go audit everything you do in your business. Not just where you think your data lives, but what do you do? How do you

Bring in new clients or customers or patients, whatever industry you're in. How do you market? How do you intake them? How do you onboard them? How do you deliver your services? How what does your HR process look like? What is every admin role, every everything that is done in your business, every system, every operation? How is it done and where does that data live? And you've got to have a backup plan for that. And now we've just added a new one. If you're vibe coding or, you know, using even an

AI integrations, even if you're not building code, if you're using AI integrations, you know, and and something gets messed up with that, you just you've got to have this stuff documented and and properly backed up. So I I think I have it. I'm gonna go double check it within

Mario Zaki (16:56)
this thing flipped off the way that it's hurting.

Justin Shelley (17:00)
the unhackmybusiness.com portal. The section on data backup has a guide for that of how you need to go through and audit all of your systems and figure out where the data lives and and build a plan to to back it up. A test restore.

for the love of God, test restore.

Mario Zaki (17:16)
Yeah, and you can also use AI and actually have it check its own work and say, where's my vulnerabilities? What can we do to encrypt this data? What can we do to lock this down more? You can even use a agent or a different AI and have it audit somebody else, audit the original work and say, where's my vulnerability?

There's some gray areas now with like a Fable 5 saying like it's not checking security. you know, it's going to block you out and stuff like that. You have to kind of just play with it, but you should be able to get another agent to, you know, maybe like a more expensive agent to actually check the work and find out where or what you can improve on to, or what you can do to improve on the security that's in place now.

Justin Shelley (18:13)
Yeah. Yep. Use AI to use AI. We've said that a few times, right? That's kind of what you're saying there. So yeah, right.

Mario Zaki (18:20)
Yeah, you're just the middleman

Justin Shelley (18:25)
So the Mario, that's that's it. That's what I've got for this week. We're keeping it short intentionally. I want you to get back to your vacation because you're having way too much fun to be doing this nonsense. we'll we'll we'll come back with more of a in depth discussion once we've got our other two co hosts as well. So for today, listening audience.

Call your insurance company. First go to the website, unhackmybusiness dot com, download the the PDFs, the checklist, the guides from episode ninety nine, and then pick up that phone and call your insurance agent and make sure that you're covered. That's it, Mario. That's all I got. Okay.

Mario Zaki (18:58)
wait, one last step, one last step.

They have to tune in for episode 100.

Justin Shelley (19:03)
That's right. Episode 100's coming up next week. it's gonna be a good one, but it's gonna be a surprise because I'm not gonna tell anybody what we're doing yet.

Mario Zaki (19:13)
I can't wait.

Justin Shelley (19:15)
All right, Mario. that's it, huh? Any any final thoughts? If not, we're gonna get some outro music. I'll try to dance a little bit this time, and then we're

Mario Zaki (19:23)
you

Justin Shelley (19:23)
gonna let you get back to vacation. We'll come back strong for episode 100. So all right, man.

Mario Zaki (19:27)
You got it. I appreciate it, Justin.

Justin Shelley (19:29)
Enjoy, and we'll see you next week.

Mario Zaki (19:32)
Thanks, bye guys.

Justin Shelley (19:41)
I should not have made that commitment to dance.

Mario Zaki (19:44)
you