CEO To Rainmaker
CEO To Rainmaker
Episode # 85 IT, Cybersecurity and AI, What You Absolutely Need To Now !!
The digital landscape has transformed dramatically, and with it the threats facing your business. In this eye-opening conversation with IT security veteran Ryan Kincer, we uncover the harsh reality that small businesses aren't just vulnerable to cyber attacks—they're the primary targets.
Ryan pulls back the curtain on the modern cybercriminal: no longer limited to physical break-ins, today's digital thieves operate remotely in their sweatpants, purchasing criminal software from the dark web to cast wide nets for vulnerable businesses. The statistics are sobering—over 60% of cyber attacks target small businesses, and of those attacked, more than 60% close their doors within a year.
We explore practical, budget-conscious security measures every business should implement, from multi-factor authentication to regular software updates and comprehensive staff training. Ryan shares a particularly chilling story about a local business crippled by ransomware for weeks, losing hundreds of thousands of dollars despite having cybersecurity insurance.
The conversation takes an intriguing turn when we discuss artificial intelligence—both as a productivity booster for legitimate businesses and as a powerful new weapon for cybercriminals. Ryan offers crucial guidance on using AI safely in your business while protecting intellectual property through proper "siloing" of information.
Perhaps most valuable is our dissection of emerging threats like "fake receipt" scams that bypass traditional security red flags by containing no suspicious links or attachments—instead manipulating victims into calling fake customer service numbers where their financial information is harvested.
Whether you're a tech novice or savvy business leader, this episode delivers essential knowledge to protect your company's future. Listen now to arm yourself against the invisible threats that could determine whether your business thrives or becomes another cybercrime statistic.
Good morning, loyal listeners, viewers and first-timers. As always, my goal is to provide cutting-edge information to make you guys and gals better executives out there, so that your business will prosper. So that your business will prosper. Today's show episode 85, will focus on IT cybersecurity and AI. My expert guest is Ryan Kintzer, owner of Keenits, a full-service IT company, and Ryan has been in the saddle for 30 years, but you could never tell because he still looks very young. But he knows his stuff and he's going to share some pearls of wisdom with you.
Speaker 1:I had Ryan as a guest three years ago and it received really high ratings. But a lot has changed in the IT cybersecurity world in the last three years, especially with the emergence of AI, and so I thought I would bring Ryan back to kind of give us an overview of what happened three years ago and what happens now. What do you need to do to protect yourself? So, with your permission, I'd like to bring out Ryan. There he is, ryan. How are you? I am great, gene Good, to bring out Ryan. There he is, ryan. How are you?
Speaker 2:I am great, gene, good to be with you. Thanks for that introduction.
Speaker 1:Yeah, ryan, I wonder if you could just do me a favor for people that maybe have been living in a cave for the last five years. What is your definition of IT, cybersecurity and AI?
Speaker 2:So IT? It's interesting when I talk to a lot of people in business, you say the word IT. Some of them don't know what it is, which means they probably need it more than they think that's why I asked that question.
Speaker 1:Yeah, sure.
Speaker 2:IT stands for information technology. It's basically the part of a business. Every business has it nowadays because there's some element of technology that's driving that business forward. Some businesses have heavy adoption of technology, some are light and that can depend on the type that they are in business. You know, the technology needs of a much smaller business have a small footprint, whereas as they start to grow and the business develops and matures, that technology becomes more and more complex. Cybersecurity is the fabric that weaves through everything technology, because every time you adopt technology there are always flaws and vulnerabilities that are built into it. Not by design, but there are bad actors out there looking for ways to infiltrate that.
Speaker 1:And that is now.
Speaker 2:Technology is now the well. Cybercrime is now the method by which criminals go and steal money and information, and information just comes back to money. So now they don't need to go down to you know it's not a smash and grab at a physical store anymore. They can sit in their sweatpants, subscribe to criminal software, they can get off the dark web and carry out campaigns against businesses anywhere in the world that they want, and it's kind of like fishing for them, you know. They're just out looking for their next target.
Speaker 2:And when it comes to cybersecurity, small businesses especially don't see the importance of cybersecurity because they think that they're not a target that the big companies with the big pockets of the target Quite. The opposite is true. The small business is the easy target. Even though the money isn't the same amount, it's easier to get into these small pockets than it is to get into those big pockets. And more than 60% of cyber attacks are always against small businesses, and more than 60% of small businesses that do suffer a cyber attack are out of business within a year after that cyber oh my god, this is scary.
Speaker 1:Maybe I should cancel this show.
Speaker 2:No, don't cancel it.
Speaker 1:This is, and this is the aspect of it that I hate, because I don't like fear-mongering but these are just the statistics that we're dealing with I get to see the dark side of it, and it's not pleasant well, that's, that's why I brought you on as a guest so small business owners can know you are the most vulnerable.
Speaker 2:Yeah, and you're an easy target for them, especially because small businesses don't have those large budgets to put security in place. Now there's a lot of basics that small businesses can do, and a lot of businesses have heard of familiar technologies like multi-factor authentication. That's the big one where it's basically everything you log into nowadays, especially like banks are one of the first adopters of this and pushing it on people and anyone who logs into an email account on Microsoft or Google, they're asked to provide a second form of verification which, after you put your password in to log into your account, it then asks to send a code to your physical mobile device to verify hey, this is you.
Speaker 1:Yeah, we have all been through that.
Speaker 2:You have and people get annoyed by it. But for a business, that is annoyance that you need to get used to. Make sure that you have all of your systems protected by this multi-factor authentication. Don't opt for convenience. Opt for the inconvenience that MFA requires and adopt that security strategy. That's one big one making sure all your computers are always up to date.
Speaker 2:It's very easy to get lost on, you know. People don't always want to put updates on their computer because they hold onto a computer for too long or they don't want to waste their time going through an update or they're scared to do it. That's how criminals get in is through software vulnerability. So always keep your software up to date. Train your staff on what the latest security threats are. It's very easily done. You can find videos on YouTube that do security awareness training what to watch out for on bogus emails that try to take over your account or get into your computer. Put security software on your computers and the biggest one is doing data backups. Make sure that you're backing up your data multiple times and that you're checking it frequently.
Speaker 1:Okay, so how would you define AI and what is that role in your world?
Speaker 2:So artificial intelligence is kind of it's the latest buzzword. Obviously, that is, it's top of everybody's mind. You can't go anywhere on the Internet right now or hear news where people are not talking about the advent of AI it's. It is so prevalent. Yes, yes, artificial intelligence is Really becoming a lot of. It is shiny object stuff. I call call because it's a lot of fun, like, oh, look at these cool images it creates. I mean, someone sent me something yesterday. I'd never seen before where it goes and reads a website and creates like a whole podcast. It sounds like a male and a female talking back and forth to each other talking about what's on that website, and they're making it sound like they're talking about your company. It does all of this cool stuff that is fun to explore, but when you talk about it in the context of business, there's some important things to be aware of.
Speaker 1:Which are.
Speaker 2:The main one is privacy concerns. So for small businesses it's not as much of a worry. But as your business grows, people in your organization that are feeding what can be considered intellectual property into these AI engines. You need to make sure that your company has a strategy in place where staff are using AI through tools that you're providing through them. These are usually paid services that you get through chat GPT or Microsoft Copilot or Google Workspace. They have their own version of AI called Gemini, but those paid services. They have protections in place to keep your intellectual property private what we would call siloed, so it's not just available for anyone to get into, and they keep that private, so not anybody can just get into it.
Speaker 2:The benefit it creates, too, is that it creates context for your organization. So I have a couple of guys on my team that are really into AI and they're pushing us to use AI. They're pushing me to use it because I'm kind of skeptical about portions of it, but they're showing me the benefits of it. But they're creating this context inside of. We're using chat GPT, where chat GPT in our instance of AI in our silo it becomes aware of how Keen IT likes to speak, how we like to sound where our data sources are, how our processes look, and so the output we get back from AI is actually contextually relevant to what we're doing in our business.
Speaker 1:Okay, so let me shift gears on you. I have a photographic memory, Ryan. I remember something that you said three years ago that benefits to a CEO who is reasonably knowledgeable about IT and cybersecurity is productivity, sustainability and scalability. Can you expand on those three issues a little bit?
Speaker 2:Productivity. And what was the second one? Scalability and sustainability. Can you expand on those three?
Speaker 1:issues a little bit Productivity and what was the second one?
Speaker 2:Scalability and sustainability Are you talking about in context of AI specifically?
Speaker 1:or just IT. I'm talking about IT specifically.
Speaker 2:So, yeah, so, of course, anybody who's a business owner or at the C-level of an organization is interested in those three. So, when it comes to productivity, ai in particular is going to be. That's where you're going to see your biggest boost in adoption of AI. Sure, sure, it takes down tasks that we would normally do and cuts that time down significantly that we would normally do and cuts that time down significantly. I personally think that a lot of things that AI spits out still need a little bit of polish, but all of the grunt work to produce it has been cut out. So you're going to see your biggest gains in productivity, I think, through AI adoption.
Speaker 2:Scalability when it comes to technology, the way that a company needs to have a strategy with technology is without a good strategy and technology, you can't scale your business because you need repeatable process, and that's where a good IT strategy comes in. Just like a CEO will put together an operational or a marketing and all the different strategies for a business, a good, well-defined IT strategy, by standardizing your environment, securing your environment so that, as your technology continues to grow and you're bringing in more technology resources, will give you that ability to scale. A lot of times, people will be like I don't need information security policies, I don't need a strategy till I get to a certain size. If you do that, you start to hit these uncomfortable boundaries where it's like, oh shoot, we need to pivot and make this happen now. If you do that, if you make those strategies and put them in place now, you don't have those boundaries as much. You just start hitting those things and you're able to just add on more technology and bring it in without having the security concerns All right.
Speaker 1:well, let me answer this question then. Ryan, if you have a good IT strategy in place, can it help a company's brand?
Speaker 2:Oh, absolutely it helps a company's brand, because that's a great question. A lot of people see IT as like a behind the curtain thing. It's kind of like they see it as a cost center. Yes, and those that you're serving, that stuff will start to come to the forefront, Having good policies in place and a good technology strategy and even things like what they call incident response and cybersecurity programs. People want to work with companies they know are doing their best to secure their data, and in some industries it's almost required. So when you go to talk to a certain client if you don't have an IT strategy in place, and then they hand over this questionnaire to be like hey, we're a larger organization than you typically work with. We require you to have all this security in place. If you don't have that in place already, you can't answer yes to those and you now don't have the ability to scale, to grow and serve those types of clients. So that's where it develops great brand and reputation in your industry.
Speaker 1:Makes sense. So what's the biggest difference between three years ago and 2025 with regards to IT and cybersecurity? What are the hot issues right now and who?
Speaker 2:is your company addressing.
Speaker 1:Is there one that sticks out, or just several of them?
Speaker 2:You know it's hard to say that three years ago cybersecurity is any different. I mean, the landscape of technology is always changing, of course.
Speaker 2:So you know, from three years ago to now. Ai, of course, is the big topic, the big changer. That's something everybody should be watching and studying, and we're trying to make ourselves prepared to help our clients adopt a good AI strategy and how it can help with their business. So we're trying to get our arms around that, so we know how to serve our clients. But in the realm of cybersecurity, a lot of it is still just common sense, standards and best practices that companies need to follow, and especially for small businesses, which is what we deal with.
Speaker 2:A small business is so focused on paying the rent, bringing in that revenue, making sure they're meeting payroll, that if they don't think about the cybersecurity side of their business, it could put them highly at risk. And we're here to help them identify where that risk is and try to mitigate it. So it's really comes down to making sure that you align with good best practices that even the government three years ago published under the Biden administration. They pushed out like a hey, everybody should at least be following this set of standards. Um, the federal government realized it was that big of an issue and pushed that out okay, let me.
Speaker 1:Let me ask the question in a different way, right? Um? What are some new tricks that cyber criminals are using? To access your money, your information, your intellectual property. That maybe they weren't doing three years ago, because everyone says you know the crooks get smarter every year. I don't know how they do it, but they do.
Speaker 2:I do have a few, so let's talk about those. Thanks for bringing that up Before I talk about those. Number one everybody listening needs to realize that they are compromised. Everyone talks about oh, my data is leaked on the dark web. You just need to live your life knowing that you have some of your information leaked on the dark web, so it's good to protect it and take security measures.
Speaker 1:So I don't even know what the dark web is. What is that?
Speaker 2:Well, when you go to the Internet and you do a search, everything the whole internet is indexed so that you can go find stuff. The dark web is not on that search index.
Speaker 1:Ah, okay.
Speaker 2:So people go to. These are the back alleyways of the internet that people go to where it's not a front door entrance. I got it, you got to know what alley to walk down and what back door to knock on to open that door.
Speaker 1:I was just kidding you, ryan, I'm an expert on that door.
Speaker 2:So I was just kidding you, ryan, I'm an expert on that stuff, yeah yeah. The reason that's important, gene, is because all these criminals carrying out these attacks against you are pulling your information from the dark web. So they know Gene Valdez's personal email address is X Y Z, but they don't know much more about them and they start to do research and pull information and try to find out where else you're at on the internet and then they use it to craft campaigns to get at you. Wow, one of the campaigns that's come up in the last couple of years that was not around three years ago, and this one is very clever. Again, most threats are through email, and one of the campaigns that they now run is you'll get an email in your inbox. That is what we call a fake receipt. It'll say hey, gene, we just want to let you know. You know. Thank you for resubscribing and renewing your subscription to norton antivirus.
Speaker 1:I just got one of those this morning. Thank you for your payment.
Speaker 2:Yes, thank you for your payment and it's got a dollar amount of like 350 or 450 bucks.
Speaker 1:It was 300 bucks for paypal. I go, I didn't buy anything.
Speaker 2:There's no link on it. That because normally people would see a link. People have gotten smarter, so we all know oh man, if there's a link, I need to be careful about clicking on it.
Speaker 2:So, there's no link on it that would make you suspicious. There's no attachment on it that would make you feel suspicious. All it is is it's trying to put you into a state of emotional compromise, to be like I didn't authorize this charge. And in the email they say if you have questions or concerns about this, call this number and we'll help straighten it out. And all that is is a criminal on the other end asking you what your bank card is so they can refund your money. Oh God, so we call those fake receipts. Those have become huge. Not a lot of people fall for them, but it just takes a moment for someone that's never seen it before to make that phone call and they're calling a criminal. So don't call a number that is on a suspicious email okay, I want to shift gears.
Speaker 1:Um, let's just call it horror stories. I need to ask this question. I mean, you've been in the business for a long time. Can you give me an example of a client that was compromised, whatever the problem was, what you did to fix it and what it cost that owner in terms of tangible money and time? Intangible time.
Speaker 2:Yeah Well, I got several examples. I'll pick one of someone I met just a couple of years ago. They cause this one's pretty radical and it hits close to home because it was it infected their. It affected their entire business. They are a small business here in the local SoCal area. They got hit with ransomware back, I think in 2022.
Speaker 2:And those of you that don't know ransomware is someone clicked on the wrong thing. It got onto a computer in their network. It reached out, encrypted all of the files that were visible over the network, including their server. Their business was shut down for weeks Wow, for weeks. And this is a small business that is providing uh materials that have a short shelf life, so they bring materials in and they get it out to local retail stores here in the SoCal area a very popular retail store. So they couldn't move that stuff. So for a few weeks they were down. They had to contact their side. They had to pull the trigger on their cybersecurity insurance. Cybersecurity insurance sent down representatives that came and locked down all their systems, wiped their systems, did the investigation, but it took them a few weeks to get back up and running and they were. They lost a lot of historical data in that process? How much?
Speaker 1:money did they lose?
Speaker 2:You know, I don't know that, I got the number from the owner but it was hundreds of thousands of dollars. And that wasn't even, and so cybersecurity insurance covered a lot of that expense. But here's the kicker they still had to buy some, they still had to buy licensing and and do some other stuff just to get through that. A year later it was not.
Speaker 2:it had determined that it wasn't done properly because they got hit again with that same ransomware oh geez wow and it was because the systems weren't properly wiped clean and processes weren't gone through, so they had to send someone else in clean it all up. So now we're talking about hundreds of thousands more, and by after they got back up and running after after the last incident they contacted us to be like whoever we were using was not doing a good job of protecting us. We need good security. So we came in and had to do some further cleanup and you know that's an additional tens of thousands they had to spend. But now we just actively monitor and protect them and they got a lot of basic protections in place they didn't have before.
Speaker 1:And they don't have that concern. That's important, yeah. So let me ask you a very I don't want to say dumb, but you know it's not my world, but when you suspect that you have been hit, who do you call? Do you call the police, the fbi?
Speaker 2:uh, you do're encouraged. You're encouraged to call FBI. I would say this If you have cyber insurance, you call your insurance company first.
Speaker 1:If you'll know. Let me back up. What percentage of small business owners do you know have cyber security insurance?
Speaker 2:Probably less than 50 percent.
Speaker 1:Yikes, okay, go ahead.
Speaker 2:Yeah, so that's who you would call first. Number two you would certainly call your IT professional, if you have one.
Speaker 1:Yeah.
Speaker 2:Because they can come in and assess to see what's going on and work alongside with the cyber insurance, if that's even necessary. Cyber insurance will, or the IT professional will recommend whether FBI needs to be contacted. But I will tell you, gene contacting the FBI. The FBI likes you to contact them, but they pretty much don't do much.
Speaker 1:They're too big. I mean, it's a bureaucracy, right. I mean why would they want to help a $3 million company?
Speaker 2:Exactly, exactly. It's all about numbers for them so so for them. They like to get the information because they can sometimes figure out if the group that was involved in this attack is someone that they're currently chasing. But they can't go get your money back, um, yeah, and they don't really do much, so it's more of like data gathering for them okay, so how many small businesses are paying ransoms to get their information back?
Speaker 1:Or? Is ransomware a dead issue, or are small businesses still paying for it?
Speaker 2:No, no, ransomware is not a dead issue. Matter of fact, ransomware is a big business in the criminal world. That is what they are after. Ransomware is the way that they can get money from small businesses. The criminals also do it by tricking companies into sending them money as like hey, I'm your vendor, please change the bank account you're paying to. That's a common tactic, but most of the time it's through some sort of ransomware where they get in, lock up your data, hold it for ransom, and now they're even moving on. Instead of just saying, hey, I want your money to get your data files encrypted, now they don't even encrypt it. They just say, hey, we exfiltrated all your data. We're going to go post it out on the dark web or make it available publicly if you don't pay this ransom.
Speaker 1:All right. So let's say that that does happen and you're going to pay them. How do you pay them? Do you meet them in a park with a brown paper bag and get cash? I mean, there's got to be some kind of you know way to identify who the money went to, or? Is there not.
Speaker 2:It is, but it's all through.
Speaker 1:Uh like bitcoin so now you're just using cyber currency to do all of that it's.
Speaker 2:That's why criminals especially don't want uh currencies like bitcoin to be tracked by the government, because if the money's traceable, it goes back to the criminals. Right now, something like Bitcoin is not traceable whatsoever, so that's how it's done. They ask for Bitcoin.
Speaker 1:Okay, interesting, wow, but.
Speaker 2:I don't know the percentage of businesses that pay much anymore. I know it was high a few years ago, but gosh, I could tell you I still hear too many stories of businesses paying because, even if they have backups, the cost of restoring everything and getting back. Sometimes it's just cheaper for them to pay the ransom, just to get going and all they're doing is telling the criminals. Hey, I'm a paying customer, and now they're even a bigger target on their back. Oh geez.
Speaker 1:Okay, so let me ask a more general question what percentage of small business owners and I'm identifying small business owners as doing anywhere from maybe 1 to 20 million in annual sales, be one to 20 million in annual sales have, in your opinion, in place a good IT?
Speaker 2:cybersecurity strategy, or plan, if you will. This is not my opinion. This is a well-known statistic, but only about 51% of small businesses have any cybersecurity in place.
Speaker 1:So 49% are just flying from there. You know what I think the 51% is even generous, I think.
Speaker 2:I think they're including people that have like even a minuscule amount of like hey, I have strong passwords are included in that 51%, but, yes, a large majority are just why is that?
Speaker 2:Ryan, you know, in fairness to business owners, a business owner has a lot on their plate, as you well know. There are so many things that demand their attention and when you're a business owner trying to scratch to get your business to build, you're so focused on generating revenue, servicing clients, that the security behind all that technology that's supporting it is just really not a concern for you. And most people operate on the basis of I'm not going to think about it because I've never been affected by it before.
Speaker 1:Right, right. It will never happen to me.
Speaker 2:Exactly, and so that's the reason why most people don't give it that time Now, as they get to a point where there's a lot of things that keep business owners up at night, and one night a business owner will wake up and be like, oh my gosh, I now have a lot of assets I'm worried about and revenue I'm trying to protect. One of those wake ups one night will be about how am I secured in my technology? And that's when they start to reach out and find a professional to say, hey, what can I be doing to put protections in place?
Speaker 1:Okay, so I want you to put a crystal ball in front of you, and I know this is just your opinion, but where do you think cybersecurity is going in the future? Is it going to get worse the same, or better? It's going to get worse. Is it going to get worse, the same or better, it's going to get worse.
Speaker 2:It's going to get worse because of ai. It's because of ai, though. Um man, I, I have to tell you that I I just started reading in the past couple of weeks about ai generated videos and deep fakes. Yeah, even in a lot of it affects larger companies. But now criminals are generating deep fake videos to go through a job interview with the company. So in HR department thinks they're looking at a video for a candidate and it's really a criminal. And you, like north korea or south korea, I think, was the example that was shown to me of now you don't even know that you're dealing with somebody real anymore. So it's, that's. That's what all this is. All of everything behind cyber security and cyber crime is all about tricking people into thinking one thing, and we all have to be really suspicious about what we're seeing may not always be real, and that's why I think it's going to get a little more difficult.
Speaker 1:It's going to get worse because of AI. So let me ask you a question Are you really Ryan Kintzer or are you a robot?
Speaker 2:Yeah, I am Ryan Kintzer. That remains to be seen. Gene that remains to be seen gene.
Speaker 1:That remains to be seen. Oh I, I guess there's two sides of the coin, right we? Technology is great, but along with it comes a lot of scary things it's just risk.
Speaker 2:It's like anything else in business, right, there's always risk with anything that we do and yeah, so it's just learning how to manage that area of risk in your business.
Speaker 1:All right, well, we're. We're coming toward the end. Now, ron, I've just could you give me what you think is the most important thing that you would want my listeners, business owners, to take away from today's show? In 25 words or less.
Speaker 2:Again, never think it won't happen to you. Just get some good security in place. Even if it's minimal, start somewhere.
Speaker 1:Okay, that's good and short too.
Speaker 2:Yes, well, you said 25 words.
Speaker 1:You can count afterwards with an AI tool.
Speaker 2:You can submit this video to AI and it'll tell you how many words I said. That's funny.
Speaker 1:Okay Well, Ryan, thanks so much for the great information. It's scary out there, isn't it?
Speaker 2:It is, but you know what? There's a lot of stuff that's scary in life. Don't let it stop you from chasing that dream. Get to living. Don't live under a rock and live under fear.
Speaker 1:Well, the good thing is I guess it's sort of security for your employment as the owner of a business in the IT world, right?
Speaker 2:You can say that, yeah, I suppose it is. We'll always be here to help people through all of that stuff, for sure, and that's why I don't like scaring people into it. It's just a reality that we need to face. Yeah, they need to know. They need to know.
Speaker 1:So all right. Well, thanks a lot, ryan. I appreciate it. So that's a wrap, everyone, if you want to avail yourself to this episode, I'm on all of the major podcast directories. I'm on YouTube. Just do a search for CEO to Rainmaker Gene Valdez, and I'll see you next month. If you have any questions for me, contact me. If you have any questions for Ryan, I know how to get a hold of them. So, with that, I'll see you next month. Thank you, ryan. Bye-bye.
Speaker 2:Thanks, Gene.