Five years ago, when a major hacking attempt was successful, "it was big news," said Roman Bohuk, a cybersecurity expert and 2020 University of Virginia alumnus.
But, nowadays, "There’s probably 10 news articles each day about some kind of big company getting hacked," Bohuk said.
Earlier this month, a cyberattack temporarily shut down Canvas, an online education platform used by schools nationwide – including UVA – as end-of-semester staples like final exams and projects were in full swing.
That incident reinforced the growing demand for companies like SkillBit, the Charlottesville-based startup Bohuk co-founded with fellow Wahoo Thomas Rogers.
Originally launched as "MetaCTF," SkillBit helps companies assess, train and strengthen cybersecurity teams through hands-on simulations designed to mirror real-world attacks.
People are also reading…
Its client list includes companies such as Uber and GitHub, as well as the University of South Florida. This week, for the second time since 2023, SkillBit is participating in the International Cybersecurity Competition.
Known informally as the "Cyber World Cup," the event features teams from more than 80 countries competing in cybersecurity challenges.
Rogers, a former UVA basketball player, used a local hoops analogy to describe SkillBit’s role in the event.
"It’s like they’re providing JPJ (John Paul Jones Arena) and inviting the teams," Rogers said, "but we’re giving them the court, the balls, the baskets to help run the infrastructure around the actual game."
"We are creating the scenarios that the teams are going to have to solve as a part of the competition."
Whether through international competitions or corporate training exercises, SkillBit’s goal is to help organizations better prepare for cyber threats.
"We’ll build a mock website for a small business," Rogers said, describing a typical exercise, "and we build the website to be vulnerable on purpose. And then we present it to the user and say, ‘Here, can you figure out a way to log in?’
"By exploiting the website, they learn how to protect it."
SkillBit first partnered with the International Cybersecurity Competition in 2023 when San Diego hosted the event. Since then, the rise of artificial intelligence has reshaped the landscape.
"AI can execute attacks and find vulnerabilities much faster than before," Bohuk said. "It can automate tasks that used to take trained professionals hours or days to complete."
In response, SkillBit has begun building hacking simulations designed to teach clients both how AI can strengthen cyber defenses and how attackers can exploit AI systems. One focus area is "prompt injection," an emerging cyber threat in which attackers use carefully crafted prompts to trick chatbots and other AI systems into revealing protected information.
