Cyber Talent Series 16: Introducing SkillBit

Join co-host Phoebe DeVito as she turns the microphone on fellow co-host Thomas Rogers to discuss MetaCTF's transition to SkillBit. Thomas shares the origins of MetaCTF, the philosophy behind hands-on CTF-based learning, and how that foundation evolved into a broader platform for cybersecurity skill development that's better captured with the name, SkillBit. They also explore the vision behind SkillBit’s bite-sized training model, the role of AI in guiding skill development, and how organizations can better measure and grow cybersecurity talent.

Transcript

SPEAKER_01 0:11

Hello, welcome to the Cyber Talent series where we explore how organizations are closing skills gaps, accelerating onboarding, and building high-performing cybersecurity teams. My name is Phoebe DeVito, and today I'm going to be talking with my co-host, Thomas Rogers, and you're going to be getting a peek behind the curtain at Meta CTF's transition to Skillbit. So thanks for having this convo today, Thomas.

SPEAKER_00 0:32

Yeah, excited.

SPEAKER_01 0:33

Awesome. So our longtime listeners might remember when we interviewed you in episode one. But for folks who are newer to the show, could you just give a quick refresher on your role at Skillbit and kind of your focus day to day?

SPEAKER_00 0:45

Yeah. So I'm co-founder of Skillbit and I'm president. So I lead marketing, customer success, sales. Me and Roman work together on product. But my job primarily on the day-to-day is to talk to customers, help customers with whatever they need to be successful in their cyber skill development journey.

SPEAKER_01 1:03

Awesome. Okay, cool. And um, so before we get into this transition to Skillbit, kind of going back to the beginning, wanted to hear if you could talk a little bit about the inception of the company kind of from the beginning, what problem you and Roman were originally setting out to solve and how that's been accomplished through Meta CTF.

SPEAKER_00 1:22

Yeah, so Roman's been running CTFs for a long time, 10 years or more. And really, he started building and running and managing CTFs because he felt like that was the best way to learn cybersecurity, whether you're getting into the field or trying to get exposed to new vulnerabilities, attacks, methods, tools, whatever the case, because it's so hands-on and experiential and requires you to do things. Also, the fact that it's collaborative, cybersecurity is a team sport, and CTFs are a team sport. So Roman started running CTFs a decade ago. And uh what that led to is uh really him seeing that there was a need to run really high-quality, you know, CTF competitions, and companies were reaching out to us continuously asking to run it for their company, mostly as a part of like their security training program. So whether it was like a part of an established program or something they were trying to like gin up interest in. But that was a really interesting time to see, hey, we were just doing this thing for conferences and to democratize cybersecurity learning. And now companies are putting value into this activity as a learning method. So, in you know, servicing those customers and and working with uh, you know, a bunch of enterprise companies to run these CTF competitions, which we've run 600 of them in the past four or five years, we're talking to them continuously. So we're saying, like, what does this actually solve for you? Like, what is this doing for you? And I think what we really learned is that the method of the format of the CTF challenge is what's really valuable. It it requires people to do things, to engage, to try new things. And so that that was a critical learning and something that's really been a key driver in our transition to Skillbit is the this CTF challenge is something we can take and we can apply it to other methods of learning, evaluation, assessing. And so that's what we're doing.

SPEAKER_01 3:19

Awesome. Yeah, that's a great recap. Thank you. And you kind of just mentioned it, but I'm curious at what point did you and Roman feel like the company had evolved enough that like a rebrand made sense? When did that kind of start for you? And then when did it become really solid?

SPEAKER_00 3:34

We've talked about it for four years. I think the hardest part is like deciding on a name, finding a domain. That was a whole thing. But you know, feeling like the name is something that fits like where we want to go and is going to be like versatile. I think probably the main driver is our the launch of our continuous learning platform. So that was meta CTF On-Demand Labs, which will now be Skillbit Labs. So it's continuous learning and it's basically like we're moving out of just doing CTF competitions as training. So we're doing, we're doing more than that. And um I think that evolution kind of reflects where we where we see an opportunity to help, and our expertise is kind of beyond that. But the the the idea of changing the name is something we've thought about for a long time. It just took, you know, takes time to find the right name and all the other pieces to fall into place. Because also like the the key part of that is like the name is not, it's important, but it's not that important. Like it's it's not like critical to running a business. So we're trying to find time to make the right decision there.

SPEAKER_01 4:37

Yeah, I love that you mentioned, you know, the name's not everything, but it is a big piece of this rebrand. And I was fortunate to get to be part of that process, you know, as one of the team members at Skill bit, seeing all of the different options and then kind of narrowing it down, and that process is painstaking and also really fun. So I'd love if you could kind of talk a little bit more about like the initial inspiration for the name Skill bit and kind of how we got to that.

SPEAKER_00 4:58

Yeah, there were two things that went into that. The first is our philosophy around training, which is the bite-size piece. So skill bit, bite-sized skill development, that's sort of where that came from. But on the bite-size piece, that's a big part of our philosophy is that users should be able to log on to our platform and get a lot done in a short period of time because we're deconstructing these complex workflows into individual tasks that they can complete in a short period of time. So that bite-sized nature is designed to meet the modern security professional workflow. People are busy, teams are understaffed, they don't have much time, they can jump in for 20 minutes here and there, hopefully each week or, you know, even daily, or in some cases, whatever the whatever the cadence is right for them. But designing these training platforms where the content is meant to be able to be solved in short bursts, uh, that was a big part of it. The other part was it was really important to me to include the word skill in this. I think I have a lot of feelings about the term and just kind of comparing the term skill development versus training. I think training has a lot of sort of legacy learning connotations, I guess I'll say, like where, you know, like classroom-based, a little bit more like knowledge-based versus actually, you know, learning to do things, whereas skill development is is maybe a little more like practical and tangible. And so the word skill, I think, was very important to us to include in in the name. And so combining, you know, bite size and skills was was a was a no-brainer for us with Skillbit.

SPEAKER_01 6:31

Yeah, awesome. And I I like that you mentioned that. So one thing obviously is part of this rebrand for the listeners, we've been doing a lot with um, you know, our website, including, you know, working on some case studies. And that's given me a really cool opportunity to interview a lot of our customers and also just operating as the customer success manager, trying to really see what part of our platform has been really, really helpful to folks. And I think what's so interesting is the thing that kind of came up. If you think of like a word cloud, like the word that would be the biggest, I think that came up in every conversation is just the flexibility. And I think for so long, even in my career, like training feels like it's been synonymous with like, I'm gonna miss that week of work or I'm gonna miss that whole day and have, you know, a ton of stuff I gotta make up. Sometimes you can't even find that day where that works for your schedule, you know, or it's consuming all of your outside of work hours. And, you know, there's nothing wrong with those training structures. But I love how you just touched on we're trying to kind of meet cybersecurity folks where they are. And I think that it was really, really encouraging to hear people say that, you know, if I like only have five minutes between meetings, I can not only feel like I got something done, but I can actually learn a new skill that's then gonna help me in my job. So, you know, I think that that's such a great point. And I do think that it's also such a rapidly evolving industry where we need to be upskilling. Um and so, you know, trying to make that something that fits into the actual workflow of someone who works in cybersecurity, I think is also something I'm passionate about. So I'm happy that you touched on that.

SPEAKER_00 7:58

No doubt. Yeah, it's been good getting all the feedback that you've collected just from, you know, helping people get started with our platform. I I feel like that's been so helpful to hear, like, hey, this is what we hoped people would get out of it. And then they're actually getting out of it what we hoped. Like that's that's great.

SPEAKER_01 8:14

Yeah, absolutely. And I think one more thing I'll speak to just on those like customer interviews, is I think this it's really awesome to hear that this tool can help teams bit like build on their kind of existing culture of skill development. And I think it's really cool to hear how, you know, for some folks it's just like I'm an individual using this tool and I'm able to crack away at a couple of challenges between meetings. But we've also heard really fun stories of teams that like build 3D trophies for winners and have like these little internal competitions, or we talk to one person who every week one member of the team like finds a challenge that really was interesting for them and kind of like presents on it. So I think it's cool to think about the way that this can also be something that brings teams together as everyone is kind of working to upskill. And ultimately that's you know in the best interest of the individual, the organization. So yeah, I think it's it's you know, you always you're putting out a product and you want to you want to hope that it's like meeting people where they are and it's helpful. But I think it's really cool when you can hear about folks using this in ways that maybe we didn't even predict. So I yeah, I'm super excited about the evolution of this. And speaking to that, I'm curious. So as Skillbit grows, what products or services are you most excited about, either building or kind of building on to meet some of those customer needs, like we talked about?

SPEAKER_00 9:28

I think helping in more ways up and down the talent stack. So sort of evaluating like, hey, where do we fit in the talent stack? And for the most part, so far, we've fit in the, hey, you already have this base of cyber focused employees, and you're trying to, you know, help them develop in their career, you're you know, providing them with additional professional development opportunity. And there's other things that you know companies need to do up and down that talent stack. So whether it's like learn new tools, onboard new employees, we have been doing uh a good bit of helping companies to assess at the interview stage. So the CTF format really works there because it's it's kind of like problem solving. So you get to see how an individual, um, a candidate would you know interact with a specific like task at work. It's kind of like a case study. But I think up and down the talent stack is something really interesting and yeah, providing more value in terms of like learning things that are gonna help the company succeed in InfoSec. And then the other thing is just adding a lot of you know AI to our platform in a way that'll help the user experience. So to streamline like what should I focus on next? Like, you know, I'm a threat hunter and I want to move forward in my career. Like, where should I spend time and how should I focus time? I don't have much time, and sort of deciding like what new skills I want to develop is like maybe part of a challenge, helping to do that and then helping managers to to better, you know, have an evaluation of what are our capabilities, what are our team's capabilities, so that they can decide, you know, who to staff on a project or who to promote, or do we need to hire externally? Can we hire internally? That all those things. So I see that that's that's primarily where we're gonna use AI is to like improve the user experience.

SPEAKER_01 11:13

Yeah, awesome. I love that you talked about the evaluation piece. I think that one thing I was thinking about when we started recording this today is how many of our like I think almost every podcast guest we've had on the Cybertalent series has talked about um evaluation and how critical and like foundational that is to building these teams. And so I'm curious, yeah, I'm curious when you think back on like our other kind of recordings and the episodes, you know, folks that we've talked to, like, have there been times for you where you're like, oh, that's like, yeah, that's exactly the problem I'm trying to solve.

SPEAKER_00 11:44

I think the thing is like every single episode has been kind of like that. So it's not you know, maybe, maybe it touches on different, different things, but I I think that's what's so interesting is people are attacking similar problems from different angles, and they have unique approaches to each of these things that they're trying to accomplish. But at the end of the day, everyone is like trying to hire the best people, hire the smartest people that fit their culture the best, and treat them well and upskill them and make sure that their organization is protected and that they do a great job. Like people cyber professionals have a ton of pride and pride of work. And so I I think, yeah, that no no one single episode, I don't think. I mean, I could think of like five, but pretty much every episode is like people trying to accomplish similar things that are like, yes, that's exactly what we would ideally want to help with.

SPEAKER_01 12:32

Yeah, a hundred percent. And I think, you know, one thing that I'm excited about when we look at like especially the Skillbit Labs product and this on-demand, you know, ability to go in and solve challenges. One thing I think I'm really excited about seeing how it evolves is it's not all like the hard technical skills and a lot of that you can teach, but like just this idea of curiosity being really important. I think whatever field you're in, that's true. And so it was really cool for me when I started talking to some of our customers, hearing them say, like, this helps me see like my team's curiosity, you know, both in like who's wanting to go to develop their skills, but also like that ability to kind of I think of like pulling a string on a sweater. It's like you just can go deeper and deeper. And even with some of the really frustrating challenges that are harder, like you can, you know, spend as much time as you want really like digging into a new concept. So I think I'm I'm really excited to see, you know, like in Skillbit and even beyond that, how we can grow in the InfoSec community in that ability to kind of like see candidates for all that they are, like, you know, hard skills and soft skills that are gonna make them a really awesome team member and eventually like the people that we've been read, like really great leaders. So yeah, I'm excited about that part of it too. And it's cool hearing that from some of our customers. So, speaking of kind of the InfoSec community, obviously the InfoSec community is strong and Skill bit is established in the community. And so, you know, Meta CTF has been for as long as that's been kind of our name. And so, what would you say to that community as the company enters this new chapter during this rebrand?

SPEAKER_00 14:01

I think it's just more of the same. Like this is all about us being able to provide more to the community um in in different ways. Yeah, ideally, um, you know, we're gonna we're still gonna, you know, run the CTFs where yeah, you can block off your, you know, the third Thursday of every month with our Flash CTFs, and we're still gonna have the weekly challenge every Tuesday drop at you know 6 p.m. Eastern. And so there's just gonna be more stuff like that. So more, more opportunities to learn, more free resources, more ways to get your foot in the door and meet new friends and current and future colleagues and like working, working with them. Yeah, the the skill bit evolution is just gonna be one that is gonna enable us to invest even more into the community.

SPEAKER_01 14:47

Awesome. I love that. So as you look ahead, how do you see the way organizations develop? And you know, we talked a little bit about evaluation. So evaluating cyber talent, how do you see that continuing to evolve? And how do you see skill bit fitting into that feature?

SPEAKER_00 15:03

I think thinking about conversations that we have on this podcast and outside of this podcast is when I ask executives how they quantify and measure capabilities, it's usually like we don't really. And I think the primary reasons why companies don't try to do that is just because it's hard. I think actually quantifying a skill is typically viewed as a, you know, it's it's a soft thing. It's not a tangible, measurable thing. And what we want to do is is sort of demystify that and like create a measurable way for companies to think about capabilities. So that that's just gonna unlock a a number of different things that they're gonna be able to do with a more data-driven approach, including how do we know the right profile of candidate to look for here? Oh, we know because we have this basis of like these are three really accomplished incident response analysts in our in our current company. They fit this profile, this is their skills profile based on this index that we've created internally. So we know this is the type of candidate we need to look for. And then it's a pattern matching exercise from there. And you don't have to rely on the resume. You can still use that as a, you know, as a as a um, you know, as a way to uh, you know, as a as a piece of the decision making, but it's not like the whole thing. And then you use the interview to sort of supplement that. But that's just one example. There's a couple other examples might be we're evaluating this new vendor, and we need to understand how quickly are we gonna be able to adopt this tool and get it up and running and achieve value. Maybe they're presenting us with a business case of, you know, you're gonna, this is like the ROI and like how you're gonna achieve value. You might be able to take a look at like what your team's capabilities are on that tool, whether like from previous work or some exercises they've done recently as a part of the demo and POC. And so I think creating a world where there's a there's a quantitative approach that's accepted and understood for capabilities, especially within cybersecurity, is one that we are working on helping to co-create at Skillbid.

SPEAKER_01 17:21

That's awesome. I love that. And I think, you know, I've had a couple awesome guests who have talked about how they kind of quantify more in the sense of that like interview process. But I think when we get into that conversation of like, you know, it's you want that more well-rounded picture. Like certificates are awesome and like certifications are great, and like they're not everything, you know, the resume tells you a lot, but not everything. And then when we get into the more subjective stuff, like interviews, we've had guests bring up like it can get, you know, there can be bias or different things that you know, you're in a room with eight interviewers. And sometimes I think we talked on one episode about like even the time of day you talk to someone can can impact that. And so love that idea of like whether this is like vendor evaluation or candidate evaluation, like finding that way to kind of like quantify some of these like qualitative skills that make like a candidate really awesome or a vendor, you know, a good fit for your company. And I'm glad that you touched on that, and I'm excited to see where Skillbit can take it.

SPEAKER_00 18:15

For sure. Yeah, cut through the noise.

SPEAKER_01 18:17

Yeah, absolutely. Awesome, Thomas. Well, is there anything else you want to, you know, tell our listeners about this transition to Skillbit?

SPEAKER_00 18:24

So it's mid-March 2026, and we'll be rolling out our new marketing website in the next week or two. And we're also we have a new product release coming out for Skillbit Labs. It's super exciting. That's probably more of like an early April time frame. But just stay tuned, follow us on social, and you'll hear all about uh the company changes and yeah, stay in touch that way.

SPEAKER_01 18:49

Awesome. All right, thanks so much, and we'll yeah, we'll be back on your feed soon. Thanks, everyone.

SPEAKER_00 18:54

That's a wrap for today's episode of the Cyber Talent series. If you enjoyed the combo, make sure to subscribe on Spotify. Also follow us on YouTube and subscribe there. We'll be sharing content there as well. For ongoing tips on hiring, retaining, upskilling your cyber workforce. Make sure to follow us on LinkedIn and check us out at medic.com. Thanks for tuning in. We'll see you next time.