How Vanta’s founder bet big on startup security and found product-market fit — Christina Cacioppo

 Since Vanta was founded back in 2018, the company has been quietly expanding its corner of the global security and compliance market. And so what's first started as Vanta specializing in helping companies meet standards like SOC two, HIPAA and GDPR has grown into the leading trust management platform.

And so now you're a series B company. You've raised over 200 million to date, uh, by some very big names. CrowdStrike, Sequoia Craft Ventures, and Vantis customer base. Now numbers north of 5,000 organizations, including Quora, modern Treasury, Autodesk, and companies like Lattice. Uh, as one of its very first customers, Van's.

Low profile has been, I think, in a way by design. In fact, I know you signed your first 600 customers or. Without even a real website and only hired your first marketing role in late 2020. So in today's conversation, I really want to peel back the layers of Vantis story. And so to kick things off, Christina, I'd love if you could take us back to before the company, uh, was even an idea in your notebook.

Could you tell us a bit about your background and some of the different pieces that pushed you towards the founder path?

 For sure. Um, so I grew up in. The Midwest, uh, my parents were both academics. Um, two parts of that. One, they actually really liked their job. So growing up I thought, you know, a job was something you really liked to do and you found really interesting. Um, and second part is I thought I would be an academic.

Uh, I didn't wanna study what they studied, but it actually just seemed comfortable and familiar to me. So that's what I thought I would do until I was. 21 kind of graduating school. Um, and then somewhere around there, I think I was in the process actually writing an undergrad thesis at economics. I realized this was great, but there's other things to do.

Um, and so I kind of did a, a host of different things. Um, Ended up, uh, getting really lucky in my first job at a school was at an early stage venture firm in New York City, union Square Ventures. Um, so got to work with Fred and Brad and Albert, uh, as they thought about large networks of engaged users. And I think in that, um, you know, I think actually going into that, I, I maybe did wanna start a company, but I definitely didn't say that out loud and or even in my head, um, it kind of seemed like, I don't know, I wasn't, you know, prepared, ready, the sort of person who started a company, whatever that meant.

But at U S V, um, I basically just spent two years meeting with founders, like day in and day out, week in and week out. And it was really helpful because you just see all the different sorts of people who become founders, um, and how different they are. And like, yes, there's commonalities around, just getting up and putting one foot in front of the other.

But there's so many different ways to do. . And so that was just like really helpful, honestly, really transformative. Um, and I kind of got to the point where it's like, okay, I kind of do wanna go start a company, but I want it to be a software company and I can't code. And I know lots of people do that, but I don't feel like I can.

So I'm gonna go take my bonus, um, and go teach myself to code and teach myself to build product. and I spent the next two years or so doing that. Um, made a bunch of things, none of which anyone has ever heard of, um, most of which were bad because it just says you're learning something you like, have to make a lot of bad stuff before you start to make reasonable stuff.

It's kind of the like Ira glass quote, right, where you're like, taste outstrips your talent for a long time. , um, did that in some ways felt like I got to a better place of like, I learned how to make things. But, um, you know, I was also at this funny place where I'd, I'd done some of it with, you know, one or two other people, but I'd never really worked at a real company, before.

Um, and so ended up joining Dropbox, uh, which is where we cross paths, um, as a product manager, and again, got really lucky. Worked on a new product. At the time, Dropbox Paper, trying to bring that to market. Um, and that was just a whole different ballgame. Like the team with the engineering product and design team was about seven or eight people when I joined for, for a paper in particular.

Um, and it was probably about 70 or 80 when I left a couple years later. So, got to like, see what that is, see what a company is, you know, see what marketing does. Joking and not joking. Uh, I sort of didn't know.and so all of that was, you know, kinda ended up in vanta in a lot of ways, 

 did you join Dropbox knowing that my next step after Dropbox will be to start my own company, and this is sort of like the training ground for that in a

 yeah, that was very much the like, what I, what I wanted and I'd kind of at least gotten to like, saying that to myself. Um, so a little bit less to other people, but yes.

 Cool. And so, um, talk about, you know, when you decided to leave Dropbox and, and how you started to think about the idea that would become.

 Yeah. you know, I think all of these things, they make sense in retrospect, but they're kind of complicated and they feel like swirly at the time. it was kind of from a, a product perspective, I think for me, with Paper it became pretty clear to me that the best chance for paper success would be to go a lot closer to core Dropbox.

Whereas we'd sort of been operating as this like separate team and that was, you know, really fun in a lot of ways. But I think not actually serving the product or its users very well. Um, and so there was a piece there where it seemed like that should just change and like, am I the person for that?

Or like, ish, you know, I think it was less clear to me probably also to others. I think there was also a part where, you know, just kind of impatient was like, okay, I feel like I've learned a lot. Um, let me go see if I have or not right. Uh, but, but I wanna, I wanna go try this thing. Um, you know, in some ways there's no time like the present.

 And so was Vanta your first idea or did you have other ideas kind of in those early days?

 No, there were a host of slew of terrible ideas. Um, so to take you back, this was late 2016. Uh, at the time there was actually also a like AI chat bot, voice assistant, right? Alexa, like wave. And so one of the initial ideas, uh, sort of the framework was. , what new technologies, you know, are opening up new opportunities and what are you good at?

So I was like, okay, well, voice, um, is new and maybe opening stuff up and you just got an Alexa. It seems kind of cool and like, I guess I know things about team collaboration after a couple years at Dropbox. So can you make right, like your voice assistant for work? Um, and spent some time on that. Made I think as, as many people have, The, you know, meeting recorder that records all your meetings and transcribes them across the company.

And, um, it sounds kind of neat. Uh, you know, some people really wanted, I think actually your median person doesn't want that product at all. Uh, there's a bunch of like very real reasons for that. Also, at the time, the technology just like, wasn't that good. Um, you know, we made a microphone. The joke was a microphone that dumps things into a Slack channel.

It mostly dumped nonsense into a Slack channel. Like this wasn't even us. . Um, and we're also like, look, we're not AI engineers. Like we're not gonna make this, you know, make these models really good. Um, you know, Google was like the type also, it's like Google at the time will, but then that's for every startup.

And so like, what's our differentiation again? You know, it just like didn't, the pieces didn't fit together. Um, the true low point. It's really funny now, but we were trying to like narrow in on a use. because the general like startup one just didn't, didn't seem like it made sense. Uh, and ended up making a voice assistant for biologists in a lab, right?

Like, you know, it kind of makes sense. You're like doing things with their hands. They have gloves, they have chemicals, they need to do conversions. It's kind of like cooking. Anyway, but that was kind of a moment where we were like, when did we found a lab? We like shipped them a microphone. We made them an iPad app.

In some ways they were really excited cuz like no one makes software for biologists in labs. Um, but also like, this was not a real, you know, like the market for this was like, you know, the size of my thumb. Uh, you know, we didn't actually know anything about biologists. You'd like go tell somebody that's what you're working on and they look at you like, what are you doing?

 Okay. And so then I think at some point you, you thought about, Hey, what about the security space? And so what was it that was drawing you to security?

 This is, it's funny, it was in some ways just naive interest, right? Um, it was, this seems exceedingly important and increasingly so, um, security on the internet, you know, you're reading more and more about breaches. It's eroding trust in software. as somebody who sort of grew up in software, like I really like software.

I believe in the transformative power of new tools. But if no one trusts them, then it doesn't matter, right? and honestly, actually back to Dropbox. Dropbox had an incredible product security team and so just spending time with the people on Nat team, you know, really compelling, really Articul. talking through the problems, um, that they had in their workflows and, you know, the, the high points in their low points of their job.

There's also just a bit of like, I like spending time with those people, right? Um, and so if you're gonna go both think about product development and then ongoing customer relationships, I think it is just, you know, not necessary, but it's really nice if you, if you love, love spending time with your users.

 Okay, awesome. Yeah, so it sounds like it was just really fun and you enjoyed talking to security folks. Did you find that when you were researching the security idea, you spent more time talking to potential customers than you did with the voice idea?

 So, absolutely. And I think, uh, just like made all the classic, um, find an idea mistakes that I, you know, maybe could have enumerated to you in advance and then promptly made them. Um, but I think of the voice idea, it was like, it was a bit of, you know, excitement about a technology. Uh, Believing you have this kind of brilliant product idea that of course everyone will want.

Um, and like not really focusing on anything real people and like real problems, uh, when you're in the like ideation or the creation stage. So what with the voice thing, you know, honestly, what we did was we. You know, built, built this tool and then walked around to people and were like, do you want our tool?

Do you want our tool? What about you? Um, and it was a little bit like the, you know, kids' book, like, are you my Mother ? You know, and like, no, no one is like, no one, no one wanted the tool really. Um, and it, you know, we did that for a bit, didn't feel very good. And I think, you know, then kind of realized that, and so, Rather than having the initial rush of being like, I've got a great idea, I'm gonna build something.

Like you get, you know, like there's positive feeds and lock back loops. You feel like you're making progress when you're building and then you like hit this wall because no one wants it. Um, since somebody's tried to reverse it. And so it's like, okay, we're actually not allowed to build anything. at all.

We are just going to talk to people, um, and talk to them until we have a lot of confidence and like a mental model of people and their jobs and the problems they might have and, and how we might solve it. Um, and there were a couple heuristics we used there too. So one was you had to keep having conversations with people until.

You knew you could kind of predict about two thirds to three quarters of what they would tell you, right? So you had to like, again, keep having these conversations until like three quarters of it was stuff you already knew at least. Um, and yeah, just really focus in on like what was their day-to-day like?

Some of the best questions we asked were, you know, asking people to like pull out their calendar and say, okay, you know, look at all the meetings you had in the past couple weeks. Like what were the best parts of the last couple weeks? What were the worst parts? Um, and again, just try to underst. People and their problems.

 How do asking those sorts of questions get you to the point where you understand kind of what they want.

 Yeah. I mean, so slowly, I think, and iteratively, right? Um, I think in retrospect it, it sounds a lot cleaner, but if I think about. Um, literally doing that and actually with the, uh, product security lead at Dropbox, it's one of the first conversations I had because it was so easy to kind of get to that person.

Um, and what he told me when he, you know, we looked at his calendar, was like, look, the, the best parts of my weeks are when I get to work with product teams. on security issues, right. And sometimes I embed with them, you have to do this with us, a paper, right? But it's like, I can work with the PM and the engineering managers.

And the engineers and like get the right stuff prioritized and fixed. Like that's the best part. The worst part is when I have to like, you know, pull together reporting on the things I've done for my manager, for executives, or sometimes get on the phone with customers and explain what we do. And you know, some of that's nice, but then you do it for.

Fifth time that week. And that gets like pretty dull pretty quickly, right? And so you kind of get this, okay, like the person really likes doing the work. Like they, they fundamentally like their job. Um, but there's this like, work about work or, you know, demonstrating that you've secured things.

Part that was like kind of tedious and annoying. That's just as an example of something got out those conversations. Um, you kinda keep pushing on that and, you know, talked how we got to compliance, but just like this very early glimmer of, of something there.

 Got it. And so what were the clues that you were hearing that eventually led you to sort of this, automating soc two idea that you became known for?

 Yeah. So couple fold. So one was, You know, going around and talked to, so probably when I, when I went down and, you know, did all these interviews or a couple audiences when I was like, co-founders, Security folks if they had them, engineering leaders, uh, eventually sales leaders. And so what that happened is cause you'd kind of go to like technical co-founders and, you know, roughly would say, Hey, you know, what, what are you doing for security at your startup?

Um, and they would generally look at like, Quite guiltily back and say like, not that much and I wish it would better. And like, please don't write this down. Right. Um, you're totally cool. You know, why don't you do more? Sounds like you want to do more than you were doing, like, what's going on? And I think the answers were always like, I mean, often quite reasonable.

You know, there's a little bit of. I don't know what good looks like or I don't quite know what to do, but there's actually more like, it's just really hard to prioritize, right? I can go and spend a bunch of time securing things and do stuff, I think would be quite good. , it's like, I don't really how to measure, right?

I'm measuring it by the absence of a breach. But also, we're a small startup and our problem is no one knows us. Not that everyone's trying to hack us. Um, or I can go spend my time building a feature that a customer wants in order to give us our first revenue. I'm gonna do the latter, like kind of all the time.

 right? So we heard that a bunch. And actually that was, you know, initially kind of, um, discouraging, right? Cause you're like, oh, this is why there aren't security companies for startups. Because even if it's a good idea, it's an easy to use product. You're still running up against this like, prioritization hurdle.

Um, and, and there's actually a phase of that. We kind of kept talking to people and there was actually a really transformative moment when I walked into Figma and Figma at the time was. Probably 30, 35 people

 and I was talking to one of their infrastructure engineers. Yeah. Yeah. Um, And, you know, kind of expecting to have the same conversation.

Right? Uh, you're like in the, so have you already heard, have you already had the conversation? You're about to have vain? Um, I was talking to him and I was like, okay, so what, what do you all do for security? And this person just listed like 12 tools and a bunch of best practices and like, just kept talking.

Uh, and that, that's one of like, why , right? Like who are you and why? Um, and the answer at the time was they had just signed Google. Which is like a huge deal. 30 person company, right? And as part of selling Google on Figma, Google it sent over this long questionnaire. Do you do this practice? Do you, you know, encrypt this?

Are you secure in this way? And. The answers were mostly nos, but they didn't wanna say no. So they just turned that into their roadmap and just did everything so they could like credibly say yes. Um, and that was this moment of like, oh wow. Like of course you did right? And you managed to like align.

Securing your company with growing your business Like what is this? Like this sounds quite promising.

 That that's sort of what created the urgency for.

 Yes. Yeah. And it let you know, I think like this engineer, certainly engineers, um, we talked to, right? It was like, They kind of, again, had an idea of what to do. It gave them a prescriptive list and more so just like the organizational mandate to go do it. Um, right. And so that's for this like, okay, so questionnaires like, what are these?

And you know, we did this like, go look at the questionnaires. Can you standardize them? Can you automatically answer them? Um, Kind of like there's some stuff there, but then we're like, uh, mostly you just don't wanna get these cuz they're so bespoke custom. So how do you not get a questionnaire and you're like, oh, compliance certifications SOC two, and then what are those anyway?

And so it, it all kind of built, um, in a way that again makes a lot of sense in retrospect, but just to like kind of level set that process. Was probably three or four months, um, of these like conversations, right? So it did not happen overnight. And you know, two months in, you're sort of like, I don't know if I, you know, I'm spending a lot of time on this, but I don't even know if it's gonna turn out into anything or not.

 Right. But the, the aha moment it sounds like was if I can help these companies unlock business and sell to bigger customers, that's a real motivator, and that's sort of what gets them to think about security and, and doing all these things.

 correct? Yes. Yes. There's just this moment of like, okay, now we're not sure we can build a product here, but like, just for a moment, suspend disbelief. Say you could make a, like, press a button and get soc two. Lots of people will pay to press that button 

Like if you can do it, this seems like a thing that people will want.

 Okay. Got it. so you have this strong sense of validation that if I can make a button that says you get SOC two, there's demand for that. And so then how do you go trying to figure out if you can actually make that work?

 Right? Right. So then you're like, okay, well what is a SOC two? Um, and so a couple folds. So Ben, it was just kind of this iterative prototyping where step one was like, go get every SOC two. You can get your hands on and read them all. . Um, and so got about a dozen of 'em and kind of compared them and tried to break down.

You know, you hear these are all different and everyone's unique and you need a consultant and like, are they actually different?

 Well, for the folks who haven't seen one, Christina, what does the SOC two like even look like?

 That's a good question. Uh, a SOC two is very practically, it is like an 80 page pdf. That lists out kind of what in compliance speak as a control, but is like the security practices of a company.

And it says, Hey, you know, as a company we have these practices and an auditor, in this case an accountant, uh, has come into the company, made sure we actually have that practice. Like we do what we say, um, and written some detail on how they do it and, you know, codified all this up in this long pdf. Um, but that's roughly what it is.

 Okay. And so that's a, so you're attempting to now productize this, like, see if I, see if we can generate this, you know, somehow automat.

 Yes. Um, and when we went and talked to, you know, consultants and auditors, uh, they were like, well, you can't do that because every report is unique. Right. Um, and you know, I think we were kind of software people and we're like, well, of course. But do they have to be unique?

Right. if we're talking about security practices here, Yeah, there's some nuance, but there's also best practices, right? Um, and say Dropbox has a very different business than Salesforce say, right? Two early SOC two as I read. Um, but should they actually, you know, protect customer data differently?

Uh, it's not evident, right? Um, so I think there's some bit of, of outside in thinking here of saying, Well, historically these have all been, you know, very bespoke. How bespoke should they be? Uh, especially at the earliest stages of a company building one of these out?

 Okay. Got it. So what was like the first M V.

 Yeah, so the first MVP was we went to, uh, a company segment, actually, um, where we knew some

 We did well, segment was, I mean, you know, a lot of these, right? Like, I think they, uh, knew us and knew, uh, you know, we didn't really know SOC two that well yet, but we're gonna work really hard until we was much more of a bet on that.

Um, . And what we basically did was interviewed their whole, or interviewed their team, you know, figured out what their SOC two should look like and how far away is it. So we made them a gap assessment that was like very bespoke and customized to them that they could then plan a roadmap against if they wanted.

Um, and honestly the test there was one, can we deliver them something that's credible? And two, do they find it credible? We are learning here. Um, and that actually went well. Uh, and so then we moved to front second company and that test was can we basically give them segments gap assessment, but not tell them it is segments, right?

We use the same controls, the same rules and best practices go to the see where front is. You know, it's customized in that sense. Um, but this is kind of pushing on the, can you productize it, can you standard. the set of things, um, at that. And so that was like, well, can they tell it was actually for another company?

You know, it's not really like it's their gaps, but not, you know, the, the, the rubric of the same. Uh, they couldn't. Um, and then actually what happened was a former Dropbox coworker, uh, emailed pretty good email, which was basically a version of, Hey, I hear you've become soc two consultants. That's super strange.

Uh, two thoughts. One, we should get a drink cause like, what are you doing with your lives? Um, two, can you come do this for my company as well? Um, and so you're sort of like, oh, this is great. Like, no, now, now we can start coding. Right now we can start building some of this.

 Oh, okay. So for these initial, you know, kind of test runs this, you were doing this all by hand and sort of thinking, okay, we'll be able to write code to do this eventually, but it's all by hand at this point.

 Yeah. And I think there, I mean there's some, some, I dunno, some hubris and we were like, look, we can, we can build whatever we want, hubris and that, but it was like, but the hard part is building something people want. Uh, the easy part is writing code. Um, and so like focus on the thing people want and then you get to go write all the code you wanna.

If you know, hoping someone will actually use it.

 Okay, so Christina, at this point, you know, you've, you've worked with Segment and Front did you have a hypothesis on kind of who your ideal customer profile would be and, and were you learning about what that profile looked like? You know, the more folks you talked to,

 So we were, um, and I would say yes, I hypothesis, although kind of weekly held, I think it was so at the time, this is not true today, but back to, you know, 2017, uh, companies that were like under 500 people say, did not get soc twos at all. Right. Um, and. So we were looking at, we talked to people who had soc twos.

That seemed kind of hard. So it tended to be like couple hundred person companies, um, would have conversations with much smaller companies, uh, where there was a lot of education. They didn't really know what a SOC two was to the extent they knew they were like, that just sounds like a thing, you know.

Again, Dropbox does, but no one else does. Also talk to compliance teams at really big companies to kinda learn about the market. Um, so I guess weak hypotheses around it being a several hundred person company. Um, but actually just a lot of kind of take the intros you can get or get into the companies that you can get into and ask a lot of people and, and sort of flare out to try to cover a bunch of ground and figure out where it's really landing.

 so you've done some of these kind of initial tests that, that we're promising. You're talking to a bunch of folks. You get the email from a friend saying, you know, can you do this for my company? When did you sort of have the internal confidence like, okay, it's time to start coding. Let's build a real product here.

 Yeah, so it's kind of after that. And I think it was like, again, we had our gap assessment spreadsheet that we'd given to two companies, and actually this third one, it seemed useful to all of them, which was in some ways kind of shocking to us, but it seemed useful to them. Um, and you know, the joke was, this was something people were talking about over the weekend that people were hearing about we were doing this and you know, you can.

Make jokes about, uh, San Francisco startup people and the fun they have on the weekends, but like that, that also seemed kind of rare that people were hearing about it, and so felt like there was something in that too.

641a2b28688b724fae14c412

Christina Cacioppo is the co-founder and CEO of Vanta. She pulls back the curtain on some of the security company’s more unconventional moves on the path to product-market fit, like waiting until they acquired hundreds of customers before building a website and operating at cash flow break-even for years before raising its Series A. 

How Vanta’s founder bet big on startup security and found product-market fit

Christina Cacioppo pulls back the curtain on some of Vanta’s more unconventional moves on the path to product-market fit, like waiting until they acquired hundreds of customers before building a website and operating at cash flow break-even for years before raising its Series A. 