How AI Is Repricing Every Software Company

We have talked to our customers a lot about token-based pricing, and I think what we've generally heard is people are real smart. But actually, and so if you try to charge them based on tokens, they are very quick to say, 'Oh, you've just marked up a Claude token 4x. Are you 4x as good as Claude? I don't know, let me go try it out.' You actually put yourselves in a competitive position against the models. And so what we've seen on token pricing is like, if you're trying to mark up at all, users are very smart and you will lose on that comparison.

Started Vanta about eight years ago, which was about 8,000... yeah, exactly. You're like in 17 centuries ago, with the premise of can we help companies build and earn trust? And build trust is like start security programs and compliance programs, or mature them, and then go get credit for their customers through audits like a SOC 2 or ISO 27001 and HIPAA, etc., questionnaires, trust centers. But basically this idea of can we build a security company by helping companies implement security because it's what their customer is asking for. And so we were initially known for SOC 2. We had a billboard — we do have a billboard on the 101. We're mostly known for making billboards, I joke, but it started like very compliance, very audit-centric. The idea was always, hey, that's just like one way to get a company started on this. And so since then, we've gone into different areas of security, we've gone into different ways of like earning trust with your customers. And so today we're about 16,000 customers global with about five products.

Execution, I think. You have to both like... software, the blessing and the curse, and this is, you know, more true now even than it was five years ago. Like, you're really only as good as the last thing you shipped. And so you can be first and you can start it, and it doesn't really matter. I mean, that's more true now because it's like someone can vibe code your thing in a weekend. And so you've just got to like constantly be shipping new products, new features that make the experience better for customers and like running on that differentiation. And so there's some feature level. I think the other thing we really invested in when it got competitive that was very good was integrations, pulling in data from other tools. And so now you can connect Vanta to one of 400 tools. We pull a ton of data out of those tools, and that's what powers the automation, the agent, the AI, all of that. We call it our trust graph. It's really just like a security data lake, and that is bigger, broader than any other provider, including some of the security providers, because we touch areas they don't. And I think that in retrospect that data foundation has let us build new things faster — software and agent. It was that piece. And then I think on the go-to-market side it was like just push good billboards, like shockingly good compliance that doesn't suck too much, which got really popular on r/accounting, which none of us knew was a bucket list item in our lives, but when r/accounting likes your things, you're like, okay, something worked. And then the lived experience is just like you can feel like you are going as fast as you can, and you should in fact lean in further and like push harder.

Parts of that are true and parts of it are not true. But again, in the vein of like, you're only as good as the last thing you shipped. You're like, great. So, you know, what are you — what is the agent? You have all this data in a system of record. Fine. What the heck are you doing with it?

I think cognitive dissonance. Like, you've got to hold two things in your head, right? One is the like — look, I think at the fullness of time, an 80% growth business with 80% margins will like be good, and actually be better than like over the same time period — run it out long enough — a, you know, 160% growth business with 30% margins. You're like, one of these will like return more cash, right, in the fullness of time. But today the latter is valued at, you know, 3x, 4x the multiple of the former, 10x the multiple of the former, right? And so there's a part where you're like, 'Hey guys, everyone's being irrational here,' and then there's a — and like, this is a good business, and you have to keep doing things that make business sense and doing the things that customers want, which may or may not be, you know, token pricing models that put you more in the latter category than the former profile. And then there's like a very clear like game-on-the-field piece where you're like, well, if you need to be financed again, you're looking at investors today, many of whom are kind of AI maximalists, and are like — talk to firms that are like, 'Yeah, we'll invest in the labs and we'll basically invest in tractors in Iowa and like nothing in between,' you know, robo-tractors in Iowa at a lab and like everything else, and you're like, huh, interesting point of view. And then from a like talent perspective, right, like people — you know, you hire ambitious people who want to do things, and if it feels like they're not in the right boat, they're going to change boats, right? Like the talent war part is very real, too. And so you just kind of got to live with like, okay, in the fullness of time, I think this will all kind of sort itself out. And you have to live for the fullness of time.

So we do, and not just like, oh, and I also think of myself as like the best human in the world — like, not, there's probably some of that, but like when we go benchmark where we are from an agent-in-our-product perspective against, you know, quote-unquote AI applications, we have yet to find someone who is further along. Now you could be like, we're doing a bad job looking, is like, you know, the obvious critique there, but just we are like constantly going to the set of names you imagine when you think AI applications and generally finding they're not yet where we are, where an agent is doing most of the work. The agent — the other one of the things, it's chat-based, but there's like long-running agents. Our agent is like auto-generating UI on the fly because sometimes you want chat, right, and sometimes you want UI, but we just have an agent that's building UI, user can do something, comes back in the flow, keeps it going, like very much optimized around the like keep-the-user-going-in-the-flow loops.

You're definitely that, but in some ways you could do that in the past with just like monitoring and alerting. This is more like the Vanta product experience is now oriented around an agent that is bringing you as a user things and often saying, 'Hey, I went and did this for you. Are you good with it? Then I will go do it. Okay, great. The next thing I think I should go do.'

Someone just left your company and you didn't get them out of all of their accounts. I just like wrote a custom agent for you that will go do that. Do you want me to go turn this on? Great. Do you also want me to go, you know, remove accounts, access from these three people? Great. You want that running always?

Anyway, in the course of that, we end up using a lot of tokens. We have talked to our customers a lot about token-based pricing. And I think what we've generally heard is like people are real smart, but actually, and so if you try to charge them based on tokens, they are very quick to say, 'Oh, you've just marked up a Claude token 4x. Are you 4x as good as Claude? I don't know, let me go try it out.' And so then you're like — you actually put yourselves in a competitive position against the models. I think probably no application really wants to do — like we can talk about harnesses, but like you don't want to get compared. And so what we've seen on token pricing is like if you're trying to mark up at all, users are very smart and you will lose on that comparison.

We're eating the token cost right now.

We're taking lower margin, and honestly just like really concentrate on usage because like that experience that I just talked through where the agent is going off and doing things — we just like fundamentally believe that is a much better user experience. And we've got, call it, 25% of all of our customers in that sort of flow right now, and we're like, look, if we can get that to 75%, one, I think we like much better retention — like net retention there, you know, it's just like a much better customer experience. And then if we need to go sort out pricing later, we should go sort out pricing later. But like this is a usage phase and like a deployment phase of this technology, and just go nail that, and you can figure out commercialization after.

Yeah, this was something we started concentrating on at the beginning of the year. It was basically like evals. Yeah. For all the — and like task-specific or agent-specific evals from a product perspective. We call it all the Vanta agent, and it's one thing, of course, behind the scene it's like hundreds of agents that all have specific tasks and use tools and have computers and, you know, that whole setup that I think everyone's converging on. But in the beginning of the year, really invested in using our subject matter experts, the folks who like ran security and compliance programs at other companies, to write the eval frameworks and then eval their evals, and using tooling for that anyway. And so when we think about model swapping, it is — right, again, right now it's like mostly quality, it's not cost. I also think some of it — this is because we don't use as many tokens as coding. I think we're also all starting to like — coding is, and coding agents, lots of token use, maybe legal and like document drafting next, and then when you get to more of the decision-action world, which is where we are relative to coding, we just don't use that many tokens anyway. And so that kind of lets us like optimize for quality versus being as concerned about cost as some of the other companies.

I think everyone wants to get to outcome pricing, and if you actually go talk to a pricing person, they will tell you it's actually output pricing because it's not — but whatever. Like everyone wants to get to that. And like in another life I was a microeconomics professor, like I love this conceptually, like I love the like we get paid for outcomes and the alignment of incentives, love it. The hard part is just like what are the outcomes? And I think, you know, support ticket closed makes a lot of sense. Actually, to that — maybe differentiate outcome and output. As I understand it, in support, the ticket closed is an output; the outcome is actually like my Sonos now works, right? But even like the ticket closed, that is relatively unobjectionable. I think a lot of companies, included, are trying to figure out what's that like neat unit of work that we can all agree on. And you can say it's, oh, it's a document drafted, it's an alert closed, it's an account offboarded, and you can kind of do that. But then there's just so much cognitive overhead because you're like, I just named three things, I could name another 47, and then our user has to be like, oh, well, if I do this with the agent I pay this, but if I do it, you know — and you're just like, no one, no one wants that. I think everyone I talk to wants to get to outcome/output pricing, but it's really not clear how you get there. I think charging tokens themselves really puts you up against Claude. So then people try to obscure that by charging credits and having some like credit-token exchange rate thing, which I think again, users are smart and they're like, I see what you're doing and I see you've obscured it. Fine.

I think — okay, so we, in the vein of like eight-year-old company and eight-year-old codebase, it is so much easier to throw the coding agents at a small codebase than a large one, and that's like a token input thing, and they're getting better and better. But one thing we've spent a lot of time also investing in in the last year — and I know Notion has spent a bunch of time in, and they were like nine months ahead of us on — is modularizing parts of the codebase so that the agent can just understand smaller parts of it and understand it fully and then be really effective. Whereas if you chuck it at, again, an eight-year codebase sight unseen, it just like doesn't have the context window to understand everything and will do silly things. And so then you need a high-context engineer to babysit it, which is helpful, but like sort of invalidates some of the point. Companies have always had this problem. They've just talked about it as like, oh, when we onboard a new engineer, it takes them a while to figure out the codebase. It's just agents have made it like, well, great, now we want to onboard 9,000 new engineers tomorrow. And so it's just like heightened that problem. So I give ourselves a lower grade on that, just because we are like in the process of using agents and people to make the codebase easier to understand too.

Oh yeah. Like nine. Yeah.

Eight, nine. I mean, I think the like principles are still the same. Like everything is hard. People matter. You know, like all the tropes are still the tropes, but the way you do stuff should be quite different.

Kind of. Yeah. Yeah. I think there are just structural parts of some markets, and I think Bending Spoons is very good at, you know, identifying these, where you can put any entrepreneur in the world in that structure. This is kind of like the does-market-or-founder-win Andreessen Horowitz thing, and you're like, market wins. I think that is still true, and I think this AI technology shift has made some markets that used to look really good look really bad, and the best person in the world running that will still run into a brick wall. And I think there is a like founder-motivation piece where it's like you got to be in it and like push in this era, and if you don't want to do that, totally fine, but like the rest of the company will not, you know, self-organize to do so.

Just getting people to use it, which I think there's like a — and then, okay, so which sounds obvious, but it's like definitely use it yourself, build for your company personally, does not matter, just like understand where the models are, where they're good, where they're bad, what harness means. Like you just like — and like kind of do that at least every two weeks because it just changes so quickly. And I do think you have to have a like visceral understanding of what works and what doesn't, so that when somebody comes and they say we're going to fire all of our SDRs because I built one agent, and you can kind of be like, did you — you know, like where is that true and where is that false. Anyway, so there's like a be-in-the-muck, and then I think it's like, yeah, you want to get as many other people in that as possible. Broadly generalized, it's very black and white, but it's like, yeah, and some people just go do that and some people don't. If you'd asked me a year ago, you'd been like, oh, well, there's like some, you know, intrinsic motivation, and you know, kind of the people who aren't, separate problems, go deal with them. I think I'm slightly more empathetic now in that we have seen — I can give a specific example — but like very strong people kind of not go dive in, and you have to like nudge them more, but like try to figure out what's blocking them, and something can be blocking them, and you can get people into the muck even if they don't dive in initially.

So if you're a small company starting out on Vanta, great. We've got this like set of controls for you. You just adopt them. You maybe mess with them on the edges, but you're like off to the races. If you're a larger company, you clearly run a security and compliance program, and you come to Vanta because you want that visualized. You want the automation and you want the monitoring. You want the real-time dashboards. You don't want the like jury-rigged thing. Fine. Well, the hard part is you've got to get all that existing stuff — the controls, the risks, the data, the policies, the procedures, all that stuff — into Vanta. Classically, the way you would do that SaaS company is you're like, 'Oh, we're going to make an onboarding wizard. It has four steps and a progress bar and we will like give you confetti, you know, like you're going to do that whole thing.' We were setting out to build better onboarding this year. And the first couple product reviews, the team kept bringing onboarding wizards. Kept being like, 'Stop with the onboarding. Like, no, you know, go use an LLM. Stop.' But they kept bringing onboarding wizards. And this was like a motivated team, talented people. They cared and kept bringing onboarding wizards. And we finally got them. Anyway, the experience now they shipped and is working is it's basically Claude. It's like big canvas. Drag all your messy files in, drag in all your screenshots. We will like make sense of it, ask you questions, and then you are set up and off to the races, and it works really well. So like, why were these smart, motivated people bringing onboarding wizards? So you go out like finally, and the thing was they were like, well, we don't know if we can get the like drag-your-files thing to work. It might not work, and we know the onboarding wizard will work because we've built those before, and like we basically don't think we're allowed to fail on this project. And you come and you're like, 'Oh, that's the thing. Great. Well, like we're just gonna like bet that the LLM flow is going to work, and we will make it work, and we will hill-climb all we need to, but like burn the boat and just make this thing work.' And then they were like, 'Oh, okay, great.' You know, do you want a next product review tomorrow? But it was this like funny thing where you're like, 'I would not have guessed that that was their blocker.' And you like solve that, and they were like going.

Yeah. And it's not to say Vanta won't be, but I do think the — it's funny. It's like a — I think for me it's like, oh, should I adjust the pitch and be like, well, inevitably, you know, the baseline here is Vanta's 50 billion. The real question you should be considering, you know, is like, if you join, can you take us on a journey to like 250 billion? And you're like, should I just start saying that? You know, like again, like probably — like the answer is like probably not, but the answer is not definitely not. Totally. Because you're like, well, that is like — that is the pitch that people who work at Vanta are getting from other companies, you know. And then you're just kind of like, okay, well, do you — and I try not to like counter by, you know, being like, well, they suck. But it's just this like the market now is saying that so much, and so if you don't, you do seem unambitious.

There's like a Vanta principle, value, but principle of like do what it says on the tin, which is kind of like do what you say you're going to do. And look, you can put ambitious things on a tin. It's not that, but like don't overpromise and underdeliver. And so kind of what we do is like give some of that like here's what we do as a company, good, bad, and different, but just like here's the context. Now like let me talk to you about the business metrics, and we'll generally just show — as candidates — like show everybody everything. It's fine. They're good. Like we don't really want them to leak, but if they leak, it's not the worst. And then walk them through that and what we're doing and how that grows over time, and like try to root it in all of the facts and all of the data. And so in some ways it's like counter the vibes with like data and trustworthy vibes versus YOLO vibes, I guess.

Sometimes. No magic playbook here. I think if you go to the person and be like, what are you optimizing for, right? And like why are you kind of like why did you entertain this — but not in a pokey way, just in a like what's annoying you at Vanta, right? And actually one of these in specific, very strong leader, still at Vanta, but like it was basically this person felt like they couldn't make decisions that would put Vanta on a similar trajectory, and that would be their preference, but they're like, oh, but this new place is promising me like full decision-making authority on this trajectory. And you're like, totally fair feedback. What do you need to feel like you can make these decisions? Like just go make these decisions. Go. Like there's a money part and a FOMO part for sure. We've definitely gone up on comp. And you know, comp bands are like — people are going to hate that I — but like comp bands are kind of a joke now. You're like the comp band is whatever data you have is wrong. It is like what is being offered to these people in...

Oh, I think we should have way more comp dispersion than we do.

Total comp — it's probably like a factor of 10.

And it should — I think it actually should be higher. My general comp philosophy is like you never pay the top people enough, and you should keep — you should always try to be like very clear, you should always try, and you will never hit it, and there's a bunch of people you pay much more than their contribution.

Just like high agency, get done. Like it's in some ways — it sounds so milquetoast, and I don't know, like that's worth millions of dollars, but like yes, actually it is. Like a high-context person who understands the company and the customers and the domain, making generally reasonable decisions and sometimes bad ones, and then iterating on their bad ones and just moving is so valuable.

Accelerating. The counterforce is like when are we going to — or at what point will investors get more concerned about dilution and stock-based comp? And right, which I kind of like weren't throughout the 2010s, late 2010s. We had more of a like stock-based comp conversation as an industry in like 2022, '23. Now we're definitely not talking about it, but like that's the counter side. I think as if — without that push on like dilution, I think people just get paid more and more. That's probably right.

I've historically not cared, and sometimes even done things to like demonstrate my not caring, which were good and bad. I care about ARR and ARR growth, and like I do pay — I pay a ton of attention to those, and those are the metrics. I think I've now — I mean, a lot of — been through enough valuation environments, like 2010s, 2021, 2022, seen the like multiple roller coaster, where I just don't put a bunch of stock in that, or I used to not. I think the thing I care a bunch about that then will get me to caring about these multiples is like the sentiment of people who work at Vanta, and they feel like they're at a company that is growing and growing, and then both in general growing and then growing relative to their other opportunities in the market. There's a part of the market that is raising money every six months at like, you know, 5x the prior valuation, and like that's a real talent competitor. Yeah.

We have not done them historically, but I think that is the game on the field. If you're doing a tender every time, and you got to do them.

Totally. But that — in some — like my opinions about it sort of don't matter. Like I actually can have all the feelings I want in whatever direction about tenders. They are normalized, and people expect them, and they expect it as part of their comp. And if you are not giving it to them, you got to give them a bunch of other stuff to make it up.

Not at all. Not really. Which is again a very like founder-privilege statement, but basically it's like the endgame is like how long can we keep this going for? And look, like 99% of the big independent, you know, software companies in the United States are public. And so like yes, IPO in that sense. I don't have it as a bucket list item myself. It's more of like means to an end. Again, I think lots of people join companies and want the bucket list item. So, you know, founder-privilege caveat here again. But goal is big independent standalone company.

Underhyped is knowing the company and the customers relative to knowing the skill set. It is still really hard to hire, train, onboard, make effective people who join a company. Company marines make this better and easier and like put information at fingertips, but there is still totally something to be said about someone who's like been in a company, knows how to navigate the company, knows the customers, all of that. I'm at a phase right now where like we value that skill set and compensate that skill set more than like the vertical skill set of like you're good at sales, you're good at customer success, and would take a worse salesperson on sales skill who knows the Vanta pieces more. There's something in that, and I think especially as a lot of the labs and like fast-moving AI companies are like building out go-to-market teams, I think they're actually very much evaluating like you're a good salesperson. I think that's slightly off. And then I think as we think about building agents for all of this, the company context piece, the customer context piece is probably being relatively undervalued to like, oh, you're just good at — you are a good salesperson. The less valuable skill slightly today than it was four years ago.

Token-based pricing, low margins for the sake of having low margins, custom training models for the marketing value to be able to say we post-trained a model on our stuff.

I think if you go talk to the inference providers, and sometimes give them — depending on the provider — give them true CRM, they will say like, look, the reason to post-train a model is cost, and you might then — some businesses have that need, but there is not a quality reason to do...

There's like kind of a marketing reason to do it right now in this environment, and I think there's a lot of post-training for marketing reasons for investors and for customers, mostly for investors actually.

You are putting a stake in the ground of being a real AI company that customers, investors, like customers will notice. I think that's the primary one. I do think there's a secondary one in some use cases of like a form factor thing, and I especially with large enterprises where it's like you want to deploy this piece of software wall-to-wall that, you know, requires integrations and 17 people to sign off, and like, oof, that's a whole thing. Like, why don't you just give them a like model specific to them for this use case? There's like form... I think it's a semi-reasonable...

Yeah, we would need a bunch of data from that specific customer and then go write a bunch of eval data.

Yeah, basically.

Exactly.

Yep.

It can. I think I'm a skeptic in a couple of like, does everyone really want to be handed a model? Or there's so much around that from a user experience perspective, from a deployment perspective, form factor. Like it feels a little like, you know, in the social media or like our mobile apps when we like, we hadn't figured out pull-to-refresh yet, right? It's like kind of that. It's like there's something here. I don't think anyone actually wants to be handed a model the same way it's like hitting a refresh button. I don't know, that sounds silly, but like...

There's some version of that here. It's like we haven't figured out how this actually works, and handing models I think is not the right reasonable iteration, but like not the right solution.

I kind of think FDEs are crazy, or like I think FDEs are actually... I think it's a great talent arbitrage, the same way like chief of staff is what FDE often is, is professional services. But I think if you call it a professional services role, that's a very different talent profile than FDE in the current discourse. And I think you're not going to get the, you know, Harvard CS grad who's like high agency and wants to go do things and learn how to build a business to go sign up to be like pro-serve person number four or number 12 at a company. I think there's a real job there, but I think this like FDE wrapping around it is probably not going to stay. I also think it's like, right, the company that we all think does this well is Palantir, which I think they probably do. They have eight-figure contracts. There are some companies that have eight-figure contracts. I think we're using all FDEs in a place where we're, you know, there's like five- and six-figure contracts, and those economics probably are upside down. No, we're in an era of like 30% growth margin better, and so that sort of works, but like that doesn't feel sustainable.

There's definitely like talent war pieces. There was a time, this is more nine months ago, but it was like the, you know, joy to go around the table and complain about Cursor and like their taking of everyone. Like the Cursor of the moment is like, there's definitely that piece. There is a bit, I mean I'll take FDEs, of like, do you actually do this? Is it working? Like what do you, like where are you on this? I mean right now, you know, personal agents, which ones do you have, what are actually useful? When you think about the open-source stuff...

Yeah, I was with our customers in France a couple weeks ago, which was lovely. One of the things I was very surprised is a lot of the French software companies in Paris are using Chinese models predominantly. And I initially thought it was sort of a nationalism, maybe anti-American, you know, just something there, and stupidly sort of suggested that, and someone very quickly corrected me and said like, 'Absolutely not. We basically all switched to Chinese models when Trump closed [platform] off to non-Americans, and we just kind of realized there's a huge business continuity risk. We can't trust that if we build a business on one of these American models it'll always be available. So we stopped doing that.'

We think of Vanta as a security company. Started with compliance, but like I think the best version of compliance is proving the security you have. You've got to have good security. And we think we can and are moving into a bunch of security domains. It's sort of a platform pitch of like, look, we've already got the data, we've already got the intelligence via the agent, we can start stacking products on top of that and more security-focused products. As we understand the security of all these companies, the pressure on them to go prove they're legitimate and industrial grade is just going to go up. That's one of the founding theses of Vanta eight years ago, but it feels even more true now. Whether they're working with enterprises, governments, regulators, lawmakers, you just have to like prove your software is industrial grade in lots of ways, and that will happen more and more in more and more ways in the future. And Vanta is the thing that connects both sides of that, call it marketplace.

These models just are like so much more persistent than people actually. And so they will just like try nine quadrillion things the way a person would sort of give up after, I don't know, 9,000, right? And then in the course of that they find things and chain things together. And so I think there is a little bit, like a lot of the discourse is around zero days, and there's definitely some of that, these models are finding that we didn't find before or didn't publicly find before. I think actually though what's more so happening is these models are able to chain like 17 benign-ish or benign on their own things together and then like really find something. And like if you watch the OpenAI talk at RSA about Hugging Face, it's basically that, it's just like persistence and putting together things that on their own people would have been like, 'That's low severity, I'll fix it in 90 days,' right? Anyway, that update, which I think is tough, and we have to fight with machines because it takes what was like, 'Oh, that's important but low severity, again 90 days, and like I'm going to fix this other stuff first.' Like it just turns the prioritization on its head. And saying it makes everything critical isn't helpful because you're like, 'Well, what do you do then?' Right? But I think what that ends up looking like is you've just got to fix stuff as fast as you find it. And some of the prioritization does need to go out the window. But if you're fixing, you know, again, if you're fixing things at machine speed, you sort of don't have to prioritize. So that's where I think we're going to get to. But I think it'll be rocky as we get there.