If you found a money printing machine, you probably wouldn't tell everyone about it right away. Vanta figured out how to talk about security and compliance before anyone else was taking it seriously. Today, it's valued at $4.2 billion. Our guest today is the CEO of Vanta, Christina Cacioppo. Vanta and Christina help brands like Lovable, Snowflake, and Icelandair with their security and compliance. When Christina and her co-founder started out, investors told them, "This isn't a business."
The polite version, which everyone was polite to be clear, but was like, "This is not a product category today. This is like a fragmented service category." But again, not in like the cool 2026 way, like in the like, "That's not a business 2018 way. They're going to aqua-hire themselves to somebody in a couple months and like, they're not actually going to work on this. Who wants to work on compliance?" And no one totally said that outright, but that was like very much the vibe.
This episode is brought to you by Rippling AI, work AI tools that are more than just talk. Today on the podcast, we're going to talk about why distribution can sometimes matter more than product, how Vanta cleverly reverse engineered access to top VCs, and how the rise of AI agents has changed everyone's security needs, and how Vanta builds internally. Also, this has nothing to do with the show, but go Knicks. I'm Alex Conrad, founder and editor of Upstarts Media, and this is the Upstarts podcast, our weekly show about startup founders who punch above their weight and take on the status quo. Christina, welcome to the podcast.
Thanks so much for having me.
Vanta is a company that's been around since 2018. You started out with this sort of wonky security thing called SOC 2, right? How do you explain what Vanta is to a normal human?
Yeah, we help companies understand their security posture, so it's like layman's speak of like what security practices they have and they don't have and perhaps should have. So like, understand the lay of the land and then implement those security practices. And that's a bunch of hard work. And then we help them get credit for all that hard work with their customers who audit security questionnaires, but it's basically we help companies earn trust by doing good security and then prove that trust to their customers.
And so you went through Y Combinator, you started working with other startups, but today I know you also work with non-startup companies too like Icelandair, a bunch of healthcare companies. When we look at those maybe 16,000 plus customers who use Vanta, what is the sort of ideal customer or typical customer today?
It's funny, we actually thought we would start with like 50-person companies because that was like where the market for SOC 2 started back in 2018. And then I think because Vanta's guidance made it so much easier to get, cuz it was just here's the set of things you like, here's the security practices you should have as a small company. We started serving other YC companies. So we still call that the like two founders on the couch. So that's where we started. And then right now we have expanded into like kind of small and enterprise I would say. We have some much larger companies, but in general kind of like anywhere from two founders to like a couple thousand people. And at that it's a whole team that's running audit certainly, but like risk, compliance, security operations, like much broader scope and sense.
How did you get startups to see the need for this solution, to care about this? Because when you're building really fast, focused on day-to-day survival, you may not think, "Oh, how am I going to be audited?"
Yeah, so we also thought that would be quite hard and running around and I did some of this in the early days. Running around and being like, "Hey startup, don't you want to be more secure in general?" wasn't the best pitch. Like generally folks would say like, "Well, yes, I do want that, but when I go to the office and think about what I work on next, it's whatever the customer asked me for, not like what I desire." And so what we did was we leveraged SOC 2, which was this existing thing that at the time was like this like procurement gate or blocker. Would be like startup trying to sell to big company, big company would say, "Hey cool technology startup, but you're going to take a bunch of our data. How can we like be confident you're going to do reasonable things with it?" And the answer was either like get on the phone with them, be like, "I went to Stanford, and I am a good engineer, and I worked at shiny companies, and like you can trust me." And this whole song and dance. Or the answer was basically get a SOC 2 audit done, which like shorthand for that is like do a bunch of work, have a trusted third party come in, verify you did the work, have them write it up, and then send that PDF to everybody else. And so like we were just like, "Hey, founders, we'll help you implement a bunch of security things, and then that PDF will come, you'll get that report, and you can go use it." And so think of Vanta being the way you get SOC 2.
So it's like a painful questionnaire that you might have to fill out versus weeks of phone calls.
But that questionnaire would be manual and really time-consuming and something no one really wanted to prioritize, right?
Yeah, and it'd be painful and manual cuz it was like, "What encryption standard do you use on customer data?" And you'd be like, "Oh, I can't remember that off the top of my head. Let me like log into the AWS console and check." You know, and just repeat for 500 questions. And, you know, encryption standards don't change that often, but some of the stuff did, and it would just take all of this time. When you're doing that, you're just like looking up facts in a database somewhere, right? Which even pre-LLM felt like a very silly use of like an engineer's time.
Obviously AI is going to change some of that and already has, and let's talk about that more in a bit. But I guess early on, I'm curious was it really just the time saved and sort of the headache removal that made Vanta valuable?
I think it was actually like founders and early-stage companies could get something they couldn't get otherwise. Really? And like could they go get a SOC 2 without Vanta? Totally. But it would take, you know, 18 plus months, it would probably cost 50 to 100,000 dollars. And so the Vanta at the time was like maybe it'll take 3 months. So, down from 18, and it'll cost you all in $25,000 down from like 50 to 100, and like you can have your new engineer do the work instead of your CTO. And so, there's that combo of like overall time, dollar cost, and like CTO time. You couldn't even done this before. You would have just punted it off and like kept doing questionnaires. And now you can get to call it the like the Monopoly like, you know, past go and collect $200 card. That was kind of what a SOC 2 was without the you didn't collect $200. It was like past go and enterprise procurement. You could like go to the next stage. It was like that Monopoly card.
When you think about sort of what you guys were doing behind the scenes to make that happen, was it a tech unlock?
In the early days, we actually did a bunch of scoping work and strategy work basically to convince ourselves we could build automation for all parts of a SOC 2. And we got ourselves confident on that, and then we had to go build it. And in the process we wanted like intermediate validation, so we'd like work with customers. And the pitch to our customer was like, we will get you through this audit. Some of it we'll be SOC 2 for, some of it we might be not, but we promise we will get you through. And our customer, they're like, great. I don't really, you know, again, I'm paying you for the outcome. I don't really care how you get there. That worked behind the scenes. Again, we had folks we were like both building things, and then there is one or two GRC experts like compliance experts on the team who are running around and doing things manually in the background.
And we weren't charging. Like, now we would call this a like forward deployed engineering motion. It was 2018, so we didn't call it that. We just like mostly didn't talk about it. And investors would be like, aren't you a services business? And we'd be like, no. Anyway, we should have just called ourselves forward deployed engineers, and maybe we'd be like valued at 10x what we were.
Palantir had those, but it hadn't become this moment yet.
And it was, I think it was seen as like, oh, you need those, not today where it's like oh, you have those? Maybe we should add a zero to your valuation. Right, which is like a little, you know, anyway, it's changing of times. So, there was some amount of like fake it till you make it. But, by fake it we were like running around scurrying behind the scenes like doing the work manually. And I draw that contrast cuz I think there've been some newer and now more defunct entrants to the space that may have gotten popular on Twitter in the last couple of months where it was fake it till you make it but also just like don't do the work. Like people are not compliant and you're not running around and doing it. Which is just a contrast how we ran things in the early days cuz we figured if we want to be a compliance company, if we want to be a trust company, we've got to actually like do the thing we tell people they're doing. And again, maybe it's our software, maybe it's not, but that's our problem, not the customer's.
That is one interesting place where this AI moment has kind of changed the startup paradigm. It used to be fake it till you make it was sort of what you're describing, which is maybe it's a more manual
Just like me vetting people for my Upstarts events by hand, checking LinkedIn accounts. Like hopefully we don't do that forever, but at least we are vetting the people. And I think now there's this fake it till you make it, which is let's vibe code or use AI to sort of approximate substance, which is not what you were doing.
It's not what we were doing. It's not what we were doing today. And I think there are spaces in which you can do that. I've never believed security, compliance, trust are spaces in which you can do that. You're selling an outcome that is high anxiety and kind of morally laden. When you've like got that combo of things, you've like got to do it all the way through.
We'll dive into it more later, but at the highest level, where would you say AI has been the biggest difference in how you guys are thinking about your sort of back end or what that value prop is for the customer?
Yeah, we're reorienting pretty much everything we're doing around an agent that understands GRC generally, but you know, the models do that are like aggregated sense and anonymized sense of like customer patterns and data. And so, for example, it's like we've seen over 10,000 startups' security programs, and we've seen them mature. And so, it's just like our agent knows what at every stage, like what you might want to do next? What are your peers doing? Let's slice it that way. Constantly teaching our agents more tasks and skills to use here with the idea that most teams cannot hire a compliance expert or a security expert. And then if they do, that person is like very quickly snowed under with work. And I don't think that job will go away, but I think to your point, those people's jobs have a lot of check the security questionnaires, draft the policies, track people down to see if they did their training, nag the engineer to fix the thing in the cloud infrastructure account, deprovision the account. So, it's just like all of this like manual work that is not additive or like risk-adjusted. And it's important and it needs to be done, but we want to give those folks and engineers this agent that can go do all of that so they can think at kind of a higher level. It's sort of the like agents doing tasks, not jobs framework, right? I think these jobs will still exist. I think they'll just like have very different tasks in them.
Now, you mentioned GRC. I know what that is cuz I've written about Vanta before, and I should disclose that we have partnered with Vanta on a few events, which has been really fun. For people who are totally cold here, they're learning about this again for the first time, redefine GRC.
Yeah, so it is this like old-school acronym for governance, risk, and compliance. And it's basically this bundle of three pieces, where governance, think of is deciding what it is like what security practices your company has and what you're following. Risk is being like what are the risks and what should we do about them? And then compliance is like, okay, given the kind of philosophical governance pieces, given those risks, how should we think about guarding against them and implement what security people call controls and normal people just call like rules you follow? But it's like the bundle of that. And so in a larger company, they might have a GRC person or a GRC team. A smaller company does not have that and this often falls to an engineer who is like Googling or clawing like what does GRC mean? How do I GRC? Yeah, yeah. Like literally. And I think to your AI point, it's like the Vanta AI agent can be there like how to GRC. That person knows their business, they might know the tech stack much better. The agent knows GRC and the combo creates like much better security outcomes for the business.
When you were growing up, did you think to yourself, someday I'm going to run a GRC unicorn leading startup in the compliance software category?
Definitely. We used to joke cuz like some founders can do the like when I was five, I wanted to put, you know, people on Mars. No. No, when I was five, I did not want to be a GRC person. I think and sometimes to a fault, like one of the through lines across my career and kind of my life is like I can just, I'm someone who can be interested in lots of things and this is both a great skill and a great detriment at various points, but I think I got, you know, 8, 10 years ago now, really interested in security on the internet. Just seemed big, important, unsolved, competitive. Like there were a bunch of like getting worse. The more we were worried about security, the less we would trust software and I'm like a, you know, like I think software can, I still think in 2026 software can do great things for the world. We have to trust it to do it and like this burgeoning security threat, anyway, just started to like learn about all of that and then through that kind of got to compliance and very much initially was like, who, you know, again, who wants to, who dreams of working on compliance? Like who ever thinks they're going to do that? But then kind of realized like, wait, it's actually just kind of misunderstood. Like, it is seen as this like nonsense tax checkbox BS, basically. And it can be that, but I also think it can be the way you get credit for all the security work you did. Cuz unfortunately, like no one wants to like read your, you know, vulnerability scan that has zero results. Like, no one cares, right? But when it's kind of rolled up into something closer to the business, that's when this stuff starts mattering. And so I thought of compliance as like the output of good security, and how you communicate that good security to your customers and regulators and board. And like, that is valuable and interesting.
You were at Dropbox working on products there. And I think the lore, at least, is that you kind of see the problem first-hand at Dropbox. Is that okay, you see this problem, you think, "Oh, this is actually kind of interesting." Was it sort of obvious then that you should build a startup there?
No, I wish. That's like the much cleaner story and the much more like founder prestige story. It's not true. I think the like meta take is like it was like prepared mind, like ran into the problem at Dropbox, and then heard compliance, heard what she had to do, like ran screaming from the room, like did not return. Like, don't want to work on that, doesn't sound helpful, not going to help getting product market fit, like eject. And then flash forward like a year and a half. And again, in this like going and looking at security, I started to hear about compliance again, and I kind of remember it as like, "Oh, that was that like terrible scream from the room thing." But people keep bringing it up. What was that again? And so, yeah, it kind of, it's like the more complicated and real story. There are these two parts. There was like, know enough about it to kind of remember the words and have a place to like think about them. And then 2 years later, like run into it again and go much deeper.
So you were initially more interested in sort of wider security issues.
Which is ironic because you're being pulled into those today, right?
Really satisfying, honestly.
So, when you start the company, did people think this is too small a market? Okay.
Yes. The polite version, which everyone was polite, to be clear, but was like, this is not a product category today. This is like a fragmented service category. But again, not in like the cool 2026 way, like in the like, that's not a business 2018 way. Maybe talented team, shiny backgrounds, but like they're going to acquire themselves to somebody in a couple months and like, they're not actually going to work on this. Who wants to work on compliance? And no one totally said that outright, but that was like very much the vibe.
Now, you get credit for taking an approach that is very popular, this lean startup approach where you reach 10 million in ARR and you have recurring revenue before you raise a big Series A funding round. I think you had a little bit of funding.
Yes, which you wrote about.
I guess to this idea that you reach all this revenue before you raise.
In hindsight, how much of that was necessity versus priority?
Priority. And I pushed it too far in retrospect. There was definitely the like chip on shoulder underdog like, y'all think this is small market, you're wrong, you know, y'all think we won't stick with this, you're wrong. Total there were definitely parts of that. But then there was also the like, oh my god, this is working and we are scaling revenue so much faster than we should be able to. Given those priors, given the fact that like I was selling initially and I did not know what I was doing and it was working. And that is like a credit to product and problem space. Then it was this, oh, if we go like tell everybody, run around Soma and tell everybody this is working, we will have seven copycats tomorrow. And while the copycats will come eventually and they did, would rather that happen, you know, six months from now, not now, so like we can get more of a lead. In Zero to One, Peter Thiel had this concept of like a startup secret. And it was just like, what's the thing you know that others don't that you can run on and it felt like we had one of those or something approaching that. It was like we know this is a great market. We know it's going super quickly. Everyone else thinks we're running down a dark alley. Fine. Great, you know, like we're not, but you think that while we keep running.
I remember now when we wrote, I was at Forbes at the time and we wrote about you getting backed by Sequoia, obviously very famous firm. I remember the story at least was that the partner there kept seeing Vanta popping up in their portfolio companies and was like who is this software that all my companies are using, right?
That actually we did realize that at some point. It was, we didn't play the game with him, but we did realize cuz investors would message us. Again, in the early days I'd be like how do you know we don't have, like how do you know about us? It was like oh you came up in two board meetings this week. The sort of meta game thing was like oh if we find an investor we want we should just go sell to all their companies. Cuz like that is how you do get that deal done.
Amazing. Amazing. I mean the VCs pull similar games so I think it's only fair.
Yeah, yeah, yeah. Right, if you understand their games you can like figure out the proportional games and
Measures and countermeasures.
There's a great quote you gave me in 2021 that I'm excited to share. If you confuse financing success with company building success, you'll only get one of those things.
Yes. I think that's deeply true still.
What did you mean by that and do you think it still applies in this sort of crazy world?
I think there's lots of folks who are like messing it up and are well-intentioned.
