Christina Cacioppo founded Vanta in 2018 to solve a problem most founders didn't even know they had: compliance. Under her leadership, the company has defined the trust management category, growing to over 15,000 customers.
Cheers. Cheers. Good to see you. Good to see you. Tell the Vanta story.
We help companies start or build out their security programs and then get credit for all that work through an audit, through a security questionnaire, a trust center. But it's basically do all the work to improve your security, and then go get credit for that with your customers.
All the Vanta billboards I see use the word compliance rather than security. What's going on there?
It is one of those where you're, well, "vitamin" and "painkiller." I think compliance is... SOC 2 is a word that no one knows what the heck it means until they deeply know, and then they want it. But they know that they have to do it this quarter.
One of the original founding hypotheses of the company is if you want to start a security company for startups, you should actually start a compliance company because your customers never ask you for security, but they do ask you for compliance.
Compliance is like the buying moment for startups.
Exactly, and then when you're going through that, you have to implement a bunch of... do a bunch of best practices, maybe buy some tooling. But even if you want to, you don't do it before that moment because you're doing the thing the customer wants.
I guess at a later stage, the buyer would be split, where security would be the CISO versus compliance would be the CFO, GC, something like that.
I actually think Stripe is a little, in what I see, which is biased, but different. In that usually, compliance is there's this unified GRC, Governance Risk and Compliance function, and that lives in the CISO org. That will centralize internal audit. It'll centralize enterprise risk. You put those teams together. Third-party risk. Those teams are all together in CISO org.
You're mostly selling to CISOs?
How did you... You woke up one morning, and you decided you were passionate about starting a compliance company.
When I was three years old, it was my first word. Yes, we joked in the early days. We'd never be able to pull that story off.
I don't know. I heard training businesses are good. I've heard more absurd founding myths. I think you could just go for it.
The real story is twofold. One, prior to Vanta, I worked at Dropbox. I worked on what at the time was a new product, Dropbox Paper. We were trying to take it to market and didn't take it to market as well as we could have for several reasons. One of which was... It turned out at the time, all the Dropbox contracts had written into them, "We're secure, we're compliant, we're pen-tested, we're XYZ." Our new thing had none of those. In order to talk to someone with a Dropbox account, which was 100 million people or whatever it was, we had to go through this process. This was Dropbox 2015, so the height of its Silicon Valley power, year and a half, 10 engineers, feature building, all that. That all happened. I was not smart enough to then be like, "Aha, startup idea." Instead, this...
Dropbox, what are you doing? This sounds bad.
It was about a year and a half later, just talking to startups and founders about security, trying to figure out, is there a company to be built here? How do you get more startups to care about security? How do they do it? Kind of came across companies that either did nothing for security but felt really badly about it sometimes, but still did nothing. Then companies that had a lot of stuff in place. The lot of stuff in place was because they'd gotten a questionnaire, they'd gotten SOC 2, because of an enterprise customer. That was the, "Oh, that thing." I remember that being crazy, and onerous, and terrible. But also if you do it, that is like, Pass Go, Collect $200. Huge benefit on the other side. It was the combo of those two things.
What you're describing, I think, is just so commonly the experience in founders who start companies. I mean, it was our experience with Stripe as well, where we had just run into the problem before. But it's funny, I often run into people in university who are excited about starting a startup. That's generally... Obviously, there's lots of sexy stories of people who dropped out of college to start something. That's generally a bad time because you talk to university students, often, their ideas for companies are pretty half-baked. Find My Friends.
Yeah, it's Find My Friends. It's like a college textbook exchange app. It's like the five apps, whatever.
Whereas so frequently, what happens is people go out, and they build successful products in the world, and they do Dropbox Paper, or they get some experience. It turns out there are huge markets available with problem spaces that most normal people have not heard of with things like SOC 2. But you have to spend a while seeing how the value flows in the real world work to discover those big opportunities. How do you feel when you go to YC now, and you have these founders who've dropped out and been like, "My passion is sales enablement." But they actually do know surprisingly much about it.
I mean, if you truly manage to learn enough about sales enablement to be able to field a strong product there, then good on you. I just think you're more likely to discover those areas after five or 10 years.
What stage is the business at now?
We have 15,000 customers. Our growth rate has actually quickened the last couple of years, and quarters, and months. It's been 60% annual plus for the last couple of years since that milestone, so a ballpark number there.
Yeah, it's a proper business. Yeah.
You go to market, it's all sold? All sales.
Yeah, it's just one of the blessings and curses I've had.
We call them the 'two founders on the couch.' But it's the two founders on the couch who are building their thing and someone ask them for SOC 2, and they're working on it on Friday night because when else are you going to do the thing? All the way up to at least one member of the Fortune 50.
I would have thought that compliance is very different for founders who have never even heard of it, versus companies who have a lot of existing teams here with opinions and stuff built out. How does that work?
Yeah, it is true. Down market, we're not quite TurboTax but I think that is the experience a founder wants. It's like, "This is high stakes, and I don't want to get it wrong, and I don't really know, but just guide me through." That's more of the product experience. Then the output is like, "Here's a set of controls, security rules you follow that are monitored on an ongoing basis." Because of that, you're constantly audit-ready, you always have everything in place. Great. That's the experience a founder wants, but the output is still a security program that's monitored all the time. Upmarket, especially when I'm talking to an engineer, it's more Datadog for your compliance controls. You're like, "I have my program, I have my thing, but it lives in a spreadsheet. It lives in Jira, custom Jira, it lives in something like that. I want real-time dashboards and visibility, and deviations, and auto-remediation, I want that world."
There's almost two layers to Vanta. There is what your controls should be, and then how the controls are monitored and implemented. Early-stage companies want both. Later-stage companies may want more of the latter.
Exactly. Then the tie to audit is great. In some ways, it's like a controlled direct monitor, you just pass the logs to an auditor. It's more complicated than that, but that's the base model.
Okay, you're getting to a question I had, which was, compliance at some level is not a thing you can just buy, it's a thing you have to do. If you actually talk about all these rules, I don't know about SOC 2 in particular, but for example, a lot of compliance regimes have this notion of doer and approver being separate for something. It's like the... Code review. Yeah. The nuclear submarine where you have to have the two keys turned simultaneously to launch the PR, I guess, in this analogy. Again, Vanta can't do that for you, you have to do this.
What you do is, one, for a startup, you actually just let them know the complete list of things they actually need to do.
I presume there's some, maybe you can talk about, there's some logic of only telling them the stuff that actually applies to them.
Then there's actually, how do you enforce, say, separate doers and approvers in something like code review?
Yeah, so for something like... This was the first thing we built, and we call it Test. It's like modeled after unit tests. You're like, turn each of these controls into a unit test. Pull from version GitHub, GitLab, whatever. Look at every pull request and check these fields or this thing, or run some logic over it. That is our test for the control. That was the first thing we built, were these tests. But tests are just ways to prove control.
You're just a test suite. You're the battery of unit tests for the compliance rules.
Why don't you just say that? Why doesn't your billboard just say that?
There was a niche audience in San Francisco that would be like, "Oh, now I understand."
Yeah, but I think for the 101 billboards... What's the controversy with your 101 billboard?
Oh, my goodness. How much do we want to do this? We had a great 101...
Great billboard, I used to drive by it every day.
"Compliance that doesn't SOC 2 much." Arguably, hundreds of millions of dollars in market cap attributed to that billboard. It was funny. That was just in the annuals of Vanta and startups. The person who came up with that billboard, very pleased with herself, as she should have been.
As she should have been, 100% right. Her manager at the time was very skeptical of that billboard. Are we negging our users? Is this okay? Are we too far over the line? Anyway, you can guess which one of those people is still at Vanta today. Not just because of that, but it was a good...
Exactly. Anyway, so we had this billboard. It was great.
For many years. For many years.
I used to joke that we've had it locked up for years. Turns out we didn't, and I'm an idiot.
Oh, you forgot to renew it? Not even. You should have had a little Vanta check for that.
It was like your domain, and you're just the thing you're not supposed to do.
It was slightly better, but still bad. The agency we worked with, one, we should have caught this, our contract was just written in crayon. We got a lot of people asking about our billboard. We introduced them to lots of startups. Some of those startups were also buying with that agency.
Wow. A startup you introduced to them went and took your billboard...
They didn't even do it on purpose. The agency went to them and was like, "We have this great inventory. Would you like it?" Then we found out.
Okay, that's rough. This is the drama of the compliance world. People will learn about Vanta in other ways.
We do like to market. Then going back to the other part of the question.
How does the layer work for... The rule book might be a thousand pages long. Compiling that rule book into the steps that are actually actionable for me, because I am not a farm, and so all the farm parts of the rule book don't apply to me.
Yeah. The initial... The initial version of it actually was... This was back when we were founders on a couch, was getting as many SOC 2s as we could. It was Salesforce, Slack, AWS, whatever, and actually opening them all and just comparing them and trying to extract what was common and doing it that way. That was the first cut. What we do now is, hopefully more advanced, but there's a bit of... Now that we have probably 30,000 audits completed, we can just go back and be like, "Okay, for a company that looks like you, and for this auditor often, what sorts of controls are there?" We have that input in. Then we can also layer in both for a company in particular and in general. You get questionnaires. What are the themes and the questions you're being asked? We just launched a new commitments product that ingests contracts and scans the contracts for things that are contracted. Then you can both pull them out and say, "Hey, this should be a control." And God forbid, something happens, but you're like, "What are my obligations to my customers?" You can just basically have all that structured data. But one of the most important things is they just want to see progression over time and increase maturity over time. You've probably had this at Stripe where you wanted to use some cool new tool that had no security posture and a contingent... Sorry, hack that, maybe. But one part of it was like, "Can you just walk this up over time and show me you're making progress?"
Yes. Is SOC 2 the main bible?
Basically, it's funny. We don't break it out by framework anymore because they're all just inputs into the system.
Sure. But ultimately, you need to comply with some specific thing.
Yes, most customers will come to us for that first. Number two is ISO 27001, which is, "Europe SOC 2."
European enterprises. If you're a European company selling to Europeans, you will start with that. If you're a European selling to Americans, you'll start with SOC 2.
I think our mapping is 60% or 65%. The additional ISO stuff is often documentation, which is a great place for software to help you out.
Yeah, exactly. There's less, please implement these six more rules.
Is it SOC 2 and its international equivalence, is basically that captures most of what you're doing?
It is probably plurality, not majority. We see a lot of growth... There's this whole host, "a thousand flowers bloom" of AI standards right now. It's the whole thing there. There are a bit of healthcare-specific things. There's the PCI piece, which I know you're very familiar with. There's like that.
On healthcare, is this... Which...
There's HIPAA, which is US law. You can just declare yourself compliant with HIPAA. You get to decide.
Yeah, exactly. The downside of doing that is if you do that and are breached, the fines are enormous.
That's the check, the semi-market check there. Can you describe the policy goals that something like SOC 2 seems to accomplish? You might say, "It's simple, it's just security." But as we know, there's many different facets to that. It could be preventing information leaks, or it could be preventing fraud against the customer, or it could be all these different things. If you were to stack rank, what is SOC 2 actually trying to accomplish at a policy level?
I would say it is trying to ensure customer data is protected. I think that is what it is trying to do.
Just to round out the point to your Java/JavaScript comparison is that Java was a very popular language before the emergence of web browsers with JavaScript. When they invented JavaScript, they wanted to ride off the Java halo as a need-to-use programming language, despite the fact Java and JavaScript share no exactly commonality at all. It was just good branding. What you're saying is that it's similar with SOC 2 here. Okay, so you're saying the primary goal is to ensure that the data that you are giving this company...
Your software provider, whatever.
Is adequately protected. Many companies have had humongous data breaches. Equifax was a great... It's a great easy version. Equifax, AT&T, I believe.
Kind of all of them. Exactly.
Assume every big company as a SOC 2. Yeah, but there's a difference between some data was leaked in some context versus in the Equifax case, "Sorry, we lost all of your data."
Exactly. "We didn't fix the database."
"Which data did you lose?" "All of it." It's very hard to find that moment in the Equifax stock price chart. What's going on there? As in, we think society cares, society should care. It's valuable to not lose this data, and yet it does not seem to impair what investors deem to be the terminal value of the company.
Yes. What are investors betting on? They're betting on, will anyone churn off of Equifax because this happens? I think the cynical but correct take is no. Sometimes, because you're like, "Equifax or Delta, am I going to stop?" I'm not going to stop flying Delta, especially 10 to 15 years into this where you're like, "Oh, another one. I'll add an eighth credit monitoring service." I think there is a cynicism there that is probably correct.
Yeah. The other thing that feels like it's changing in this ecosystem is that the costs of having data breaches are going up because Europe, in particular, is getting very strict about notifications, sometimes, fines around these breaches. How is that changing your world?
We also cover some of the data privacy standards. Your GDPR, your CCPA, there's, again, alphabet soup of acronyms here. Honestly, we see demand for that that goes in waves. It tracks what you expect. It's higher in Europe. I mean, Vanta, as a product, in general, does even better in Europe and better than you would guess for a California company that doesn't have European roots. I do think there's some cultural affinity and just seriousness there, versus the easy critique of Americans in compliance is like, "I'm just checking. You tell me where the bar is, and I'll meet your bar."
It's a box-checking exercise.
Exactly. Where it's just culturally something that is more important. "You can tell me where the bar is, I'll meet it, but also I have my own internal bar," which is more the European take. But we see demand for, say, CCPA, which is a California version of GDPR, go in waves. Right now, it is definitely... I mean, all the American regulation is at a total nadir, but it's down right now.
Well, it's down at a federal level. Is it also down at a state level, the energy around the CCPA type of thing?
Yes, it is, even with... It's not clear what California is going to do, and it could go multiple ways. I still think the national politics cast a larger shadow, even over a state like California.
That's interesting. Okay. Yeah. On the national side, current administration is very into streamlining regulation through automation and AI.
But that is the catchphrase that they deeply believe in and are driving.
I would have thought that this stuff is just too boring to be caught up in any reform initiative, or will this be streamlined?
I think there's very hard-working folks in DC, across the board, but in GSA in the office trying to do this. The primary lever they're using is FedRAMP.
Which broadly, I would think of as SOC 2 for the federal government. But basically, a very onerous set of both controls and requirements and documentation, in order to begin trying to think about selling to federal, and often state, sometimes even local governments.
I hadn't realized state and local governments also use FedRAMP as their...
There's state RAMPs. Yeah. There's literally Texas RAMP...
But they conform to FedRAMP.
Exactly. There is a part of GSA, and one team in particular led by a guy called Pete Wasserman, who is trying to modernize FedRAMP. They make a like 2020 version of FedRAMP where the current version feels a bit more '90s. It is unclear if he will get the traction to succeed, but he's fighting the good fight and he gets it.
But even if they do that, I find it hard to imagine the Society of Accountants just copying the new FedRAMP lock, stock, and barrel.
I don't think they will. I think you're just going to have even more divergence between these things.
It's like less control over... I feel like your life is the XKCD of we have 15 standards.
It is, and the answer is the 16th. Yes. That is also my answer when people are like, "Isn't Vanta going to make a standard? Couldn't you make a better one?" We have that posted on the office wall.
Because it is your life. Going back to the effects of the European strictness, it doesn't show up in the form of... Maybe American companies previously were looking to check the SOC 2 box versus now they're like, "Okay, it's really important I don't cross this quite strict European rule."
Right. Where they think now, and I think in the... It's funny, when we were starting Vanta—Vanta as what it is now today—in spring of 2018, which is when GDPR was going into effect. I was running around and being like, "Will you talk to me about compliance?" Everyone said, "Yes." I was having this great luck. Then I'd show up, and I'd be like, "SOC 2." They'd be like, "GDPR is a priority. Next, please." That energy has mostly dissipated, especially in the United States. I think because it's like... The theory at the time was GDPR is written by lawyers at a very high level. It's not a spec you can hand to an engineer, comically bad as an engineering spec. But it's fine. We will clarify that in court over the next 10 years. Now we're, whatever, seven, eight years in. It hasn't really happened. It still is hand wavy for an engineer, at least, to go implement as it ever was.
How does this work with agentic coding where the honest answer to the number of human reviewers to this code is zero? Yes. How should it work? Because right now it is like, well, somebody needs to be like, "I did code..."
I think right now it's like agent writes code, human or agent puts up PR, maybe human or agent reviews it. I think to a naive SOC 2 audit, you're like, "Those seem like two user IDs had that conversation, and so we can go forward." But it's more about having two throats to choke as opposed to we read the code of this ATM software and guaranteed that you didn't introduce a money glitch.
Yes. My interpretation from talking to folks is some of the impetus behind that or the primary impetus was insider threat. That's what you're preventing against, which maybe that's my macro answer is, just go through the SOC 2 controls and be like, "What are we trying to do here?" And be like, "Okay, great. Let's design for that." That may or may not be how it's written today. That's a good question because on all the insider threat stuff, having two reviewers is one way to do it. Does SOC 2 mandate a lot of other insider threat stuff? Because presumably, you should be logging a lot of activity, auditing a lot of activity. There should be processes that you have in place.
No. I think this is where actually you get to the technical standard made by folks who often aren't as in their depth in engineering, let's say. The controls for... There are a bunch of logging and monitoring controls that are suggested. One thing maybe we also mentioned, unlike PCI, SOC 2 doesn't have a prescribed control list. PCI is different, and it's like, "You must buy this tool, whether or not it's useful to you." I'm sure you have your own story with that.
SOC 2 is like, "You must log useful events and have a system to look at them. But it is up to you to decide what the heck that means," which sometimes it's helpful. I think for a startup that's never done this, it is unhelpful because it opens up a maze in a way that's just not great. That's where being prescriptive is part of, I think, Vanta's initial product market fit. I think it's actually largely due to that. In a way, that wasn't the plan. But I think it's like figuring out how to take that high-level guidance, bring it down in some places in a way that actually makes sense.
Christina and her team at Vanta are helping their users automate compliance, which for many companies is the thing standing between them and being able to sell to enterprises. We're very familiar with this category of products with Stripe, where you have a complex web of rules that businesses need to be able to comply with so they can move on to actually improving their products. Just take tax compliance and our product, Stripe Tax. As you start selling in more states and more countries, you discover there's thousands of rules you need to follow. For example, did you know Chicago actually has a lease tax, which applies to SaaS companies, too, since you're leasing out software? Stripe Tax is built to automate all of this. With one integration, it knows what you're selling, when and where you have to collect transactional taxes, and how to register and file on your behalf. If you want to sell globally without becoming an expert in tax rules, check out Stripe Tax.
The joking reference that everyone makes is they talk about competition from Claude Code for software products is, "You're not just going to vibe code your X in a weekend." But obviously, something like SOC 2 is actually the kind of thing that a Lens or coding agents are good at working with because there's just so much training data out there, and it's a codified set of rules. How is AI helping with what you're doing, and what is your plan for... You were describing some of the scale economies you have and having seen other customers, and I'm curious what the defenses are against... A customer could, in theory, say, "Hey, Claude, give me the plan for our SOC 2 compliance, make no mistakes."
That is a thing you can contemplate. I think you can do the very defensive thing, but actually, the very defensive thing is like, "Right." But this is a place where you don't want to get stuff wrong. Spending much time on it does not make your beer taste better. Is this really the place? Even if you really want to vibe code a bunch of stuff, is this really what you want to vibe about? Fine, whatever. There's all those rumors. Ignore them all. I think where the LLMs are excellent and a little dangerous in a build versus buy, but then we just need to build better experiences on top of this is like, "Hey, Claude, I'm going to give you a mess of data. You go make sense of it to me and get me ready. I'm just going to give you a bunch of AWS screenshots or API calls. I'm going to give you all my policy documentation. I'm going to give you my existing Jira workflow. Go turn it into a thing." You can go do that today. We are building... This is our onboarding flow or will be our onboarding flow, which is, "Oh, you have an existing program that's already running. Give you all the stuff. We will go map it into the Vanta world." Then in a Claude or an LLM, it's like, "Okay, cool. Now you get files in a folder structure that you then box share that over to EY and call that your audit." Fine. You can do that. In a Vanta world, the outcome is, now, hopefully, we have your program mapped and is observable and monitored and alerted. You have continuous control monitoring. You get your dashboard, you always know what is in place and what is not. Yes, you can go send a share link to your auditor here, too, and they can log in and see everything. We think about it as they have lowered the initial audit prep in a way inside, outside Vanta. Or if they're not inside Vanta, what are we doing? Building that. But the continuous monitoring piece. That you're not going to get out of at least LLM chat. You've got to go vibe code that whole system.
Okay, so you're saying that everyone just wants... No one enjoys spending time in SOC 2. Everyone wants to have been SOC 2 compliant as of yesterday.
You're saying part of the advantage here in this new landscape is you can just take a whole bunch of unstructured stuff and just empty it into the Vanta hopper and Vanta will make sense of it. We'll get widgets that... I presume part of the defensibility comes from the fact that preference amongst practitioners, in this case, the auditors that are reviewing your SOC 2 materials, is a very strong effect.
That is very true. Both QuickBooks and Xero, to some extent, really grew off accountants becoming familiar with those pieces of software. Companies could have opinions about what they were using, but those opinions were not that strong, and they were overridden by the opinions of the auditors. We have a version of that. I don't think it's as those effects yet, at least. But even again, we've seen 20,000 audits and thousands for particular firms, and so you're like, to control... We now do AI evidence eval. It's like, "Oh, you're going to provide this piece of evidence." We can just tell you, is it going to work for this auditor? Did you upload a cap picture? Did you upload a screenshot without a timestamp on it? You're going to get told to put the timestamp back on. Just that feedback loop. We already have, and we've thought about a lot about doing things for auditors as well with that. But yeah, it moves in the direction of an AI internal audit, at least.
It feels like the data you have of anonymized prior audits is an incredibly powerful network effect that cannot be replicated because it doesn't exist in the public interest. The AIs don't have it available to them. It's just private data. Stripe is an advantage because we have all the fraud data.
We know what a normal buying pattern looks like versus not. We can offer the best anti-fraud performance just because we're working with a larger data set than other people. Similarly, people are going through an audit, you can tell them that this will work and this won't. This is our Radar.
In a way that just you cannot do even if you decided to buy it yourself.
That's a big deal. Yeah, that's kind of cool. Where else have you seen that be useful in relationships between a software vendor and buyer?
Vanta core, we think of ourselves as broadly, and what we're best known for is serving software vendors, but people who make software and want to sell it to the world. Do you have security work? Is it secure? Then we have this third-party risk product, but it's basically, I think of you're an organization, maybe it's tech, maybe it's not tech. You're buying software, and you're going to go put a bunch of your customers' data in it. You want that software to be secure, because if not, you have to turn around and tell your customers, 'I lost your data, but it's actually our email provider. But you don't care about our email provider. You think it's me, and I've sent you the email anyway.' No one wants to send that email. There's a whole world of third-party risk or vendor reviews, and we built a product for those folks.
But is there a compliance versus security tension here as you're doing this stuff?
We haven't seen as much. What we have seen is the person buying software, they might work at a tech company and be quite savvy and up to date on those threats. They might work... One of our customers is literally a hotel chain. They certainly don't get compliance themselves because they don't build software, but they buy it. Fine. What we generally see is some companies will come in with their set of questions they want to ask. Maybe I will read your SOC 2, maybe I will not, but I really want to ask you questions one through 10. Some companies don't have that. Again, there's some part of the Vanta value proposition is, 'We'll prescriptively guide you.' We have a product principle just around reasonable defaults. It's like, 'Can we make the reasonable default questionnaire, in this case, something that leads into security versus compliance?' Or versus, 'Do you have a policy to X? Can you just ask them if they X, if you care?' That's a place where we've tried to, on the margin, nudge the buyer questions toward more security, knowing that will change the economic incentive of the vendor.
One of the big debates people are having right now is how AI productivity gains show up. I feel like you could have an opinion on this because we have filled out a lot of security questionnaires at Stripe, and I think we'd be very happy if the machines could take over from here. We really don't need to... We filled out enough.
We should talk about this, yes. Exactly.
One case you could make is the machines are getting quite good. They can understand what Stripe is and isn't, and can do and can't do. Every time we get a security questionnaire, AI can fill it out. The counterargument you could say is maybe Jevons paradox will show up and there'll be even more exhaustive and elaborate and custom security questionnaires. The total amount will increase. How do you see AI productivity showing up here in the effect?
The questionnaire is actually the great example because the questionnaires do that. We tried to build this product in 2018, actually before SOC 2, because it seems easier, actually, but the language models were not good enough. Then we tried again in early '21, and then BERT came out, and you're like, 'Oh, is there more?' It was not good enough. Now it is good enough. To that, actually, GitHub gets 92% of all of the questionnaires they receive answered through Vanta. You're not at 100, but you're like, 'It's GitHub. They have AI tools. They have Copilot. It's a lot.' We are absolutely seeing this. The models are definitely good enough.
Sorry, people ask GitHub to fill out security questionnaires before—
Used to fill it, exactly.
Using GitHub, and now they can mostly turn around and return those security questionnaires with 92% filled out.
Filled out. We have a human, but just it's review and approve. Then the confidence scores on prioritizing even for the reviewer. It's like, 'You can look at the section if you want, but you kind of don't have to.' Whereas, 'Will you really look at these 10.' All of that work, our product does that.
