Compliance Is Your Competitive Advantage — Christina Cacioppo, Vanta | Enterprise Ready Conf 2024

Great to see you. Thanks for having me.

I was going to say, yeah. Yeah.

It doesn't get easier. You just go faster. It is always hard.

Yeah. So there's like I think all good founding stories, there's two versions of it, both true, and you tell them kind of in different measures. The first version, which is true, was I was a product manager at Dropbox trying to launch what at the time was a new product, Dropbox Paper. So like Dropbox's version of Notion, but it's worse. About that time, too. Anyway, and ran into the product because it was separate from the rest of Dropbox, had none of the security or GRC functionality or like platform teams from the rest of Dropbox, and I was told on the eve of launch like you can't launch because you don't have SOC 2. And I learned what it took and like literally ran screaming from the room. Like sometimes they tell the story as like and then I was brilliant and I decided to found. That's not what happened. I was like, this is insane. You're telling me like this is Dropbox in 2016, height of its power. I have to give up the like 15-person engineering team for a year before I can tell if I have product-market fit. That seems like a bad trade-off. Anyway, I do think though that was like an important part of the story because there was like a little bit of prepared mind. Like that's when I learned what like SOC, that was my like SOC what moment.

And then having left Dropbox soon a year after that or so, and really for kind of just like reasons I can't explain, like naive reasons, wanted to start a security company. Seemed really interesting. Seemed like something I wanted to learn about. Was like, look, if this doesn't work, but I spend you know 5 to 10 years learning about security, like I mean I'll be sad, but actually that's like not the worst outcome. I'll have at least learned a ton about something I care about and think is important. Hopefully it works. And so went around and talked to startups about security and generally found that while many people, it's easy to say startups don't care. I think they care. It was just really hard to prioritize because again like back to the Dropbox Paper thing, when you don't have any customers, it is very hard to be worried about losing their data. And in fact your biggest concern is not oh when I get customers how shall I secure their data. Your concern is how the heck do I get customers?

Right. And that was kind of dismal for a while. So there was like the wandering and the wilderness phase of founding a startup, and then found one company actually, the you know big company that was tiny at the time. It's a 35-person company in SoMa called Figma, which you may have heard of. And I walked in, I was talking to their head of infrastructure at the time, this guy Matthew. And I had my list of research questions, which is like, you know, how do you secure your cloud environment? And like, how do you think about employee endpoints? And by the way, I'll explain what an endpoint is because it's, you know, kind of security people use the word funny. Expecting him to say like, I don't, I don't, I don't. And Matthew in fact said, I do, like we do this, we do this, we do this, like here's all the tools, here's all the practices. And I remember actually just like almost closing my laptop and being like, who are you? Like why, you know, like I've, you're like the 10th person I've talked to and no one does these things. And his answer was like, look, we just signed a contract with Google, please don't tell anyone, big deal, again 30-person company. And as part and parcel of closing Google as a customer, they sent us a security questionnaire and it kind of asked the same things you just asked: how do you secure cloud environment, employee endpoints, like blah blah blah. And I had no answers to anything on that questionnaire, but that seemed like a bad thing to say to Google. So, I wrote answers to everything on the questionnaire and then I immediately went and did everything I wrote the answers to. And so, now it is done literally. And I sat there and was like, "Whoa, purchase trigger motivation." Like, you are now going to do whatever Google kind of wants you to hear and whatever Google thinks of as good security, you will do. And that is so different from every conversation I've had. So, that's the like second part of the founding story. There's always two stories.

Probably. Yeah. Three to five.

57 Post Street. You should stop by it. You can just like walk in.

It's great. Like a good cult. Yeah.

Yeah, I think two things in retrospect. One was honestly starting with former co-workers, people we'd worked with, like friends of friends. As much as that sounds like cheating, I mean, it kind of is cheating, but it was really helpful because there was a cohort of people where they're like, I kind of know you don't know a ton about this, but I also know you're going to like work really hard and you don't like to fail and I don't really have better options, so like sure, you know, but it's anyway, it's like you kind of had like that part of the Venn diagram. The other part of it, and I sort of mentioned it there, but the other part was we did not start with companies that had compliance standards, that had GRC or security teams. We started with founders who had nothing. And again they were, and I kind of distinctly remember the moment in mid-2019 when Slack started requiring SOC 2 of its vendors. And so it was literally founders that were like, I really want to sell to Slack. Like if I think if I put the Slack logo on my homepage this will be very good for me, but I need this SOC 2 thing. I don't know what that is. I don't know how to get it. You seem plausible. Like I don't like, are you going to knit me a pair of socks? Like I don't even know what's going on, but like I want this so badly and I know nothing and you know something. And I think there was also something to like that place of like very high need, very low knowledge about the problem honestly that also helped when the product was so MVP, you know, when somebody who did know things would be like this isn't for me.

No, gradual. I mean, there were like specific moments, but I think the product-market fit thing is more of a temperature gauge than a light switch. And then in retrospect, you tell the light switch story, but I actually the lived experience is more like not that, more I don't know, whatever the good version of a boiled frog is. There was a moment in the early days when kind of after the Figma story, we're like a little bit more kind of user research stuff going on, but we're sort of like, okay, we can both code and we have enough hubris to think we can build whatever we want. The issue we've had in our careers is we've built things no one wants, which is not fun. So let's do as much as we can prior to starting to like write TypeScript literally. And so we made early versions of Vanta in spreadsheets and then were kind of like manual SOC 2 consultants for friends' companies. And the first company we went to, literally the kind of hypothesis or the sort of test was can we make them a spreadsheet that they don't like throw us out of their office, you know, like will they, are we at all credible, can we give them a deliverable they sort of believe in and give them like a SOC 2 roadmap basically. And then that worked, and so we took it to the second company which was we actually honestly just kind of finded and replaced the company name like company one and company two. And that was a test of like can we standardize this, like if we give somebody else's roadmap, you know, to this other company, change a little bit on the edges but mostly not, can they tell. And that worked, and then we got this email from a former colleague that was basically like, hey, here you guys have become SOC 2 consultants, really weird, where did your life go wrong, we should definitely get a drink, and also my company needs a SOC 2. So like can I like pay you in booze basically to like go, you know, do whatever it is you're doing for my company. And there that was one of those, I mean it's not like light switch but like light switch moments where you're like, whoa, this person in network but like heard about this from someone else, like I don't even know, we could go track it down, but like they were at someone's house party on Saturday for some reason talking about SOC 2 and this came up and they want it, like that feels good, that felt really good. And so then it became a like oh we should probably stop the spreadsheet consulting cute thing and like start coding. And I think at the time we thought it would take, you know, a year or so to like turn a spreadsheet into code and they're probably more like four and a half years. Kind of misestimated that one. But that was one of the like early trigger moments.

I think yeah, I do think SOC 2 is incredible product-market fit. I talked about it as a product, but I think it was incredible product-market fit. And I think the thing that felt obvious when you really poked at it in 2017 was more companies would get SOC 2 if it did not take so much, if it wasn't so costly. And by costly I kind of mean dollars. Like it was probably you know 50 to 150k all-in then between a consultant and an auditor. But the problem was actually you gave up a lot of your technical team for a year. Like it was costly in terms of team time, but it was also when you talk to people, it's like, "Oh, yes, I know I need better. I want to sell to Slack or, you know, in order to sell to so-and-so, this keeps coming up and so, you know, whatever, like or you know, we're a 20-person company and we're still going to embark on this give up our CTO for a year thing." And so the thing that again I think we saw that was there but like no one else saw, which I'm still a little baffled by honestly, was if you made the easy button for SOC 2, a lot of people would want to press that button. And that's kind of what happened. I think as that happened, SOC 2 went from being we used to call it the like Monopoly Pass Go collect $200 card to the entry ticket, right? It was the first step now. You like must have it. All your competitors have it. And then now you need to go through security questionnaires. You need to go to separate vendor reviews. I also think honestly like a lot of like SOC 2 is not immune to the forces of technology acceleration and so as SOC 2 has gotten more prevalent and accelerated the pros are there and the cons which are very real are also accelerated, more common. There are some reasonable things in SOC 2, there are some things that are stuck in the 90s and less you know reasonable in a 2024 software like cloud software context, and that's all still very true. So like again, the highs are higher, the faults are larger. But it's kind of the same thing just accelerated and like blown out.

Yeah, a couple things. The plan was to raise a Series A at 1 to 2 million. Like that was the plan and there was definitely like a couple freakout moments where you're like oh my gosh we're never going to get there. I think then we kind of got there and I mean everything was burning, like everything was burning fires and you know they're the good fires, we have too many customers, we don't have the support for them, we can't find enough auditors, but also like everything was burning to the ground. It kind of felt like, like the lived experience was everything is broken. And we still had basically the whole seed round in the bank because we charged annually upfront and so some of it just like you're like, "Okay, if I need to go finance whatever, I'll assume I'll like basically dip out of the company for a month." Like that's not going to be, you know, like that seems like a terrible use of time. We don't need the money. We need nine quadrillion other things that like money can't really solve easily. We're also terrible at hiring. So, you might be like, "Why don't you hire?" We tried, but we were just like made every mistake in the book seven different ways. You know, so there was a little bit of like I actually feel remiss financing because oh my god I just need to solve the customer success problem by which I mean we had no CSMs and no customer success and that was very bad. So some of it was that, some of it was I got really lucky and started my career in an early-stage venture firm and so I knew the trick to fundraising is that the best way to raise money is to not need to raise money. And VCs in fact just want to fund businesses that don't need funding. And so you know what people like funding more than a million-dollar Series A is a $2 million Series A, you know, error our Series A, and then $5 million. And so there was a bit of like it's not like we had a window that was going to close. The window was actually just going to extend and it was going to get easier and easier so long as the growth continued. So there was a combo of those. I think also there was a bit of again at this point people still didn't know what SOC 2 was. Thought we were like you know I don't know twiddling our thumbs into the ground like this was not a market and we so knew it was and we knew there would be copycats. We kind of didn't want to go raise a big splashy round yet because we're like oh that's just going to invite a bunch of competition and so like let's hold off on that. I think I pushed that one in particular too far. But there was a moment there where I am glad we didn't be like oh we got to a million dollars in you know six months and you know this is a great business and we just can't fulfill all the demand. Because you're just kind of inviting competition then.

Yeah, I think got the whole roller coaster. I think in the early... Okay, it did not feel like it in the early days. In the early days, it felt like we were going as fast as possible, you know, like you know, I don't know, like where like you're on a motorcycle and like face pressed back and that's what every day felt like. And in retrospect, we were kind of lackadaisical, you know, and we weren't, we thought we were smarter than our customers in some cases. We definitely weren't. And so when the first like really good set of competitors emerged, one in particular was actually just really good at listening to our customers and hearing what they hated about Vanta and fixing those things. Which is an excellent strategy on their part. And there was a part there that like I was kind of, I was like hurt but it was kind of a self-directed hurt. It was like oh we've heard these things like we know these are pain points and we have not fixed them and like shoot what are we doing? So there's like that piece. Honestly I mean parts of it felt very unfair. Like actually that same company also took screenshots of Vanta and sent them to a dev shop in Mexico and got a product back copied down to the placeholder text. My childhood hero Sally Ride was in two compliance products at one point and you know like that just feels unfair but I think also on the roller coaster like everything or a lot of things are fair in capitalism like fair is not a useful concept. And so like that just doesn't matter. And there's parts that are annoying but like I think it's a deep reality and the most important thing is how you deliver for your customers and kind of you are only as good as the last thing you shipped. Like no one cares we were first. No one cares we like made up the thing and someone else copied it. Like does not matter to someone who is trying to get their job done on a daily basis. And I think internalizing that was kind of emotionally tough at times but also like real like it's reality if you can ignore it if you want but it like won't, you won't end well. I think it ultimately really caused Vanta to get way better at what we do. We got like way better at listening to customers, way better at not overthinking what they said or what we thought. Like we kind of had this like, we had a, at our worst we had a tendency to like overly intellectualize customer problems and our solutions and this just like got rid of that in a way that I think is actually very helpful. And just like a lot more resilience too. Whereas now when there's like you know this like you know kind of a new competitor slightly less often than there used to be but there's kind of a newer one in the last six months and you're like okay we've seen this playbook like you like know to act fast, you know what to do, you know some of the things, some of their critiques are halfway valid and we should like take the feedback and fix them and some of the stuff they're saying is just nonsense but like here's why we are confident it's nonsense and go combat that in the market. And I do think Vanta is a lot stronger now than we were in call it like 2021 when we were just more Midwestern about it. It was just kind of like people are being mean to us on the internet and saying untrue things like why would you even do that, you know, and like it doesn't matter. They're doing it like what are you doing next? And like in our case like hopefully not saying mean things back but like combating it in more productive ways. Yeah. I think especially as a founder, it just stings when you see like what do you do? Do you have any self-respect over there? Again, not a useful question. Doesn't matter.

Oh god. SOC 12. No, hopefully never. We started with SOC 2 again, not because it was the best thing out there, but it seemed like in 2017 it was the closest to the baseline reasonable standard. It was like the first thing companies got to though, so it was the first thing we started with. Again, very much pros and cons to it. But I think are like even more true today than they used to be. The idea was never to build a SOC 2 factory. Actually at times talked about it as a SOC 2 factory which is like a very demeaning way but some of that was because again like in the beginning we also didn't think a SOC 2 factory is very good business, turns out it's actually a surprisingly good business, but it was like that's not what we are trying to do. The idea was can you use the economic pressure motivation of like revenue growth and new customers to go drive a bunch of security practices into a company and then build those over time and along the way make the demonstration of those security practices, the audits, the questionnaires, not these like well I talked to an auditor six months ago and they wrote me this PDF and therefore you should trust our good security practices today thing which is like bad when you think about how software works but something that's real-time and continuous. And so anyway all to say we've made it for us really easy to add new frameworks and standards to Vanta because honestly it was because we didn't like, we'd have these prioritization discussions about like should we support TISAX, the German automotive standard, and we just get into these like prioritization conversations that would like drive everyone crazy. And so the strategy was instead how can we launch a new standard in four days and then if it takes four days we never have to prioritize these things, we'll just be able to do them. So we support about three dozen standards today. Added one actually, added anyone today. There's a team that just does that. Dry on the standards thing because yeah, when you're like, should we add TISAX or this other thing and then also trade it off against other product work and you're just like, oh my gosh, I don't want to sit through these meetings.