To start, SOC 2 is the security audit every software company has to pass before big clients will touch them. Riveting stuff, I know, but stay with me because you might be surprised with how much drama hides behind Silicon Valley's favorite audit.
Go and like try to figure out like what do they, what did we miss? Shoot, we've been doing it for years. Like what do they know we don't? Oh, they're not doing it. It's like just don't do the work and give someone a compliance report.
My guest today is Christina Cacioppo, co-founder and CEO of Vanta, the company that turned that dreaded checklist into a $4 billion business. She got the idea after suffering through SOC 2 by hand at Dropbox, then spent a year and a half quietly building Vanta for a market that at the time barely existed. I'm Eric Newcomer, author of the Newcomer Substack. Let's get into it.
If I say SOC 2 compliance too early, people may be like, "What am I in for here?" Like, stop listening to this one. But there's a lot of drama actually we have I will ask you about. But before we get to that, just like I on the scale of just like craziness, where are we with the AI hype cycle? Like how wild is the behavior of your fellow startup founders today?
Pretty nuts. Also, the behavior of the investor. I don't mean to put this on founders. I think the founders, if you're going to give me the money... I think there's a like if you're going to give me this, why don't I take it? Yeah.
So you think like pretty nuts? What's the behavior? Yeah. What are you seeing?
I think the best comparison I heard about it was it's like crypto in like 2021 where there is a hype hype kind of it's like a hype hype hype and but like this is a good strategy because you can like it's also kind of a you get the capital, you get the people, you get the capital, you get the people, and then hopefully those people are also building a real product over time, which maybe they are, maybe they aren't, but that's a place where it could diverge from crypto. But the like hype hype hype round bump the stock price. I think that playbook is like happening now amongst some number of the AI founders.
Round upon round before products.
Yeah. But like the products could exist and if they do they could be very compelling and the round is a great way to attract people who will make those products and so again it's like it's not clear it won't work.
Do you make angel investments sometimes? Are you doing them right now?
I've just learned that it's either my best investments. I mean, this is a thing everybody learns, so it just took me too long. But like, it's the people I've known for a really long time or it's the problem domains I actually know. And when it is not one of those, I generally, you know, I think I'm a smart person and I actually just have poor judgment.
Are there people you've known for a long time and you're like, but that gives me the confidence not to invest in this company or just like sometimes that has happened? But generally, yeah, I think a sort of a friend where you're like they're very capable, but this idea I don't get it still like...
I'll do those. I'll do those. I mean, in some ways like that was Vanta's story. So, in some ways that's like and we got nos for that of like you seem smart, but like what the heck are you doing in this problem space?
Let's briefly give the context, not spend forever. I mean you came out of what, you were a PM at Dropbox, right? And so how do you get the idea for...
So the real story is two-part. It's like I was working on Dropbox Paper, which I now describe as Notion but better but worse. No one uses it now. Notion deeply won as I should have. But that product wasn't compliant, pentested, secure, quote unquote, in any enterprise procurement sense. It was secure in an actual product security sense anyway. And I was the PM who on the eve of launch learned that and learned what we would have to do to go fix all those things and we decided not to do them because it was just too onerous. We didn't have product market fit, seemed like a bad use of time, resources, etc. So that was not, I don't know, that was not like...
Not public, but it was 2016 Dropbox, so it was like height of, you know, sushi in the cafeteria, Chrome Panda, like Silicon Valley Dropbox. It was only later, two years, when I basically, I wanted to start a security company. So I was like literally walking around SoMa talking to founders about security and sort of realized lots of people wanted to work on security at their startup, but that wasn't what customers were asking for, so they didn't, and that's why there were no security tools for startups until their customer asked them and they'd asked for a SOC 2. And I think it was really like a prepared mind thing where I knew about this problem.
So your top is basically customers saying, all right, I want to make sure if you're my vendor, like this is, you have things together, give me some certification.
Yeah, and it's basically, it's like give me something a third party comes in and checks everything really rigorously so I don't have to do that work myself, I'll trust it. And like that makes sense. I think it was like the way you would prepare things, work with that auditor made no sense to me as like PM engineer, and so that's what we tried to fix.
This is a sort of pour one out for Dropbox moment. I know what, Drew Houston has stepped away as CEO, right? He just did or yeah, to I think co but like exec chairman and like co-CEO to exec chairman. Feels like the idea that you know Dropbox would take its great insight on cloud and like find a sort of next thing never happened and and Paper was obviously at one moment an effort of we're going to build like you said sort of a Notion ahead of its time.
Do you think it could have gone another way or what, what's your, how do you take stock of that? I think I mean in a like in an academic sense or could you have whiteboarded logical things that made sense that were adjacencies that could be built and worked?
A million percent. And there's a lot of that I think company culture and execution-wise. None of those things got off the ground.
But it had great people, like Dropbox had all these cool, it was like one of these great networks. So it's like oh all those people went on to be really influential.
Totally. Yeah. Town, I don't know if you, Town the AI agent startup just raised a big round yesterday, but like Gene Den and Tony wrote about like all of these folks were at...
So you have the right people but then you're like oh the culture couldn't have done it. Like how do you square that?
I think the co-, I think Dropbox had the blessing and curse of... so Drew was public about like he built lots of things before kind of finding a chair and Hacker News, but like that thing he posted on the internet and kind of a million people used it all the time and it was sort of, it was this blessing and that, and then that became a like, you know, whatever billion and a half revenue business and curse because it was like oh well we just think of smart things and launch them and then a million people use them, and that's the way the world works. And that was like so baked in. Whereas when that didn't happen, which also that like kind of never happens, there wasn't like a I think a product development muscle to push through that and get to something with product market fit. And so it was just constantly like new idea didn't quite work. We must not have been smart enough, but not like talking to customers, fig-, like had a machine...
Like there are businesses that have like new product development machines, right?
And I think again it was like in part because it was, I, you see this, I think the companies that develop those have first products that are good, clearly they got to that stage, but they're not these like I kind of don't have to do anything and I have a billion dollars of revenue products. I think when you have one of those it's way harder to build the muscle.
What was that first thing for Vanta that helped you acquire customers?
It was like, "We will get you a SOC 2. We will get you through that and we will not pay $100,000 and take a year and a half."
Because it used to be the domain of sort of more consultants.
It was 100% consultants. Yeah. Yeah.
And it was, and so that was like it, I mean $100,000 sucked and we brought it down to like 10 to 20. But I think the real thing was it'll take you three months, not 18. And you can put your high performer whatever engineer on it, not your like co-founder CTO. And it was that, that's actually what made the market work.
You're in a space that aspires to be boring in some ways. It's like no drama. It's like yes, you're good and safe. But it has some of the highest drama in Silicon Valley with this YC startup Delve, which I don't, YC sort of disowned, I guess. You know, there was basically this, it was interesting because it wasn't like reporting in the traditional sense. There was sort of like an anonymous, anonymous sort of dossier...
Yeah. Do you know who it is or?
Uh I have a theory, but I do not know. I'm quite confident they don't work at Vanta. Thank you. Not involved or the...
That basically says, you know, they're like pre-filling out a bunch of forms for their customers to make, to which allowed customers or suggested to customers that they should just sort of submit made-up stuff basically. And then the reviewers who are supposed to be third party were like, you know, pretty random and not doing a great job.
I think they weren't reviewing the whole set of things. They were, and I don't think you've, have you talked about this?
Not all right. So why outside of anti-?
And I mean it is a, it was a, it is still a meaningful competitor to you, right? Or did you feel their business impact? Uh, which, when they competing with you?
A million percent. Okay. Yeah. Yeah. Yes. Um, yes, especially among startup founders.
And so what is your view on it?
In this early stage automated compliance market, the dominant strategy is you have to build a bunch of stuff to actually automate and produce the evidence these auditors need. Dominant strategy takes a while to do, is you, you can also do it manually yourself. So the dominant strategy is you're like, "Hey, we're Vanta, but we're better and nicer and we hold your hand because they're too big and we're cheaper." And that is actually an excellent pitch and you can do it. And then people, it's a good pitch. So people will come to you, you will handhold them through. Hopefully you're also building things. You can get to $10 million in revenue on this pitch. Then when you hit around and then you can raise this big round and you can feel great. And then you kind of hit a wall because now at 10, at $10 million revenue, you've got a couple hundred customers. You've got a good pitch. So people are still coming in and you've got these hundreds of customers you promised this thing to that you are trying to do in a way that doesn't scale and you've got all this new business...
Because it takes time to deliver. Basically sell it before you built the capability to deliver it.
And so you can kind of get and then you kind of hit this wall cuz then you're like, okay, maybe you're a year in and people are like, hey, you said you'd help me a year ago. You said, you know, you better than Vanta, but like I'm nowhere and it's your fault, not mine. And you have and then you're like, oh shoot, I should build things. I should hire things, but also the new visit anyway. And you just kind of hit this wall for like a year.
And the YC and the culture are saying automate everything, like make it...
But there's also just like not enough hours in the day to like hire people and build the product and do the sale and I mean a high class problem in startups but like it's a real problem. I'm so confident in saying this because Vanta did a version of this, all of our like 2020, 2021 competitors did a version, like I've just seen this movie seven times. So we watched this with Delve and we're like, "Oh, it's fine that they're going to, they're playing this playbook, but they're going to hit a wall." They didn't hit a wall. Kept going. And then we would go talk to founders who use their product and rave reviews. It was like I don't have to do anything. But it worked. Like wait, what did they figure out? So we like go and we like try to figure out like what do they, what did we miss? Shoot. We've been doing this for years. Like what do they know we don't? And then sometime last year we're like oh they're not doing it. It's fake it till you make it, but not in the sense we did where is like fake it until you're building it and do things manually along the way and do your best. It's like just don't do the work and give someone a compliance report. And so what we found was they were a ferocious competitor because fake compliance is a way better product experience for a founder than real compliance. It's way easier to do fake compliance than real compliance. And so if it's like it's way less, it's actually no work and slightly cheaper. It's a great pitch.
What great pitch. So when you're selling to like who care or like who is the person that cares about the SOC 2 brand, right? Or it's like it's like I'm a startup selling to Amazon. Amazon's looking at just that I have SOC 2, I'm looking at who did it. I'm looking that is Vanta's SOC 2 or like what, what is Amazon doing when they're analyzing where does the actual, whose reputation, who has to care about reputation here to make this decision.
So like 10ish years ago in Amazon, I don't literally them, but it was a like oh you've done SOC 2, that feels pretty good and it was cuz it was like it was in part the things you had to do but it was in part just you had the organizational acumen to like do the whole thing, like it was just kind of a harder thing to do and so it was almost just a general proof of work. Vanta and others have made this very easy and SOC 2 is I think now it is less a oh you must be a pretty competent organization, it's like you did the thing great now. So often for these big companies now it went from being most of the security review process to just the first step amongst many and what often the enterprise procurement teams have done is being like look you have to talk to, to talk to us and we know you can get one, don't, don't give us any stuff about it being too... Um, now we're going to go ask you for seven more things cuz it doesn't hold quite the weight it.
So, is that an argument just for Delve then? It's like whatever, I just have to check the box like they don't care.
They're still reviewing. So, we had those debates of like is, is this just, you know, you like think like an economist and you like draw those forces. And so, we had those debates and what we just, and you're like, you know, should you, should we do this? You, you know, we decided not to in part because I think while that is an excellent experience for a founder you certainly lose credibility with enterprise procurement, you also lose credibility with like mid-market and enterprise security teams and if you aspire to serve both markets you cannot do this. If you aspire to just serve founders, we were actually like maybe, maybe this works, we don't want to play that game. And then the thing that changed was someone in March or published a, I don't know, 70,000-word anonymous deeply researched very online investigation into all the practices and that just like caught fire on Twitter for a week.
And how much of your business is SOC 2 right now and how much are you trying to make Vanta an overall stamp of this is like a safe partner?
So we actually don't break it down by standard anymore, but I would say so alone actually very little now. Obviously or like not maybe not obviously but often it is the entry point for an American startup. Yes, that is a first thing. But if that startup stays alive, they're adding on different frameworks. They're adding on different product areas. And one switch we made over the last four years is talking much more about the product in general and its feature set versus just a SOC 2 um kind of for, for the reasons you imagine right now. There's lots of ways to get a SOC 2. We can quibble about quality, but to your earlier question, the dominant brand is SOC 2. It's not audit firm SOC 2 or even Vanta SOC 2. While I would like it, SOC 2 has a ton of brand stickiness itself.
And for SOC 2, do you also use outside auditors? Like is Vanta giving, why doesn't Vanta just give the stamp instead of outside?
For SOC 2, you can't, you basically you can't audit your own work.
Oh, because you're helping them do the work.
We are helping them do the work. Yes. So, we have always worked with outside auditors. Again, early in the company's life, we had all these debates and had, you know, it's like, why can't we just be the auditor? Maybe we, you know, get some friends to start an audit firm. That sounds good. And we're basically like, it sounds good in the short term and that looks terrible in the long run and it kind of doesn't pass the front page test and so don't do it. We've had competitors who've done all like have the friends start it, have the former employees start it, whatever. But we've just been like that's, that, that doesn't, if you're playing the long game, that will not work.
And, and so just to be clear, do you think Delve behaved unethically?
Yes. I think they told their customers we are implementing security practices for you and they were not. And I think they, or rather I don't know, the Substack suggests they knew the auditors they were working with were not rigorous in looking at all of the things they should and in response to knowing that sent them more business.
And now I've said okay we're going to try and clean up our auditors maybe a little bit. Um, have they gotten away with...
I, I think no. And just like I mean I know what percentage of their, you know, call it February customer base Vanta has, um, which is...
You had a lot of customers say oh no redo it for us or...
We're in the process. We did it, we did, but just like those days, I mean like so much new business, there was just like immediate exodus. And so I don't, you know, just I, this seems like not the brand to try to rehabilitate in the space to try to do it again. I think those founders could go build something else very successful in another space.
A very different company, one that likes to do everything. Rippling is now running to what, I don't know. Have you seen them in the marketplace?
We actually, I mean we certainly saw the announcement. And I think they are, I mean this is not, I think everyone thinks they are aggressive and ferocious and not to be underestimated. We haven't seen them much yet, but we are, we understand they are aggressive and ferocious.
I want to like zoom out and like just talk security for a minute because I mean AI seems like it could be sort of a total nightmare for security. It, it empowers, you know, every rogue actor in the world with, you know, intelligence to fire up and create voices to, you know, so many new vectors of attack. Like what do you see and what are you recommending like that the startup world does with this sort of like new AI vector of attack?
Yeah, I think it's, I, I think I mean maybe to state the obvious. It's going to be really interesting and fun on some level, but security overall is just this, one of the things that drew me to it is this kind of cat-and-mouse game where both sides are, are quite smart and sort of an ongoing, you know, competition. And I think these models, well, we can talk about whether they will, you know, send us all into like UBI land and make us all potatoes or something. They seem, you know, quite good at finding vulnerabilities in code at least like as a discrete statement. And that is something we will like all have to grapple with. And so I kind of do subscribe to the, I think even if you are like an AI maximalist, security companies, cyber companies, more important in the future, not less, AI is like this huge tailwind for them. And I think actually to his founder point, I think founders will have to care about this earlier in part so they don't, nothing happens and, you know, they don't become a bad Twitter headline, in part because I think enterprise procurement teams are going to push on them because enterprise procurement teams or enterprises get the how worrisome this is. They will push it on procurement, procurement will push it on the founder. So I think that's the other vector whether or not the founder kind of intrinsically thinks about this.
The AI of it all. How much do you find like leverage for your own business?
So much. So much. So much. I think twofold.
As someone to be clear who started this conversation being like, "Oh, the AI hype is out of control. People are..." I just say that to contextualize for the listener who's AI skeptical that this is coming from someone who sees some of the overexuberance.
Yeah. I would say like in the market. I mean, also, but like in the market. Yes, some amount of overexuberance is a, is a nice word for it. Also, I think parts of the tech are real and I think it's getting, and the parts that aren't, some of them are getting better very quickly. So, I think betting against the tech getting better is rather silly. It's like betting against San Francisco a couple years ago. Like rather silly bet, but yes, I think a couple things. So, one, we see a tailwind and we've seen a bunch of acceleration in the business just because there's more startups being created.
So some of it's just customers, customer creation.
Exactly. You know, like everyone cites, but it's the best we have like this publicly, the Stripe Atlas stat of twice as many companies founded in January 2026 as January 2025. I'm like will they all survive? No. But like 2x on your baseline's pretty good. So you see that a lot of the compliance workflows are pretty manual and workflow based. And so there's just things we can automate now we couldn't have 2, 3, 5 years ago. And that is very cool. There's product experiences we wanted to build, we couldn't, we can now build. Great. And then the other part of it is while exciting, AI is also very scary especially to enterprises and like what are the models doing? What are the agents doing with what data? What the heck's going on? And that just like that scrutiny is like right in Vanta's, those questions are like right in Vanta's wheelhouse.
Are you having engineers come to you and say, you know, like potential customers and say, "Oh, I'm just going to ask Claude, like make me SOC 2 compliant."
Yeah, we've done that, too. Yeah. Yeah. So, yeah. And we actually every, what are we do? Probably once a month, we'll like try to rebuild Vanta with Claude from scratch. Just not that we're probably going to use...
Just so once it's possible, you know, or...
Exactly. Exactly. You don't want someone else figuring out. Exactly. And there's a bit of rebuilding software is still hard. I think the places where at least internally we've seen we are much more likely to rebuild software and do it well is when the process is fully internal. It is just, it doesn't touch a customer. It doesn't touch a partner. It doesn't touch an auditor. It doesn't touch a regulator. It's super internal. Those are the places where like we've experimented. We have some stuff. We've done some stuff. I think in talking to folks those are the places. I think when it touches regulation or audit or a place where like you want to be correct all the time, that's when like yeah maybe you can build some version but like do you want to maintain that and ensure that...
Right, because when you worry about regulators and compliance it doesn't matter just what the output is, it matters how it got there.
Exactly. Whereas when it's just internal, an ticket that your team has filed to get access to BigQuery, whatever, pick your favorite cloud, whatever, pick your tool. Yeah, like that.
What are, what are sort of the next stand-, what are the stand-, what is the next SOC 2 or what are the other compliance standards?
