Scaling trust to unicorn status with Vanta CEO Christina Cacioppo | TechCrunch Disrupt 2024

Yeah, I think with the caveat on this—a lot of my career stories, I've heard other people's career stories—tend to make sense in retrospect, but at the time you're just like muddling through and making the best decision you can. So all to say, if I make this sound good, I was muddling at the time. But I think I got out of school, was a kid who liked the internet, was kind of obsessed with Apple Computer in middle school, you know, all this stuff, and so kind of knew I wanted to do something in startups, but wasn't particularly qualified for like kind of anything.

In economics, yeah, yeah. Which is wonderful, and I love micro and econ's great, but like not obviously a great—you know, what role do you go into? And it's kind of like, I don't know, like a new grad who can hopefully do things, sort of. Anyway, and then a venture firm in New York, Union Square Ventures, had a blog, and one of the principals, the GPs there, Fred Wilson, kept this blog, AVC, and he blogged, and I read it, and he wrote this post about how he wanted a new—the firm wanted like a new young kid basically at the firm, because they had this wonderful person named Andrew who was moving on, and so they needed to like backfill Andrew. And I read that post and was like, wow, this seems incredible. I wonder who's going to get the job. Definitely not me. And like kind of went along with my life, and then...

I did not apply. It was like two or three weeks, and then at the end of those, I kind of kept thinking about it, and then, you know, was like, maybe I should—you know, I'm not going to get it, but like I'll send them some links. The job post was 'send us a couple links to your web presence,' and so like literally the night before the thing closed, I sent them some links and was like, well, now I can stop thinking about it because clearly that's a dead end here. And long story short, I got the job, which was probably primarily shocking to me. But it was less like—I, you know, I'm sure like VC sounds really cool and awesome and I don't know, lucrative or something, but like did not think that was me. Ended up at this firm that was five people at the time and really wonderful, and like great—Fred, Brad, and Albert are all wonderful, and learned a ton.

But I think I sat there and got to meet with founders all day every day, and mostly wanted to be them. And my job was great—like my job was like objectively wonderful. But I kind of didn't want it, and I grappled with that a little bit and was trying to, you know, figure that out. I was also a little...

Yeah, I know. I thought I was trying to figure out, well, is this such a me thing? Maybe just, you know, whatever. Anyway, I think for me one of the really helpful things on that was part of that job is you meet founders all day long, and like you see this, but there's lots of different types of founders. And that, at least at the time, the media narrative was not that. The media narrative is like everyone is Mark Zuckerberg, they've been coding since they were four, every—you know, they go into their dorm room, they make a thing, a billion people use it, like—and if that doesn't—if you don't do that, like you're not a founder.

Yeah, exactly. Definitely not TechCrunch in 2007. But anyway, I think the really helpful thing was just seeing how many different ways people could do it, and that helped a little bit with the like, oh, I could actually like—I could be a person who does this piece. That was a big part of it.

Kind of laugh, it's kind of—you're like, I'm done here. Yeah, again, going to tell the story in a more linear way than it was in reality, but the other kind of chip I had on my shoulder was I wanted to start a technology startup and I couldn't code. And lots and lots of people start technology startups and cannot code, and one can do this. But I felt personally I could not, because so much of my confidence comes from like personally just like feeling like I understand something. Other people like drive their confidence differently, like it's just a me thing. But anyway, so I quit USV, I took my bonus, I taught myself to code, I made a bunch of stuff no one has ever heard of or ever used, which is both fun and kind of demoralizing a little bit.

Oh, I do actually have a list online. The thing I started with was a book website, like it was supposed to be Goodreads but better, except it was Goodreads but worse because I like didn't know what I was doing. But that was actually my first project, not because I thought it would be a good business, but because like when I would go to my friends' apartments, I like loved seeing their bookshelves, and that was just like—I wanted to see my friends' bookshelves, and that was enough to push me through like learning the minutiae of, you know, CSS or JavaScript or whatever it was.

Yeah, I think there's a little bit of the arbitrage of the—like Paul Graham calls them the schlep businesses. But the—like it actually is very rewarding to work on something where people have to like do it, but they don't want to, and you help them because they end up being so grateful to you. So there's a little bit of that on just kind of like almost emotional level. But I actually think like we didn't start with SOC 2 and did not expect SOC 2 to become nearly—it's—that would become more prevalent, but it's become much more prevalent than even expected. The like original, I don't know, insight thesis was small companies don't do a lot for their internal security and security of their customer data, not because they don't care—it's common—but like it's not that, it's because it's when you have no customers or you don't have enough customers to stay in business, your highest concern is not securing your customers' data, your highest concern is getting more customers. And so like that's why there weren't companies that, you know, helped startups secure themselves, like all the security companies kind of start at a much bigger company.

All of that, this is a little bit of the econ background where you're like, okay, think about the system and incentives. And but then I was like, okay, well if you want like startups to care more about security, you need to tie that to the thing they care about, which is growth, revenue growth, customer growth. And so how can you like re—like kind of make a startup do things to help itself be more secure, but then reward it for that, right? Like how do you get more customers out of security? And I think compliance actually is that, because the first time you get a SOC 2, you open up a new market. The first time you go through HIPAA, you can now sell to healthcare companies. Like these actually are TAM expansion, revenue acceleration. And that's not to say like you shouldn't just like slap the HIPAA badge on your website and call it a day and start, you know, selling to healthcare companies. Like you have to actually do the work. But if you can couple that work to the reward of new customers, you can get startups to like do a lot more security.

It actually has, yeah. You know, like that was a thesis. It's funny, I a couple months ago for the first time in like five or six years looked at our seed deck from April of 2018, and it is like build a security company starting with startups getting SOC 2 and then building on security tools from there. And you're like, huh, kind of on some level it went faster than I expected, on some level it's gone slower, but like surprisingly yes.

Yeah, so there was a lot of like—at that point, could code. My co-founder could code very much, could code much better than I could. But we both built a bunch of things that no one wanted, kind of back to my book website, right? And so we're sort of like, look, we can—them hubris to be like, look, we can write, you know, whatever code we want, but the issue is like, does somebody want this product or this feature or this thing? And who knows? And our intuition has been bad in the past, so like don't trust that, like do the thing manually to figure it out and then go write the code. And so there were a lot of examples of this, but one particularly fun one were these emails where, to this day, does this, but we'd—you know, you can connect your G Suite account and we'd scan and then tell you, okay, who in your company doesn't have two-factor on their email account? You probably want them to have that. And so we would do that, and then I would wake up every Friday morning very early because for some reason I thought like Friday at, you know, 6:00 a.m. was the right time to send this email. Definitely wasn't, but anyway, and like manually go look up—and we only had like 20 customers, so we'd like manually go look these up and then write people emails and be like, hey, you know, Frederick, like Christina doesn't have, you know, two-factor on, you should probably like forward this to her. And send them off, and then we'd like look a week later and be like, okay, did the list change? Right? Like did the email work? Did it like drive better security behavior? And it mostly did. And then one morning I was like sleep deprived and I like messed up a bunch of the emails, and people actually all replied and were like, hey, your script is wrong, like your code is wrong. And you're like, no, I'm just—I need more coffee. But like at this point it probably should be code because like you read it, you looked at it, you thought about it, you realized it was wrong. Like I mean embarrassing, but like great signal that someone's using it, right?

That's frugality. We try, and it's not—I mean, we joke about, you know, Midwestern values or Costco coffee or, you know, kind of all these things, but the idea is not starve growth or like be stingy or be annoying. The idea is like very much invest in the places that drive growth, but then don't fritter away money on the things that don't. Which sounds obvious, but I think having seen a bunch of—a ton of startups over the last, I know, 10, 15 years, it's actually really easy to spend money on stuff that, you know, someone wants, it seems reasonable, you don't want to disappoint someone, but like it doesn't actually matter. And then I think if you keep doing that, there's like cultural implications. And so yeah, this all sounds like platitudes, I know, but I think it is a trickier balance. We try to strike it. I think we're more aggressive about what we spend on and what we don't than other companies. Maybe it's the right balance, maybe it's not. We'll know more in a couple years, scorecard will come out.

I mean, I think our offices are nice. I think some people at Vanta, if they were on stage and we gave them truth serum, they'd be like, the offices could definitely be nicer. The offices definitely could be nicer. I think relative to the heyday of your San Francisco tech office in like the late 2010s, our offices are like nowhere near that. You know, and I think there's a balance of like treating people like adults is like another frame, and like truly like adults, not like kids kind of. You know, we'll do food a couple days a week, but like food around get-togethers and like—or like team offsite or like we're together to drive something versus like—I mean, I worked at a place that had like three meals a day, five days a week, and it was wonderful, but like there probably could have been similar business outcomes with like slightly less Michelin-star chefs involved.

They are nice. I'll take them.

We did probably like the email story, like there's kind of versions of that story at different levels of fidelity for again six to nine months before we started coding. And so I think it was more of like an incremental get-confidence perspective. You know, there was a moment, again no code was written, like Vanta was all manual, where we'd worked with a couple companies, they seemed happy, and then actually we got an email from a former coworker that basically said, hey, here you guys have become SOC 2 consultants, really weird life decision, we should probably get a drink, and like I don't know what like your life seems like it's going well, but that's a weird career decision. But before you get that drink, can you come in and help my company get a SOC 2? And there's this moment of like that felt really good because you're like, okay, doesn't make sense, but like you're still asking for the thing. This is all word—like someone told you, like you were at a San Francisco house party and heard about it, you know, like there's like a strong word-of-mouth thing here, and it's all manual, and you don't care because you just want the outcome. And so there was something where you're like, oh no, like no, we won't do your company in a spreadsheet, but like we should start writing code such that you could like become a proper customer.

Consultants, and the consultants generally were, I think, one of the actually big advantages, where the consultants were accountants by training, and so we were going to startup CTOs and saying, hey, do you want to work with like a PM engineer or do you want to work with an accountant on your technical stuff? And that was a great choice to give a startup CTO.