It's our great pleasure to welcome Christina, who's the co-founder and CEO of Vanta. Christina, thanks for joining us. Vanta, you've heard of Vanta. You know, it's the leading AI-powered trust platform in the world. Yeah. Well, 15,000 customers in 58 countries.
Over 200 million of revenue, valued at 4 billion. Sequoia, Y Combinator, Goldman Sachs, JP Morgan as investors. And before this, and you're just getting started with Vanta, and prior to this, Christina was a product manager at Dropbox, then worked as an investor at Union Square Ventures, and then decided to start up. Christina, I'm going to start with your origin story, your founder story. You've talked about that, and thank you, by the way. I know you've been very gracious to spend time with our founders before. You have this incredible story of trying so many projects. You know, maybe just start with that.
Yeah. Where do I want to start? Okay. I think most founders, the first time they try something, it does not work. And in fact, even the thing they're working on, it didn't work initially, but that's often not the story that gets told. And I really realized this working at an early-stage venture firm and hearing the stories behind. So this is a long time ago, but like Tumblr, Foursquare, Coinbase, even whatever those companies, and knowing kind of the actual story and then the public story. And it's not malicious or no one lying or, you know, doing anything wrong. But I think the end effect is a story that often gets told is like founder had an idea, coded it one night, released it to the world, and 150,000 people used it, and that basically has only happened with Facebook. Like that has happened with like no other company. But one thing I felt was I felt like I had to be that person who like had the idea and then it immediately took off, and I didn't feel like I could be that person. I didn't feel like I could be the person who like tried something, listened to feedback, iterated, whatever worked. And so, one thing I feel kind of really strongly about in the Vanta story is like, I mean, on my personal website, I have a list of like, I don't know how many, two dozen things I tried before Vanta. And when you read them, a lot of them sound really dumb, and you like probably question my intelligence if you read them because you're like, she worked on a voice app for biologists. Like, what was the plot there? And I can both explain the plot, but like there was no plot. But anyway, one of the things I just like care a lot about is talking about those messy early days, both with Vanta and stuff pre-Vanta, because I think that is actually the best way to get more people to think they can be founders. So that's my box on that.
Double click a little bit. So 22 projects.
So did you leave Union Square Ventures, or were you trying these projects while you were...
Talk a little bit about that.
Maybe bring it to life. What were you doing? Were you putting stuff out there, trying it? Maybe just bring it to life because, you know, even Tim, who was a Postto founder, talked about the fact that they pivoted so many times.
So okay, I joined USV. It was when I joined, it was three partners and me. There, like, three more people got added to the firm basically. Great firm, lots of things, but like I had to kind of figure out my job. And so what I was doing mostly was running around and talking to founders, as whoever would, you know, let me get coffee with them in New York City at the time. And I think through that I developed this like, oh, as wonderful, I mean, as great as a job as a venture is, and it's intellectually interesting, and the USV guys are great, and here's nine million reasons why one should want this job, I kind of don't want it. And I was like very angsty and annoying about that, and like I still feel badly for everyone who had to deal with me at that time. But what I eventually ended up doing, took me too long, was I had saved my bonus from the first year, which was like basically equivalent to my salary, which was like a lot of money when you're 24. And I was just like, 'Okay, I'm going to leave USV.' Very scary. Not actually scary, but scary at the time. I'm going to not get a job. I will live off that bonus as long as I can and try to like live a little bit like a church mouse, like not spend that much money, and just teach myself to code and make up stuff. And so that's what I did for basically the following two years. And I knew myself well enough to know that I needed some structure. So what I did was, a friend of mine in New York had just sold his company to eBay. New York. eBay had opened this big office in New York. It was this giant beautiful floor. There were like, you know, it was like capacity of whatever 300 people, and there were like 20, you know, engineers in a corner. So I grabbed a desk. I sat next to them, and every day I would like get up and I would like walk to my office, and I would like sit next to my fake co-workers, and I would like, they would do their eBay work and I would like work on my projects. And I kind of like tricked myself into kind of thinking I had a job, or at least a structure of a job, because I acted like I did. I just like didn't get a paycheck. But I got kind of everything else. And that kept me, you know, because then you're like, it's not get up and like, I mean, there was definitely existential dread of like, what am I doing? Should I get a job? Like, am I going to amount to anything?
And you did this for two years.
Did it for about a year. That was about a year.
And that's the 22 projects that you went through.
How many went through that period? Probably that's the myth is that 22 went in there. Anyway, to kind of speedrun to the end, I did that for a bit. I ended up moving out here from New York. I did a version of this in my apartment. I got to the place where I felt like I could build stuff. But nothing was working.
And this is pre-AI. You were really learning how to code, right?
Yeah. Yeah. Yeah. But nothing was working. Like nothing. I really wanted to start a startup, but none of these ideas should have been a startup or looked like they were going to become one. And then honestly, like another set of anxiety started to set in, which was like my friends and peers were like having jobs and getting promoted and, you know, whatever, and I like, I had kind of not had a job. And so that's when I joined Dropbox and was like, I really want to make this thing work, but like it's not, and I feel like I'm kind of missing out on some subset of like how does one job, how does one work at a company skills that I should probably have. And so that's why I joined Dropbox.
Got it. And then how, just tell us about the, how did you come up with the idea for Vanta? Like where did that come from?
So kind of in the vein of actual real stories, two-part story. I was a product manager at Dropbox. I was trying to launch a new product, left Dropbox, trying to come up with startup ideas, and one of the kind of themes we were spending time in, because I was just interested in it, was security. And then I was spending time with startup founders because I knew startup founders. I like them. I wanted to hang out with them, whatever. Talking to startup founders about security, the broad theme was people cared and wanted to do the right thing. Like no one wants to not secure customer data, but when push came to shove, you build the thing your customers are asking for. And they're often asking for features. They are not asking for security per se. The thing they do ask for is compliance. They do ask for a SOC 2. They do ask for security questionnaires. And so I realized that compliance was kind of the security feature customers were asking for, and you had a way to be like, okay, great, go secure all this stuff and then get this thing that will go unlock a bunch, like I talked to a questionnaire, whatever, that will go unlock a bunch of enterprise customers for you, and like that's a good, that's a good pitch. And I think part of how I stumbled on that was just talking to founders and thinking hard, but some of it was because like I kind of, I like, 'Oh, I remember that thing. I remember how valuable it was.' Like, so two was...
You got your first 600 customers without a website.
How did that, like what was the thinking there and how did that happen? And...
So, in the early days, people thought we were crazy in a bad way because no startups got SOC 2s. So, very few companies, you know, again, Dropbox, I mean, Dropbox itself in 2015 had a SOC 2, but like any new product didn't have one. Big companies weren't getting these, let alone baby startups. And so the seed round pitch, which was like, we're going to SOC 2 all the startups. The seed investors would kind of look back at us and say, cool plan, but none of our startups get SOC 2s. Like, what, you know, how big is this market? How many SOC 2s are done in the world? And then if you like pin me, it's like, well, I did the math and it's like $10 million a year worth, and they're like, cool, so you want to raise $3 million to attract...
Nice meeting you, like let us know if you ever want to work at one of our portfolio companies. Like have a good day if people are polite, but like that was roughly the message anyway. And they weren't logically wrong, but I think the thing we deeply believed was like, no, if you make this thing easier and you drop the cost, the dollar cost, but really the time cost, you're going to open up a lot more market. And so that was the theory. And basically to loop back to your point, like that happened, and it happened fast. And what I mean is we found a handful of startups that would let us talk to them in the very early days, and it worked. And then they kind of told some people, or like someone would say, talk to, and I'd be like, oh, go talk to Vanta. What's Vanta? They don't have a website, just like email this address. And it was like a San Francisco word-of-mouth thing that started to develop. And the reason, and we kept, and it was like working, like we were getting inbound, like at some point on the order of like two or three emails a day, a weekday.
All organic, all word of mouth. And what we tried really hard to do in those days was make this kind of call-response. If someone says SOC 2, someone else should say Vanta. And the forums for that were like, I don't know if you have a, like, you know, the 15 Slack channel, the like First Round founder forum, the like Bookface, whatever, right? It was like those sort of things. And what we felt like was we had a secret in the Peter Thiel sense. Like everyone else thought we were idiots and this wasn't a market, and we knew it was a great market, and at some point the rest of the world was going to figure out and we'd get competitors. But we just wanted to run as undercover as we could as long as we could because you're like, 'Look, this is great, and having no competitors is even better.' And so that's why we didn't do our website. That's why we weren't splashy. That's why...
Oh, so you wanted to basically be like stealth, but like...
Or like stealth in that like...
Like you didn't want to make a deal about it, right?
No. And walk around and be like, 'We have a...'
Oh my god, we have 600 customers. You weren't doing any of that.
No, because you're like, somebody's going to be like, 'Oh, I can compete with that.' You're like, I would like you to wait six months on having that thought, because I will like do things for six months and be like that much further ahead.
So, it's very interesting, right? You made the market. Vanta made the market. I had two questions. Like, when did you know this thing was really working? Is it when the emails just start coming in?
Kind of. Yeah. Yeah. It was just like, the emails were coming in and people were happier with us. Actually, they were happier with us than they should have been. And to that I mean like one of our YC batchmates called the Vanta app the brutalist white website where they would log in and mostly get yelled at because they hadn't done things. And that was in fact the product experience, and yet they paid us $10,000 and were happy about the interaction.
Your starting ACV was $10,000.
Yeah. And so you're like, 'Okay, look, we should make the...' like there's, oh my god, so many like reasons to be embarrassed about this thing. And it's...
And did the product work well or it was just...
That's the thing is like, it didn't, it didn't, like the app itself, like type errors all over the place. Like there was like all of this stuff, but like you got to the goal in a way that was way better. And so I think it's one of those like, yes, at a macro level it worked really well.
It was the worst web app I had built in my life at that point.
Got it. And then now maybe let's move on to, you had PMF, right? All these emails are coming in, you have 600 customers, you don't have a website. Talk a little bit about GTM. How did you think about the next step? Because you kind of got to it much later.
When I started Vanta, I could not tell you what GTM stood for. Joking but not joking. So I read all the sales books, which is helpful for me, but I don't know if I actually recommend. And then I just approached all of this, what were sales calls, as like product feedback calls, you know. And it was like, oh my gosh, this director of security at Carta, someone remember this call in like 2018, would like give me a half an hour of his time, and like this is great. And so it was just, it was like kind, it was a bunch of discovery, or salespeople called discovery, and I would have called user research, but it was just a bunch of like, what's your job? How do you do it? Like, what do you think of this? What do you think of that? 15 minutes, like, I am actually very curious, and like, tell me about how you think about the world so I can have that mental model when I'm building Vanta, and then I will like show this thing to you and just be like, what do you think? Like, what works? What do you get? What do you not? And I think it was, I think it was a sales process, well, that I really liked because it was user research, and I like user research like deeply. I think it worked because I was mostly talking to engineers or like engineering-adjacent people. I think if I had been talking to another persona, it wouldn't have worked. And in fact, when our first AE came in, and he actually, he watched one of my calls, and I think two things happened in his mind at once. One was like, 'What the hell is she doing? I've never seen something like this. How is this going to work?' And then actually it was a one-call close, and he was like, 'Oh, if that worked and got a one-call close, I can run the table on this thing.' Which he then did. And so I just, I say that.
So you weren't really pitching at all. You weren't selling.
No, because I kind of didn't know how to.
You didn't know how to sell, right?
So, you were asking questions, you were being curious, right? Trying to figure out their problems.
I mean, I joke I would do like 27 minutes of discovery and then be like, 'Right, well, was there another purpose of this call?' You know, did you want an order form or something? And again, and it kind of, it worked just way better than it should have.
And is the company still approach it that way? Do you still have...
Not as much. I like, I wish we did more discovery than we do, but probably every team...
Right. Okay. Let's keep going. Let's talk about capital efficiency. You got to 10 million of revenue ARR before you raised your Series A.
Of course, that's today, you know, at 10 million, you probably raise at like 2 billion.
Yes, you're an AI company, especially based in San Francisco. Tell us a little bit about the approach that you took, what was behind it. You'd been a venture capitalist, you knew how to raise funding, you definitely knew how to go pitch now that you had all these customers.
Yeah, I think so. I mean, people would tell me that, and you're like, I don't know, I've never pitched, or you know. But I think the thing I did know was I had a, again, clear mental model of how early-stage VCs think about things. And joking but not, they definitely want to fund whatever, a million-dollar quickly growing ARR businesses. Even more than that, they want to fund $2 million ARR quickly growing businesses. Even more than that, they want to fund $4 million ARR quickly growing businesses that don't. And so, the best way to raise money is to not need to raise money, and kind of tell people that, but just in truth, right?
Best way to raise is not to raise.
Yes. You get to a scale everybody wants to invest.
So basically by the time you got to 10 million, everybody's like knocking on your door.
Yeah. And like the word had kind of gotten out, the word definitely.
So you didn't do any fundraising. You just, after your seed round, pretty much.
Yes. And there were two parts of that. I mean, the only cheat code on this I have, but it is a true cheat code, is we charged our company customers annually upfront.
Upfront. They pay you full.
They paid us 10K upfront. And so basically what that let us do was like, whatever, we bring in 20 customers a month, let's say at that point, right? So it's $200,000, if I did my math right, that was basically our payroll expense for the month. And so we just, we had our seed round in the bank, and we sort of didn't, I was like, we're making up, but like we kind of didn't touch it, and we just like take the new receipts...
Every month closing out deals, your payroll costs...
Basically. And so that's how we got so far. I mean, we could have kind of, on some level, could have kept going.
How long did it take from founding to 10 million in revenue?
Well, founding, we were very confused for a year and a half, but I would say like call it YC, your first customer was Jan 2018, and that round was done Jan 2020.
Terrific. Now, let's talk about, you know, staying on GTM, annual contracts.
Right. I mean, you know, you were making a market, nobody knew the category. Yeah. Now like, what drove that? Was it as simple as, look, we want to just basically cover a cost? Is that where you came from?
Annual upfront or just annual?
Oh, okay. So the upfront, no, the upfront was, so the annual part was like, it didn't feel like, at least at the time, this was a month-to-month thing in that you're like, you're going to like half get ready for SOC 2 and half not. Like that just, like the monthly, the monthly like, I'm going to turn SOC 2 on and off didn't really make sense. So that's why we did annual. And then the upfront was, I read a blog post at some point the prior five years by Peter Reinhardt, the founder of Segment, who I think he still has a gold blog online. There's like four posts, but they're all excellent, and it was a two-part series of finance and accounting for founders, and one part of it was just explaining different cash cycles and on receivables. I also didn't really know what the word receivables meant, but you just have this graph of like, okay, if you charge your annual contract, you know, and you get paid monthly, you get paid semiannually, you get paid annually, here's how that impacts cash. And I like, again, I didn't totally understand. I just knew enough to be like, 'Oh, one of those is way better than the other. So start there.' And then if you have to fall to semiannual to quarterly to monthly, go for it. But like, start with that one. And we did. And people just paid us. And so you're like, and then it just became a like, oh well, yeah, this is our standard. We only offer it. Don't, don't push me like, you know, don't try to push me over. And it's like there are things you can kind of manifest by being like, but it correctly or like truth, you're like, it is true on all prior contracts of which there are, you know, but on the sixth one, you're like, well, it is true for all prior. And just kind of keep that going as long as you can.
