It seemed like a puzzle, and I wanted to figure it out, and I wanted to kind of be good at it.
Christina Cacioppo's love of puzzle solving is central to her approach as an entrepreneur. She's the founder of a tech unicorn now, but her first business puzzle was a bit more humble. As a kid growing up in Ohio...
When I had multiple Beanie Babies, I tried to sell them on eBay and then like ride my bike to Kroger, which was our like local grocery chain, and get also get money orders and cash in money orders because like I didn't have a credit card. And I remember when PayPal came out and you got like $25 if you signed up, but I I couldn't sign up because I was, you know, 12 or something, 13. And it was just like I still I I never got that $25.
Christina's Beanie Baby business never quite took off, but now her B2B SaaS company Vanta has grown to a valuation of about $2.5 billion. This is Masters of Scale. Christina Cacioppo is refreshingly honest about the unglamorous work she went through before finding the winning idea for her company, Vanta. We started by talking about her first job out of school at the legendary venture capital firm Union Square Ventures and what it taught her about startups. Christina, welcome to Masters of Scale.
Thank you so much for having me.
You went off to Stanford for college and graduate school, and then you chose to go to a venture firm. Why?
Yeah, that was dumb luck. It was less of a choice. I think coming out of Stanford when I did, kind of late 2000s, clean tech was a big deal. It was, you know, this thing called Facebook that people knew about, but actually was a lot of clean tech. And VC was not something you did out of school. I just got really lucky, and the folks at Union Square Ventures in New York had written a blog post saying, 'Hey, we want to hire someone. If you're interested, like fill out this form,' basically.
Fred Wilson, famous for being an early blogger.
Yes. And you know, I mean, I respect a ton of things about those partners in that firm, and one of them is they like they build their firm off the internet, they hire off the internet, they do not hire off of kind of personal networks or anything. And but I first read that post and was like, well, that's crazy. Who's going to get that job?
Why did you why did you have that reaction?
Who hires like that, especially a VC firm, right? Like you know, and it just didn't seem real almost, or it seemed like the person who got that job was going to be perfect in all these ways I was not. But I kind of kept thinking about it, and it was I know two-week application period, and you know, literally on day 14, I just like, well, what you know, what's the worst thing that's going to happen? Like everything will continue as it is. And so I filled out the form, and I ended up getting the job.
Why wasn't VC a thing that you would do straight out of school? I think that it seems like VCs are supposed to provide advice and experience, both in making investment decisions and then also helping the companies. And like when you're 22, advice and experience usually aren't your aren't your comparative advantage of the workforce, let's say, right? But they wanted someone with your background, with your insight, because what were they looking for at the time?
Yeah, I think it was they talked. It's funny now because it feels so cludgy, but at the time it was internet native was the term, right? But it was kind of someone who grew up on the internet, quote unquote. And when I knew, especially because this was again early, you know, late 2000s, early 2010s, a lot of consumer social, a lot of new mobile apps, and it was like looking for early adopters and people who were, you know, would say, oh, you know, Foursquare, do I think that's weird because I'm just sharing my loc broadcasting my location to strangers, or is that great and how I'm going to like make new friends? And they were like looking for people who gravitated to the latter because I thought that would kind of push their their investment thinking and help them figure out what would be next.
What did you learn at Union Square Ventures?
Well, so much. USV, I think they're good at a lot of things. They are very, very like market and idea driven, and you know, like all investment theses, sometimes it works, sometimes it doesn't. But I think their their like fundamental worldview to me was if you pick or if an entrepreneur finds the right market, they will win. And I think it's different than other firms which are more like, oh no, it doesn't matter the market, it's all about the person, kind of the great person theory of investing. And USV was like all market and idea, and a little bit like wackier the better, you know, contrarian kind of overused, but I think they did really like things that seemed dumb. The what starts as a toy become serious, you know, the Twitter investment in 2006, USV was a great example of that.
Yeah. Why? I mean, 2006, just to situate it, right? Friendster had come, MySpace was on the rise, Facebook was just becoming a thing, right? Was was still at universities. It felt like there was a wave coming. Why was Twitter sort of a like what what's different about it? Right? You can post 140 characters on Facebook, and you can do more. So why does slimming this thing, you know, why would slimming Facebook down and then not really having a user base somehow succeed? And yet it did.
Mixed success, but yes, yes, with ups and downs, yes, absolutely, absolutely.
So okay, so you spent a few years at USV, and why did you leave?
I wanted to build things. I both loved the parts of the job that where smart people would come in and you could ask them lots of questions and they would like politely tell you everything they knew, and then you could go email more smart people, and like it just kind of felt like a racket and it felt wonderful. And I really liked those parts, but but then kind of after those conversations, I'd like, you know, go back to my desk and write an email about it, and it just felt sort of unfulfilling. I wanted to, you know, if I kind of believed in one of those ideas, rather than like writing the email to advocate for the investment or whatever, I wanted to go work on it. And I think I had a bit of, you know, back to the generally folks don't VC is not someone's first job out of school. I think I had a bit of like, well, why would someone take money from me versus Fred Wilson versus Matt Cohler at the time, right? If you want someone who has like earlier career but exceedingly accomplished. And so I kind of felt like, well, I I think I I want to go try to build something. And again, if I were pitching, I wouldn't want to take money from me. I would want money from Fred. So that also doesn't seem like a great path. As shiny and as you know, many people kind of seem like they want to do it, it it didn't feel right for me.
So a lot of people in that situation, when they sit down to write the email, would have that, you know what, eff it, this is what I want to go do. I'm going to email the CEO instead of email Fred and say like you should hire me, right? That's not what you did.
No, I I think the other part of it was like I wanted to learn to build products. Like everything was so product centric because it should be, and I had like a little bit of a programming background, but not really. Like I couldn't go make a website or an iPhone app. And I think to the puzzle piece, like I wanted to figure that out and wanted to prove to myself I could do that. It also seemed like actually just in emailing the CEO, very practically, like what do you do with a former VC kid like you? Maybe put them in business development, you know, but like a product manager just seemed like a better role. So what I did was I took my bonus, basically lived off of it for two years, so that was kind of my grad student living, and taught myself to code.
How'd you teach yourself to code?
The internet. I grabbed a desk at a friend's company, and so I would wake up every day and go to work, and I would like go to his company and like sit with his engineers, and they'd be doing their like work for the company, and I would like be doing my little blog tutorial.
But it was kind of this sort of fake structure. Like I again, I went to work five days a week. I like got up in the morning and I did that and sort of acted like I had a job even though I did not have a paycheck. And that structure was actually really helpful because you wake up in the morning, you know, and you're like, what do you do? And you're like, well, clearly you go to work. That's that's what one does.
Yeah, and I think there's a lot to be learned from constructing a structure, right? Like like building the routine, building the the ritual of it all, and it must have helped to be sitting with people who were coding professionally.
It was very helpful. I tried not to, you know, use everybody as my like Stack Overflow or as my like question asking, but when I would ask something, you'd get someone who's like, oh, I remember how to do that, like let me sit down and show you, and it was very nice.
Amazing. I mean, so it really was like you were you were funding grad school with this bonus, and grad school just happened to be a desk at a friend's office. Yeah. Okay, so so you spent a couple years doing this, and you don't go start a company.
Don't go start a company, which is upsetting. I'm kind of because nothing I was working on was worth starting a company for, and I was both like really, you know, you're like frustrated by this. And I think again at USV, I'd seen that actually starting the company isn't the hard part. That's, you know, shockingly easy. The hard part is like in year four when it's not really working, but you've raised this money and you have employees and you're still doing it, and like maybe you don't want to, but you're not really saying that out loud yet, and like that and that's actually kind of the median case. And I think the downside the downside isn't the thing, you know, becomes a crater in the earth, then just ends, like then it ends and you can move on. It's sort of that slog, and so I didn't want to work on something that I wasn't really convicted in.
It took several years, a stint at Dropbox, and a laundry list of misfires before Christina found an idea interesting enough to build into her own.
We built a couple things that just no one wanted, and then realized, hey, we're going about this wrong. We're building products and then running around and asking who wants them, which is generally very hard to do well, and certainly something I've like never succeeded at in my whole career of building things. So what we started doing was we said, hey, no more coding, no more building. You just go talk to people and talk to enough people until they start to say the same thing and you find a person with a problem.
And so I started talking to people in security because security just it seemed interesting, it seemed important, it seemed big, and kind of to your point, like I was really lucky and I could kind of go explore ideas, and if they didn't work, I could probably get a job somewhere. And some of the thinking was like, would I want a job in security? I don't know, that seems kind of interesting, but like let let's go figure that out. And basically through that process, kind of lighting a lot here, but like landed on the idea for Vanta and of using compliance as a carrot to get a company to start building out their security program early.
Yeah, it's really interesting. You all took the approach of really going out and just talking to prospective customers and trying to understand before you built a product was there product market fit, where was it best with the biggest total addressable market, and where you felt called to it. Is that is that that that's exactly it. And so was there an inflection point? Was there a moment where the lightning struck and you said this is what we need to go build?
Yes and no. No, and I think it was a gradual process over three or four months of just building confidence incrementally. And when I say that, it sounds like it was better every day. It wasn't, right? Like there were ups and downs in that, but the arc over three or four months was upward. And I think there there was a moment when basically word of mouth got out actually among former Dropbox employees that we were working on compliance, and we got this email from somebody that roughly said, hey, I really don't understand why you're working on compliance. That sounds like the most boring thing. We should like get a drink and talk about your life choices. And by the way, my company, my friend's company needs this, so like you should do it for them, but then you should probably figure out what you're doing with your life. And it was this kind of funny email because like should I be offended? But but no, right? Like somehow this person had heard about what we were doing, thought we were kind of off, but also directly needed it. And again, this was all word of mouth while we were just kind of fumbling around with startup ideas. And so there was something there that like that felt like market pull, or there's something there that again never happened in all the other things I had built.
Okay, and so just in a nutshell, what does Vanta do?
Vanta helps companies build out their security programs, demonstrate compliance, and manage risk.
And the the demonstrating of compliance and managing risk before Vanta was largely a manual process.
Super manual process. So that's why a lot of companies didn't go through it. But it was spreadsheets, screenshots, you tens of hours with engineers sitting with accountants going through like cloud infrastructure accounts to give the accountants confidence the company's security was set up well, and they could issue this report that then all the other customers would trust. And so it was this kind of very valuable exercise, but it just it was so costly in terms of engineer time that companies would rarely go through it.
Yeah, and the lawyers are then freaking out.
So so as you hit on this, it sounds like both a simple and complex problem to solve. Is that is that that's fair?
Right, I think on the simple side, you it sounds kind of obvious. You say, okay, well, you know, the company security program is probably already in engineering systems. The way we kind of demonstrate that security via these audits and attestations is really manual, but then the report at the end is very valuable, so that's why people do okay. That's that's kind of simple. I think these regulations are complex and nuanced, and there's they're actually full of gray, and the gray is kind of purposeful so companies can figure out what's best for themselves. But I think that ambiguity led lots of folks to look at it and say, oh, you can't automate that because what are you automating, right? You're automating this kind of fuzzy regulation. And we looked at it and said, hey, for a set of companies that are just starting out, best practices actually get them really far. If you make sure that the company is fulfilling all the regulations with best practices and get them to implement them, the company's more secure. The the process of, you know, kind of generating all the documentation you need is automated, and you can actually cut out a lot of time and cost, and they can get this report that then very helpful for their customers and building trust.
And my lawyer brain goes immediately to, oh great, okay, but are you then taking the liability if we get this if we get it wrong because we're using your software? Was that something that came up and you had to deal with, or not really?
Because the way these the way the standards bodies, the AICPA, the ISO standards body write the write the rules is the auditors audit what the company gives them, and so it's the company's responsibility to provide the information. The auditors just look at it.
Okay, so you you're you're effectively providing the structure and process for the company to put the data into.
Okay, got it. And and is market by market? I assume there were different compliance requirements, right? It's different in a highly regulated industry like banking or pharmaceuticals than it is in, you know, I don't know, a luggage business or something like that.
That's true, and we started with SOC 2, SOC 2, which was the closest thing that existed at the time to like default business software standard. It's not it's not it's not a law. It's more of like a de facto standard, but that seemed like the first thing companies get, so the first thing we started with.
Okay, and you're not a lawyer.
How do you become an expert on SOC 2 as you are an entrepreneur with a background in venture and coding now and being a product manager?
Sitting down and learning a lot about it, talking to a ton of people, reading the regulations, reading the attestation with people who know a lot more than I do, asking a lot of dumb questions. Early on, I I did look into getting my CPA. It was like basically an eight-year journey, and I decided I was had enough school at that point. I guess I could have had it now if I had started then, so I didn't do that, but I tried to do kind of everything but go and do that.
Gotcha. Okay, and so one of the things I love SaaS. SaaS is it's a fascinating business model, right? It's also really simple ultimately when you get to committed monthly or annual recurring revenue, and you can start upselling. Like your predictability in your business is just an incredible thing. It's also not something everyone intuitively gets. So two questions on that: one, as you're building a team, how do you recruit people in to come do compliance, which there may be some sexier things going on in Silicon Valley? And then two, where did you go find investors to support the business?
Yeah, so on on team building, we did have a lot of you're working on compliance, you like that? And I think I mean yeah, and I think what we'd we'd say is it's actually much more interesting than I expected. Even for me, you know, you get to touch all parts of a company and learn about them from their cloud infrastructure to how they hire people to all the kind of SaaS applications or like software companies using. It's just actually a very broad domain, and so to me there's lots of kind of interesting problems in it, and is actually much more expansive than you know just doing a task management software or you know document collaboration software. So there was some of that, and then honestly I think the other part was we were offering we had such strong product market fit, not because our product was amazing per se, or was amazing in that it let our customers achieve something they basically couldn't achieve on their own, and they were so appreciative and grateful because compliance does sit in this intersection of something you might need to do or really feel like you need to do and something you don't want to do. And so I found is like when you offer a service or a product in that intersection, customers tend to be so grateful, and more grateful than your product might justify at that point, but again you're like getting them to something they couldn't do on their own. And so I think it was just there's a lot of market pull, there was a lot of traction, and then our users were just so happy with us, in a way where objectively I kind of didn't think they should, or our product wasn't that good yet, which was true in lots of UI and UX and the website could be better and buggy and all of that, you know, it's painfully true, but like it it got them the outcome.
Well, and you you were also solving a real problem, and you know, good was done was better than perfect at that point, right? And obviously you're not done, you're you're iterating. It it it feels like you were kind of selling a new kind of product, something that that your customers hadn't seen before. What is it like building the sales channels for a product that is really new to market?
Yeah, it was. I think we got I think we got lucky in that because it was strange. In basically again the way you would get one of these certifications before for Vanta, generally you'd approach an accounting firm that has an IT audit practice and you talk to accountants and work with them. And you know, we were clearly not accountants, we were tech people. And where we first really had go-to-market success was selling to engineers and heads of engineering. And one of our early customers described us as like a babelfish, a translator between engineering and audit, right? And I think there was something kind of deeply true there, whereas our pitch to an engineer was like, hey, you want to go through this, you can go talk to an accountant or you can talk to some engineers, like which do you want, you know?
