Christina, welcome. Super excited to have you here. Thank you so much for taking the time. Would love to learn about your journey. Actually, I always ask founders, why did you choose to do this? And actually, that's always very, very instructional. What led to it? What do you think shaped you to be a founder in the early years? Did you always know you were going to be a founder? And what led you to Vanta?
Yeah, definitely not. I think I had a lot of like people like me aren't founders for lots of definitions. I grew up in the Midwest of the US, which like kind of, I mean it's lovely when you're there, but when you're on the coast, everyone thinks the backwater. My parents were academics. I thought I'd be an academic. Certainly not like no one in my life did business. I didn't even know what that was basically, beyond like something on the news. And but I think I also wanted to be a founder, you know, but I just like didn't. Then there was like some sort of internal conflict that was like just below the surface, like I don't think I was bright enough to realize it.
I think the thing that really helped me was I got really lucky and out of school I worked at an early stage VC firm in the US, Union Square Ventures in New York. And I just spent two years meeting with founders, like 10 to 20 founders a week for two years straight. And just got to see lots of people do it. And I think that helped me like break out the like, oh, you can only do this if you know you're a business genius and you're a programming genius and you're, I don't know, from a coast of the US and like all these things I didn't see in myself. So
Talk a little bit maybe how did you converge on Vanta and like you know why this problem and were you looking for a while before you figured what you would build?
Kind of actually I really like this problem. I feel like I got really lucky. Two-part founding story and I try to tell the real one because I think so often it is so much easier to tell the stylized one where you feel like you know it's like and then I woke up and I was really smart and I did this thing which is like not how it is for most anyone who tells you that story, certainly not for me. But the two-part story is, first part I was a product manager at Dropbox trying to take a new product to market, now many moons ago. It was actually a startup acquisition so separate from the rest of Dropbox and the way we got our initial users and we're testing for product market fit because we were trying to do were from like larger Dropbox customers and I thought I was like the world's best PM because I was like going out and getting these early customers. Turns out I was not the world's best PM. I was in fact violating all of the contracts that Dropbox and these customers had, which the legal team very politely walked over to my desk one day and told me about and was like, 'You got to stop.' Unless you can meet the what's in the contracts and what's in the contracts is Dropbox is secure, compliant, you know, pentested, SOC 2, ISO 27001, this, that, and the other thing. Didn't know what the words meant. Learned what the words meant. Basically ran screaming from the room. Like this is where it'd be like the smart thing to do would have been like light bulb idea, you know, let me solve this. Not what happened at all. It just felt really silly, honestly, that, you know, here we were, we were trying to get customers. Dropbox had all these customers and yet we basically couldn't touch them unless we spent two years at the engineering team when we didn't have product market fit to go do that. Felt like terrible trade-off. So like end scene, no smart ideas.
About two years after that, had started looking into security and going deeper there and just talking to anyone who would sort of give me the time of day about security on the internet and was very interested in security for startups. It seemed like an obvious gap in the market. And then I realized the reason there weren't very many companies serving startups or security companies serving startups was because startups are trying to find product market fit, right? And the most important thing is growth and the most important thing is getting customers. And you're going to do whatever your customers ask, but they very rarely ask you to turn around and lock all your doors and windows.
No. So, you know, even someone who knows about security wants to do the right thing, you know, they'll still come and and it's like, I want to build what the customer wants. And that is generally not security until they say the and then they might say security, but really they're going to say compliance or really they're going to send you a security questionnaire or SOC or ask you for a SOC 2 and then a bunch of security practices can get implemented. And so it's hearing those conversations like remembering this horrible painful thing and then sort of just like falling down the rabbit hole of oh wow like this thing was terrible. It is but it is like it is meant for good. It is not just meant for FUD and terribleness, right? It is meant to have a company kind of build out a baseline security posture. Have a third party independent come in and verify that everybody trusts a third party. We all go along third parties. Like great system in theory. It was just the practice of how all those steps worked seemed totally stuck in the 1980s. So that was that was really the origin of it.
Actually you know it's very interesting one thing that you know I remember from the early days Mike Moe used to always say and you have just done it without realizing it. He used to always say the good founders can articulate it very clearly. And I never thought of the compliance and the security the same way you articulate it, it's very very good. And then by the way, so I was last night I was doing some research and I found something very interesting. It said basically that you did a bunch of manual compliance and security work before before actually starting to build and that's very unusual. You want to talk about that because you know I feel a lot of founders they realize after building for a while that nobody wants it or that oh they really wanted a little bit different than what I built and it seems like your customer discovery journey was quite quite extensive in a way and very manual at first. So maybe double click on that please a little bit.
For sure. And it was it was all purposeful again not because I'm smart because I had just for years prior to Vanta spent time building things that no one wanted. And so it's actually this experience of you know having the hubris of like you know am I the world's best engineer? Definitely not. But I can kind of like hack and prototype what I want. And so like that's not and I enjoy it right but like that's not the blocker. The blocker and I'll like enjoy it as I'm doing it. And it's really fun until you kind of emerge with your I'd emerge with my thing, whatever it was, and then show it to people and they'd either say, 'No, I don't want that.' Or more likely, they would say, 'Oh, that's really neat. I don't need it, but like I think my friend might,' which is like a very polite, 'I don't need this thing at all.' And that's very sad, right? Then you're just like, 'What did I just spend all this time on? Why do I have so many lines of TypeScript?' So anyway, we went into this with kind of I think you call it the hubris of we can build whatever we want. The thing we need to figure out like we're not going to validate that. We're just going to believe it heads and think we're good and whatever.
The thing we don't know is like does anybody want the thing? And so there was like a ton of paper prototyping but like made the product in spreadsheets changed it a lot to figure it out right kind of manual consulting did manual SOC 2 all of this work to basically like write the spec for what the MVP of Vanta is and by write the spec I really mean like make the spreadsheet and then it was just like oh okay it's this thing go you kind of had it and you're like and we know people want this and like they'll even take the spreadsheet but like we can make them something way better. But again the idea of like even if you're a great engineer, it's easier to change a spreadsheet than it is to change lines of code.
And how how long were that exercise and did you have customers during that time period and then how was the journey like once you were writing code and like you know you guys had an MVP or whatever you know what was the journey like then like was it pretty easy to get the first five 10 20 customers?
I think in retrospect probably yes, but in the moment no like nothing feels easy, you know, like the Greg like it nothing like it never feels easy, you just go faster. I think if I drew like that has been like consistently hard for years mostly. But if you like sent me back to 2019, I'd probably be better at that space than I was the first time. Hopefully anyway. What was it? Our very first customers were generally like former colleagues or like people our former colleagues knew. It was a lot of like social kind of social kind of social pressure, social vouching. And by that I mean they were companies that like truly had a need. They truly wanted a SOC 2 report. They didn't really know how to get it otherwise than like asking around for some like accounting consultant person. And so they called us and they knew we hadn't done this before, they knew we were like kind of figuring it out but I think the social pressure piece was like they knew we were going to try really hard and really wanted to figure it out. And so that was those were kind of the first customers where like they had the problem. It wasn't like oh you're my friend so I'm going to like buy your software. Like wasn't that but I have the problem. I don't have a great way to solve it beside you and I know you're gonna try hard so like I'll take a lark and that was like kind of the I mean again no one actually says that out loud but that's that's kind of what it was in retrospect.
You know what you just said to me? Somebody in our team who's an investor just told me yesterday this company. Oh, it has a few customers, but they're mostly the friends of the founder and they think of that as not necessarily a good thing, but actually I think it's a very good thing. It actually puts pressure on you to to not let you go down. You know, you have your friends and relationships at stake.
Yes. Yeah. I mean, very like Yes. They knew where we lived.
Yeah. You can't let them down. So, like you're going to work extra hard and be super committed. And and they have the ability to influence you. So like you're going to also you trust them so you're going to listen to their feedback pretty intently. You know it's very interesting some of these things that people think are like sort of not scalable or not good because you know your relationships will tap out but again actually these are these are actually counterintuitively quite valuable in the early days.
Yeah, because I do think in the early days, to something you just said like and actually part of why we started with startups rather than enterprises was because we were optimizing for product feedback and you're like right we don't have product market fit yet. We don't we think we know what we're building the spreadsheet thing but like we don't actually know and we know we don't actually know. So we just need like constant feed like the feedback is oxygen and it needs to come quickly or we will not be able to breathe and that will be very bad and like an enterprise you know deal cycle or feedback cycle like there's no oxygen there. Whereas a startup like you can get them in a slack channel you can get them on WhatsApp you know whatever it is and like chitter chatter back and forth and you know like ask questions and and do all of that.
People underappreciate the power of like the early days of learning and I feel like too many startups get locked in too quickly into what they're going to do and then they they don't stay open-minded enough to listen enough. So so look in 2019 you were at the early days you're already a pretty big company so scaled this now like you know in the last four or five years and I think you have been more internationally focused if I'm not wrong than most startups at your scale. So talk a little bit about how's the scaling journey been and then one other question I have for you is and this is something I keep I personally am tormented by this question and I feel like there is one philosophy of building which is just go fast like you go fast the whole time like you can't go fast enough just go fast and then the other philosophy of building which is like hey it's not about how hard you fight the battle but which battles you choose so be very strategic and take your time and build what will have a very low path of friction and I'm curious how do you think Vanta's journey has looked and so one question is that the second question is talk a little bit about team building scaling and then how you've thought about sort of the last four five years of how's the scaling journey been.
Yeah I think on the first like the you know cut many times or like measure five times cut once sort of you know that piece I'm actually of the cut five times mindset. Early Vanta was very measure five times cut once. You kind of get it in like even this early story of like you did these paper prototypes, you did this consulting, you did all this weird stuff, had to like make sure you were right and then you cut once and coded. That was early Vanta culture. And there were parts of it that were really great and there were parts of it that were like bike shedding and slow. And we sort of got away with it for a couple years because we were doing a new thing. We were the only ones doing it. And so that was that. And then kind of 2021 hit and everyone decided to start a Vanta knockoff and which was fun for everyone involved and there and like kind of you know you're they're kind of three years late to the game but the playbook which was really good actually was commoditize the demo work on commoditizing the product but that takes a little bit longer but actually not that not as long as we thought. Give the same demo and then say hey yeah prospect the pro the products are the same but we're half the price like what are you gonna choose and be like we built this in three months and Vanta has been three years and they're slow and we were kind of slow like some of that was like you didn't actually build it in three months but some of that was like we were kind of slow.
And so the you know many thoughts on competitive dynamics and competitive failing but I think one of like the deep things that taught me is part of why we like software and it's so dynamic is is it's so dynamic and your value is only as good as the last thing you shipped. And that is also brutal because you're like, wait, but the three years before of my hard work, does it matter anymore? And no, like no, it got you here and that's great and now it's what did you do for me lately and what did you do for me today? And that's great and terrible those customer expectations, but that's reality too. And so that's it kind of took a bit like 21 but like coming like mid 22 certainly it's like Vanta started to get like really get our feet under ourselves and it was just like it's like kind of maybe the analogy it's like make five small cuts to figure out what you're doing and then go right so it's not kind of like go run around in every direction like a headless chicken but many small things compound and pace matters and pace is a lot easier when you're doing small things and when you're doing these giant projects and you're trying to get them right the first time.
And so you know and I I think you know I kind of like Joe I sort of hate the word strategy and like it's both very real and very meaningful and I think it's one of those words when you use or you ask someone to make a strategy everyone just like freezes a bit you know you're like wait could I do a str like like was it is this good enough is this a real strategy is it a good strategy when you're like looking for a plan basically and a plan with rationale and if you ask for that that seems like way more tractable and like a lot more room to like okay let me try a couple things and then be like oh no this is the direction I go this makes sense right and that has become much more of Vanta today versus again early Vanta which was like let me go do a bunch of research and write a book report you would write these like five to like 15 page documents book reports on a topic to try to get to the right answer and sometimes we would but often we wouldn't and we take a bunch of time and effort doing that and that was kind of painful for everyone involved including our customers.
It looks like you got like this real rhythm and like sort of call it velocity of shipping and other things like going after after competition kicked in and then I'm guessing you guys were paranoid saying hey we created this category now all these people are trying to undercut on price and offer you know maybe 80% or 60% product and you know but the demos look just as good and the designers can be hired cheaply and so on.
Yep. All of that. All of that. And you know, I think there's a part where like I don't know if it felt unfair or like unfair or what do you do? But like it doesn't there's kind of no fair or unfair, right? Like there's no referees in capitalism. But actually, right, this is just like the way I think or the only way we figured out to respond is like ship better like satisfy customers better, more faster. And do that today. Doesn't matter if you're getting it kind of matters if you did last month, but mostly doesn't.
Yeah, this thing you said about software being so brutal that you know what you did in the past may not matter. It's a pretty interesting view.
I think that is general or like network effects are real in software but they're very rare and they tend not to come quickly and so in the first couple years of a company certainly or a SaaS company you don't want to see it. You don't want to see.
You know I think any like the network effects few and far between. Yes, I agree with that. Especially in like enterprise software and then unless the product itself somehow lends itself to like collaboration or like you know many many different stakeholders on it and so on. So scaling journey how's the team built out for you and how did that go?
I'm trying to think of like a pithy answer. Get better at it all over time. Always wish you were better at it.
Hiring mistakes. What percentage of CXO hires or like senior hires didn't work?
We had lots of customers coming in more than we could deal with, which is not a real statement and try to have some self-awareness of this, but just like the lived experience was everything's on fire. We're all headless chickens. We're like running around and trying really hard. Also, deep COVID, it's like 2020, you know, and so there's just like all all the emotions and like all the uncertainty and all of that. And so in some ways the answer is zero of those kind of one is the answer and it's not like people worked really hard and tried really hard. We just kind of like
You had so much growth. You had so much growth that was probably highly exhilarating and everybody looks successful when there's so much growth and so they were just working intensely and that's quite a bonding experience.
Everyone was working really hard and some things worked and some things didn't you know and you know like the customers were growing the people at Vanta were growing not quite some ways not as quickly as we needed them to in some ways like too quickly for people's management capacity it was like it it was a I don't know new company every month and a half sort of feeling it was just kind of pure chaos and we definitely have a good chunk of folks from that era still at Vanta, but they were not heads of functions saved for like one or two examples.
One of the things I really struggled with, well, two things I really struggled with. One was like it's not, you know, someone's growth trajectory can be like quite good, but when the business is doing this, like their growth trajectory is just too slow and it gets worse every single day. And again, they're trying really hard. And in any like almost any other context, they'd be doing like super well, but they're they're failing in a Vanta context. And that is rough for the person, it's rough for you. You're like, how much are you like coaching the like trying to get a coach external, you know, just like all of that that soup of like very real feelings and emotions. It was very tough. You know, some be easier if people are like, well, you don't care, so that's why you're not doing well. It's like, oh no, you care a ton. You're trying really hard. It just
Yeah you know so I I use phrase with founders a lot and I tell founders that you know often you will be the rate limiting step in the company's journey and so you are the best gift to the company you may also be the the curse for the company some at some stages and so what
Yeah like you have other people kind of this but then like what if you're doing this you know and like like you know usually people realize they're kind of flattening out relative until they do all of a sudden sudden enough that they feel like they slammed into a wall and like founders aren't immune to that either.
So how do you think Vanta evolves from here and where I'm asking where I'm going is you know one of the pieces I've had is I feel like every company as it grows and actually like most a few companies can take act one and like scale it and become very big but most actually companies need act two act three eventually I mean like eventually even Google needs a YouTube or it needs something else or it needs GCP and you know Microsoft has many businesses and Amazon needed you know AWS to like get to the next level and so on and and Nvidia had a rebirth and so on. Now those are obviously very large companies but you know as you look to the future to Vanta's future how do you think product changes or evolves or like the business evolves over the next 5 10 years and the reason I'm asking this question is today's session that we are running with founders called business models and modes and we talked a little about the modes and the fact that you encountered this issue for a while where the modes may have seemed low or like copycats emerged easily and then I also want to chat a little bit about how will life evolve for you from here in the future? Is there any things if you think you could do then the modes would become pretty pretty dramatic?
