Christina Cacioppo | Vanta, No-Drama Leadership, & The Future of Compliance Automation

Thank you so much for having me.

Yeah, I grew up in Columbus, Ohio. Proud Midwesterner, big college football fan. I joke college football is definitely my most problematic fave as of now because it's like not, it's like kind of, I don't know, now paying the players is like a little better, but like, um, but anyway, grew up in the era where we all just loved college football and didn't think twice about it. Daughter of two professors who, so kind of grew up on the Ohio State campus, college football, very much a Buckeye.

Definitely a Buckeye. Grew up on that campus. Just, you know, guessing book guys on the shelf behind me. Yep, that giveaway. My parents, I loved their jobs, which, and I kind of thought all adults love their jobs. I think that was actually really formative in a way. Yeah, you don't know when you're seven years old, but kind of when you're 17 or 27, you think back on. My parents loved us too, you know, like love their kids, but they just like, I don't know, they were really into their jobs. Jobs were things you liked. And I think that was great actually to grow up around.

I think there was a curiosity. There was like, you know, they're social scientists, they're not scientist scientists, but like social science that you have a hypothesis and you, it's messy and you test it with people and then you, but you see what happens. Um, and I think like you can just go do that, to use the meme, but like you can, again, I think you're like, you're working on something you care about and that's the default expectation. And so, you know, part and parcel is like you need to go find the thing you care about, but it exists. It can be done.

Yep.

That one sounds so cool. Yeah. Yep.

Again, my family was great. Columbus was great. I wanted to get the hell out at age 16, 17, 18. And so I got as far as I could, which was Northern California, went to Stanford, which was great in lots of ways. And I think, you know, and again, part of also growing in Columbus is I read stories about people in garages in Silicon Valley, you know. I think it was like kind of around probably '99, 2000 when like Steve Jobs was like really starting to hit at Apple. I think I read like five Apple biographies. Like I read every Apple biography like my local library had. Um, and so there was a part of like, you know, the allure of California and, you know, again, Mountain View garages or whatever was like very real.

See, okay, so this also like daughter of professors. I always had a Mac. I've never owned a PC. I've like basically never used a PC in my life. Kind of joking, but kind of serious because what would happen is they would have computers at work and when they'd get a new one, their old one would come home and it would be their home computer and then I would get their old home computer. So I actually like always had, I always had like my own computer and it was always a Mac because it was like the path down, you know, five levels.

I think so. And then I think, you know, I kind of had this like, oh, do I want to be a professor? And the answer was no, but I was a little confused because I just understood being a professor so well. And to me it wasn't, it's not this prestigious smart people thing. It's like what my parents do, you know? It's like not, it's totally understandable. So spent some amount of undergrad thinking I wanted to do that and then at the end I think I had the good sense to realize adults could do different things with their lives. Did a bunch of design work. Long story short, my first job I just got absurdly lucky and joined Union Square Ventures in New York. So early stage VC firm. When I joined it was basically three partners and me. It was probably eight people at the firm when I left, that is now much larger, but got to spend two years talking to founders every day, all day, and it was great, it was incredible. You know, I kind of decided at the end I wanted to go build stuff, I didn't want to be an investor, but I cannot say enough great things about that period and the guys I work for and like that whole opportunity.

Oh, their returns are, their returns are incredible. Yeah.

And that is, you know, I think it's still true of USV, but definitely the firm I joined. It was a firm Fred and Brad wanted to run. And that firm did not have a bunch of hierarchy and like young investors climbing the ranks and trying to like do the things to make VP, like, you know, joking, and not, they didn't want any of that.

Two things. One, I think Palo Alto can be a wonder. It is like if you want to live in a suburb, it's probably the best suburb in the world to live. I was 21. I didn't want to live in a suburb. And the city, San Francisco, wasn't the same city. San Francisco is not the same thing. It wasn't the thing it is now. Yeah. It wasn't the thing. Like Yelp was there and Yelp would throw these outrageous parties that I don't know, I just like read about on Yelp like I did. Yeah. And Salesforce and that was pretty much it. That was pretty much it. And my year, everyone interviewed for jobs right before, like literally right before the financial crash. So there were all these jobs in New York that, you know, then halfway disappeared a year later, but we didn't know that when we were all interviewing for jobs.

Yeah.

Totally. It's funny because I had forgotten this, of course, but like someone reminded me in the past couple months, Fred told me, Fred Wilson told me to go be a PM because he was like, look, you know, it's like kind of like that's where the center is. They make the decisions. Like I don't think he and I don't agree PM is mini CEO, but it's the closest, like there's something there. And you know, he backed a bunch of PMs that become founders and CEOs. So he's like, go be a PM. And I sort of stupidly first didn't take his advice because then I was just stubborn. And so what I did was I actually didn't take a job. I saved my bonus for a year and I lived off my bonus for a year and taught myself to code and I built a bunch of stuff no one has ever heard of. And it was both great and terrible. It was great because it was like absurdly creative. Like the world was my oyster, you know, and I could just, and I like learned this skill that I both really wanted to learn and I'm really glad I know how to do and actually enjoy. It was stressful because like I'd have a job, mostly didn't have health insurance. I mostly didn't tell my mom that actually, parents, I was on sabbatical because they're academics and they understood that concept. They kind of like found me out and they're like, 'Oh, but okay, when does your sabbatical end?' Like, 'When do you go back to your job?' And I had to be like, 'Not going to go back to, I quit. There's no going back.' I'll be lazy on that. And they were like, 'Oh, like do you have food? Do you have health insurance?' You know, and you're like kind of love it. But I did that for a bit. Learned a ton. I mean, some like, you know, now I can write Python sort of lessons and some managing my own psychology lessons and some like, oh man, life outside of bubble lessons and learned a lot, but did not start a company through this because I think part of it too is I'd seen so many ideas come through Union Square and what it took to make something work and not that I had this appreciation for how rare are truly great ideas. It was probably over appreciation. And I was probably like overly focused on it, but there's something there. Anyway, so I ended up finally, you know, two years later like a doofus taking Fred's advice and took a product management role at Dropbox. And that was kind of my first time in a real company, right? Like five person venture funds are companies, but like they're not.

It was an exciting time. It was like, you know, Harlem Globetrotters of recruiting. It was like every, like just the talent density was insane. It was unbelievable.

Yeah. Okay. So, I mean, to that, I had all this thought, I had all the thoughts about Dropbox. I chose it because of the people. It wasn't the product. It wasn't the, I mean, Merk was great. But honestly, it was, I had some good friends from undergrad. Someone I'd built a bunch of stuff with before had gone there. I was really happy. And this tiny startup called Hackpad that was making a collaborative document editor that I tried to get USV to fund and they didn't, had just sold to Dropbox. And I'd also talked to them about working for them. And so Hackpad, for those who don't know, became Dropbox Paper. And so I didn't end up working with them at USV because USV didn't fund them. It's probably the right call. I didn't end up working for them afterward because I was like too stubborn and wanted to go do my own thing, but I ended up working with them at Dropbox and we made Paper.

It was two, I mean, really strong technical co-founders who weren't and didn't want to be PMs, especially at the time, and one kind of more played a PM role over time, but it was mostly a like, hey, we need a PM. Neither of these two founders want to do it. And most Dropbox PMs at that time were of a different archetype. I mean, they're really good at what they do, but they are, they're like the type of PM you need if you're, for example, scheduling a mass migration of like nine quadrillion billion, you know, gigabytes of files off of AWS onto a host and data center. Like, if you gave me that project, I like couldn't even get it out of the gate. Like, I would fail at it. But the Dropbox Paper project was like, go figure out what people want and try to build it and try to get users. And it's kind of like, ah, that's what I spent my last two years doing. That's what I spent the two years prior talking to people about doing. Let me go try. And so it was kind of a different PM archetype.

It was pretty wild. I mean, and the talent density to your point was absurd.

Yep.

Yeah. Okay. I think two things. One, I like didn't have much of a career to speak of at that point. And I'm joking. I'm not, but you know, it was like, it was like I'd like done this VC thing and then I hadn't been employed for two years and then like what the hell, you know, like right, not a lot to lose. Yeah. Exactly. Like I'm joking, but like not, that's, and that's how it felt. I think the other part was like, yeah, yeah, our equivalent in the basement. We're actually the floor up, which is cool, but we were like the cool startup kids on Startup Island and we didn't care about everybody else and they didn't care about us, but we're like, well, we're going to be bigger than you are, you know, Dropbox Paper is going to have more users than Dropbox, you just wait. And so we got to hang out on Startup Island.

So much more because like no one cared, to your point, no one cared and it was awesome.

Oh, well, oh, my, oh, is one of, and actually one of the engineering managers I worked with who was so good talked about this at some point. He came to me and was like, 'Hey, Christina, are you trying to build Dropbox Paper? Are you trying to build an art house critical favorite or a box office smash?' And I of course said box office smash. And I think what we built with Dropbox Paper was an art house critical favorite. By that I mean at this point actually Dropbox's office was on Brannan Street and so we talked about our ICP, although we didn't know the word ICP, we talked about our ICP as some Brannan Street startups. There was like literally startups in SoMa on Brannan Street and startups on SoMa and Brannan Street loved Paper, loved it, and we would get love letters from them, like these really nice emails that were gravely detailed, and it was amazing, and there were not a million of them. We never figured, or I never figured out like how to transition, like bottle whatever it is that the Brannan Street startups liked so much about Paper and kind of distribute it to the masses. And we would, when it came to the masses, we'd like run up against Google Docs and we'd end up saying things like, 'But you can type emojis in your documents and there's stickers in the comment threads. Like, don't you want to switch your whole team onto this new product?' And people were like, 'No,' it's a terrible pitch. And we kind of never figured it out. And actually, one of the great joys of the last couple years has been watching Notion figure it out. So there was a thing there, but like I mean, I did not, you know, take it personally, like I didn't figure it out. I don't know that the enabling components, let's just say technically speaking, were available then.

Totally. Ivan's amazing. It's great.

Okay. So partially to your like collaboration tool thing and my, you know, like what was kind of like what was a value prop of Dropbox Paper. I was never able to articulate that and that was not a good move. That was like me not doing very well at my job. Collaboration software, I just got really, I mean I'm joking enough, but like collaboration software I just got burned out on. And it was like again, and I actually in like trying to come up with a startup idea spent three or four months talking to people about Slack and knowledge bases and you're like there's something here and we can talk and I just got to like there is something here and someone else is going to figure it out because I can't quite put my finger on it. And either you need to be able to or I need to be able to, and I need to find an idea I can like, you should use my product for this reason and I don't need to rely on saying words like emojis and stickers and comment threads and kind of sounding like a little like a crazy person. So like there is so much in team collaboration that I think I am like not, I don't know for whatever reason like not constitutionally the person to do. There's many things I actually like about Vanta security compliance. One of them is the value prop is so clear. The initial value prop, which is a value prop for startups to this day, is pay us X dollars and we will help you build your security and demonstrate it to an auditor and get your piece of paper that you can then use to open up new markets and new segments and go make 10x.

It is. But there, but like one part of launching Paper was finding out we couldn't launch because we did not have SOC 2 compliance.

And I was not smart enough in this moment to be like, oh, I can fix this problem. I was like, what are you talking, like what is compliance? Why do I have to give up my managing team for a year? You just told me to get users and then told me I can't talk to any Dropbox user. Like this is why working at big company sucks. You know, run screaming from the room. Truly did not, was not smart enough at all. Was just like, well, how are you going to make Paper take off if you can't give it to anybody with a Dropbox account because they have a Dropbox contract that says SOC 2. But like come on, feels like a cop-out thing here. And then I think like it was basically six months later I heard about compliance again. But there was like a prepared mind thing. There was like, wait, I remember that. That was nonsense. What was that thing again? And it made me pay more attention to basically a side comment in a like interview I was doing than I would have otherwise.

Just on that one, thank you. Two, spending two years interacting with Sand Hill Street, it did make me be like, 'Whoa, it's so easy to be obnoxious.' And like, I'm sure this person doesn't think they were obnoxious, but like, 'Wow, are they obnoxious?'

Yeah, kind of. Okay. So yes, you had actually, I think the really interesting thing here is you had all these security companies that when their marketing pages were all about compliance. Do you remember Evident.io or what we now call CSPM? All their marketing was around compliance. Their product wasn't that. And so there was a little bit of like, man, if kind of every security company has at least one product or feature page about compliance, but then they're like, it must kind of work, and yet their product doesn't do that. Just imagine if you built a product that did that. Like actually did it. And it sounds kind of dumb, but honestly that was part of it. Part of it too was like, yes, there's a bunch of like alphabet soup of compliance acronyms, but no one touched SOC 2. And so SOC 2 was the closest thing to like the default starter standard. And when we went and investigated why, it was because it was like totally open-ended and bespoke and you had to start with a consultant and then the consultant took you on a like mountaintop hike where you like look within yourself and think about what your security should be and you know, it was just like impossible. It was impossible if you'd never done it. And again, we were kind of, I think, dumb in the right ways, like naive in the right ways to be like, well, that seems crazy. Also, there's all these security best practices. I don't know, for a small company the first time, can you just codify a lot of this stuff? And you go ask the consultants and the consultants say definitely not because no, like my, you know, my job of like mountaintop, you know, exploration is so important. And you're like, is it really though? Turn, I mean, you know, fast forward the end, you can codify, you can codify a lot with best practices, not 100%, and it changes as the company grows, but when you're just getting started, best practices can get you pretty far.

Yes, that is true too. Yes. And I think again, it was kind of walking around and talking to companies that had gone through this process and been like, well, we had to change a bunch of stuff, but it was worth it because I wanted that like 10x at the, you know, end. So like you kind of put any hoop in front of me and I'll jump through it because I want the outcome so badly. And so I was like, 'Oh, okay. Well, I'll try not to like ask you to jump through too many hoops, but okay. Game on.'

Yeah. Okay. So, one thing, and I like have on soapbox about this now, but usually a startup problem is not technical risk, it's market risk. And yet, anyone who can code just code or like codes first. And it's like they're trying to derisk technical risk. And it's like no, if you're halfway decent slash you have any traction, you can build whatever you want. That's not the issue. The issue is does anyone want what you just built, right? And so for, you know, co-founders that could code, we didn't let ourselves write any code and we built everything in spreadsheets and did everything manually and like it sucked and the work is really monotonous and it wasn't fun. But you know what? I understood it backwards and forward and you get on the other side and you're like, I know precisely what to build. And my soapbox is, I think more people should do this, especially people who don't have to because they can code. But again, the frame is like there's not technical risk, it's market risk. Fix that, you know.

Yeah. I mean, so do that. Like literally if you'd asked me in 2017, I mean, I have some of this actually, these emails worthy. Like I would have told you it was $10 million revenue max. It was hundred million globally and that was some like pretty generic multiplication.

And so our theory at the time was like, look, but we can get to 10 on this and then it'll be something useful and then we'll expand to other stuff. But like, wow, we got to build a second product fast because like this thing's not, let's talk two things, like not going to be that good. Everybody else, I would say, was like, no, no, it's a $10 million market and you can maybe get to a million. And I think one of the great surprises is like, no, turns out there's actually hundreds of millions of dollars.

But it was like, we got to get out of SOC 2 fast.

We can't build a SOC 2 factory forever. Turns out you can actually build a SOC 2 factory forever. I still don't want to do that. I don't think that we're doing a Vanta, but like SOC 2 factory is a much better business.

Yep.