Christina Cacioppo: From Y Combinator to redefining trust in cybersecurity with Vanta

Welcome to Inside the Network. I'm Sid Trivedi.

I am Ross Haleduk.

And I am Mahendra Ramasinghani. We have spent decades building, investing, and researching cybersecurity companies.

On this podcast, we invite you to join us inside the network where we bring the best founders, operators, and investors building the future of cyber.

We will talk about the hard parts of the founder journey, launching companies, getting to product market fit, raising capital, and scaling to an exit.

And yes, we will also be talking about epic failures.

But Mahendra, we're here to make the founder journey easier.

That is correct, Sid, but we cannot make it too much easier because startups are hard. And of course, you already knew that.

All right, you two, enough. Let's get started with this week's episode.

Our guest today is Christina Cassiopo, CEO and founder of Vanta, the trust platform serving over 15,000 customers. Vanta has raised over $500 million from investors like Sequoia, JPMorgan, Goldman Sachs, and CrowdStrike. Yet it started as a solution for an expensive, painful, and a long manual process. SOC 2 compliance. It would typically take over 18 months and $100,000 for a company to achieve SOC 2 certification. Can you streamline and automate something like this? How did Christina go about building a product using spreadsheets from a complex process that had no precedent? But what makes this episode compelling is not just the product story, but the founder's journey. When Christina started Vanta, most of the VCs shrugged. This is your first startup. You do not have any relevant background. Is compliance even a market? Maybe the total market size is $10 million.

Pops.

That's million with an M. Christina did not wait for any VC validation. No website, no marketing, just word of mouth. She signed up hundreds of customers. She even got to cash flow breakeven on a $3 million seed round. Let me repeat that. Cash flow breakeven on a $3 million seed round. So naturally, when she met Sequoia, they promptly led her Series A round, a $50 million Series A round on her terms and her timing. In this episode, Christina shares all about finding A secret, a market opportunity that no one knows, scaling in stealth, and raising from the best. This episode is a masterclass on how a first-time founder built a company valued today over $4 billion, especially when the VCs thought the entire market size, the TAM, was $10 million. That's million with an M.

Hey, Christina, welcome to Inside the Network.

Thank you so much for having me.

So we want to talk about a whole bunch of things, and we'll get to Vanta, but before we get to Vanta, we'd love to talk a little bit about entrepreneurship and your path to the cyber community. You grew up in the Midwest with academic parents, and we heard that you even ran a Beanie Baby reselling business at 11 years old. Unprofitable, but Well, it's, it's, and then after that you went to Stanford. You didn't initially think of yourself as a technical founder. What was the, the piece that got you excited to be an entrepreneur and how did you overcome that self-doubt to focus on entrepreneurship?

Yeah, I think a couple of things. I studied economics as an undergrad. I loved it. I thought I wanted to be a microeconomics professor, realized there were other things to do.

And then.

Through a chain of just really lucky events, my first job was at an early-stage venture firm in New York City, Union Square Ventures, where my job was basically like meet with, I don't know, 10 to 20 founders a week, every week for 2 years. And I think through that, I saw a lot of different founders and different ways someone could be a founder and a lot of different definitions of strong founder, say. And I think there was a big unlock in that for me because I think I went in And I wouldn't have said this out loud, and it sounds dumb when you say it, but my model of like a Silicon Valley founder was someone who grew up, taught themselves to program at age 5, and has been like doing it ever since, and also has the ability to like sit down and like imagine the future and then build a piece of software that a billion people use. It sounds very silly when you say it that way, but I think that was like kind of the implicit like model. You're going to read about Jobs and Ellison and Zuckerberg and Larry and Sergey, and their stories do kind of rhyme with that, the stylized stories at least. Anyway, and so the 2 years at USV were really helpful because I just saw, I met people who kind of fit that archetype and character, and I met a lot of really successful people who didn't. And so I think it was just an unlock there. I think the thing that was still kind of locked, or I had a chip on my shoulder, was it still seemed like both the most successful software companies were started by people who could build software. And for me, I felt, I don't know, unprepared to run a software company if I didn't understand how to build software. And so I took kind of 2 years, lived off my bonus, and taught myself to code. Didn't build anything anyone's ever heard of, but it was just kind of that last piece for me.

And I'm curious, how was it like being at Stanford at the time that you were there? I mean, Facebook had just been created. I'm sure it was one of the, the, the places where it was really being utilized. I'm sure that had an impact. You talked about Zuckerberg. It probably had an impact in your thinking of what is a founder.

Yeah, that is very true. I mean, it was funny cuz I was there in like the late aughts, call it mid to late aughts, and that era Sand Hill Road still didn't really fund software. And you go back to like the, you know, the 2005, 4 or 5, like Excel round that Facebook, you know, which is like incredible, like, you know, round for the record books, but actually wasn't that obvious. And a lot of what Sand Hill Road was funding was clean tech. Uh, this was like the Jon Doerr clean tech era. And so even the Stanford, and so even the like entrepreneurial thought leader seminar, this speaker series that were like somebody come to campus once a week and give the talk, somebody kind of boldface tech name. There were a lot of clean tech people. Uh, they weren't really software people and they definitely weren't consumer software people. So there was like that thread. And then, but then there was also like Facebook was down University Ave in Palo Alto, you know, someone knew somebody who was dating such and such co-founder, you know, like they were just in the milieu because they were 22 and Palo Alto and, you know, and so it was kind of both of those. But I think it's funny, I do remember talking to my like social psychologist father about Facebook and telling him about it and like how compelling it was and how I thought savvy, their product designer slash they were about making it compelling. So it's very silly, but the pre-newsfeed, the homepage used to just be a list of your friends and it was alphabetized. And then there was like a, uh, and you had to kind of log in and I gotta click on people and, you know, see if they updated their profiles. And then they started, they've changed that order to people organized by last profile updated and everyone logged on 40 million times more often. And I mean, it was just like product decisions like that, kind of watching and being like, oh, these people are good at what they do. You know, this is impressive.

Christina, you went through the YC in early days of Vanta, and today, I would say you're one of the very few YC companies in cybersecurity that scaled into a true category-defining business. As you look back, what role did YC actually play in Vanta's success? About the real value distribution, given that you were selling to startups, and obviously YC had a large pool of startups, or was it more about the forcing focus, speed, and clarity early on?

It was both. I do think YC startups are kinder to one another when everyone is small than they, you know, quote unquote, should be by some like rational model. And by kinder, I just mean like, you email another YC founder and I don't know, ask for advice or an intro or get on a call and like, The hit rate's surprisingly good, and there's kind of like a bit of a pay it forward culture, pay it backward culture maybe. Early, when you're early days, when you're starting to build something, I just kind of think honest feedback from actual customers, it's like oxygen. And you know, you're kind of building a plant, call it, and like if your plant gets oxygen, it will grow, and if it doesn't, it will die. And it is like kind of as simple as that. And so having a Rolodex basically of white people you could email and be like, hi, you did YC 5 years ago, I'm in it now. You know, here, I'm working on XYZ. Can I talk to you or someone on your team? And it's not that the hit rate's 100%, but that hit rate, I don't know, for me it was probably like a third. Like it was high. It was so much higher. Anyway, and so that is like very real. And I think the community benefit of YC to me is that, or primarily that. I think the other side is YC, it's just, you know, I think the, the, at least when I went through it, the core structure of the program, I mean, it was more than this, but it also wasn't, it was like, You come in week 1 or 2, you pick a metric. Also, if you're building B2B software, it should probably be ARR. If you're building consumer software, it should probably be like daily active users or weekly active users. You pick a metric, you pick a goal for yourself for 10 weeks from now on demo day, and then everything you do is driving that metric to the goal by demo day. And you have to stand up every week and be like, I told you, you know, my goal is X and I was supposed to do Y this week and I did or didn't do it and I have to tell you that and I'm going to do Z next week. And you just have to say that in front of like 20 people every week. And it is shocking how much behavior that drives.

So, Christina, you did not come from a deep security background, and sometimes that can be a huge advantage. Sometimes that can be a disadvantage. Talk to us about what was going on inside your head as you were starting this journey, and how did you see the world of SOC 2 audits at that point?

Yeah, I think it was, it was both an advantage and disadvantage, and I don't know where that scale balance is in absolute, but I think on the advantage side, part of what we were able to do with compliance and GRC and, you know, continuous control monitoring and sort of the, the GRC words for it, but it would say, hey, a compliance audit like a SOC 2 should be a demonstration of the security practices you have. And so step one is implement good security practices, and we can talk about what that means, but like do that. And then because this is a system like any other technical system that you're monitoring and logging, you should just kind of have logs and exhaust and data from that process that you can show to an auditor. That's kind of like how the system should work, quote unquote, from first principles. Or if you take like an engineer, engineer mind, like an infra engineer, a platform engineer mindset to it. And I think, and that is like not how the system worked at all. But I think the kind of fortunate part was to be like, well, I can like look at this from a very different point of view. I think the, on the disadvantage side, I think there's a lot of domain knowledge, there's a lot of credibility, there's a lot of, I don't know, like any domain expertise group, there's a bit of like, you gotta be able to hang with the domain experts. And if you can't, like, you, you know, like, what do you, what do you sort of expect? And I think cyber has, has some of that, not good or bad, just exists. I also think actually it's something I learned afterward was a lot of go-to-market now for early cyber tools is again, very in-network, very, find the lighthouse or the thought leader CISOs, work with them, get them on board, kind of get them truly happy customers, and then use that case study elsewhere. And we just didn't, we didn't play that playbook at all. And like, should have, because people, I mean, kind of expect how kind of everybody else did it. And so we were different, but like not in a good way in that sense. And I just kind of didn't know enough to know that.

I know despite not knowing enough, I think it's remarkable what Vanta has achieved. There is a story about you struggling with SOC 2 audit. When you were a product manager at Dropbox. Can you go back in time and relive that pain with us for a little bit?

Yeah, for sure. It was, so this was like Dropbox kind of 2014, 2015, 2016. So like the height of its Silicon Valley, like power and prowess. I was a product manager working on what at the time was a new product. It was called Dropbox Paper. It's like a real-time collaborative editor. So it was sort of like a Google Docs or a Notion, but like very integrated into Dropbox. And we, the tech had actually come through an acquisition. So we were like separate code base, separate deploy, separate kind of everything from file sync and share Dropbox, which was great for us, we thought, because we could move much faster. We could have our own software development lifecycle, like our own, you know, build merge queues, whatever, pick your favorite. Like we could just kind of move. And it was great until it wasn't in that we had built this product. Basically everyone at Dropbox used it every day. Like it just became the default text editor, like document editor. But we did not have very many external customers. And so I think inside there was a bit of like, oh, this is so great and we love this product and of course it'll be the best thing ever and everyone will love it, but we can't figure out how to get it to the rest of people who, you know, don't, don't work at this company. And so one of the things we started doing was just kind of giving it away, working with account managers and just giving it away to some of the startups that use Dropbox for file sync. And I was great at my job and this was such a smart idea and this is how we get it. You know, I felt like I was Great. Like, I'm basically ready to be promoted to chief product officer over here with my decision-making. And, uh, that was not the case. Started doing that. The legal team finds out, comes over very politely but sternly and is sort of just like, what are you doing? And I'm like, being excellent at my job, you know, getting users. And they're like, no, you are voiding all of our contracts and like opening up with all of this liability. And like, don't you know what's in these contracts? Like, nope. And they're like, well, you know, you're, are you SOC 2 pen tested, vulnerability monitored, are you meeting SLIs? Like, are you? And I was like, but can you slow down on those words so I can like write them down and Google them? You know, like what, what are the words you're saying? Anyway. And so that was my first introduction to this. And what I learned, I mean, it's like, again, lawyers were again, more reasonable than I was being, to be very clear. Like the, the point was Dropbox had signed contracts with these companies and made commitments around data security, around privacy, around audits and auditability. That applied to Dropbox products, of which we were one. And so, if we wanted to work with these customers, we had to uphold these commitments. And so, then I was like, "Oh, great. Well, what would that take? What does it take to be pen tested twice a year with remediation done in 2 weeks? And what does it take to go through a SOC 2 audit with all 5 TSCs at the Dropbox EY standard?" And, you know, just like, what does it take? And the answer was about a year and a half of engineering time for our team. And so, then the decision was like, "Okay, do we kind of pause all product development for a year and a half?" and go do all these things such that we can then get customers, or should we just go try to find customers some other way, people that don't have Dropbox contracts, because we don't think we have product market, like we think we need to iterate more. We took path B. I don't know if that was the right decision or like the score, you know, score doesn't look great on that decision. I, you know, option 1 may have been better, but that was sort of my first, first introduction. And it was, you know, like this all logically makes sense and man, we're at the, again, kind of the height of Silicon Valley and Dropbox and its power, and it's still 10 engineers in a year and a half. That feels crazy.

I want to talk a little bit about the founding of Vanta. So you go through this experience being at this amazing company, Dropbox, at, you know, certainly at its early stage of massive growth. And then post that, you leave and join YC. How did you decide to focus on this problem you had had at Dropbox? We'd heard, by the way, that you were thinking about a bunch of other ideas. One of the ideas that we heard about was building a voice assistant for biologists. Like, how did you go from that to working on SOC 2, which is, you know, a specific type of compliance requirement created by a bunch of accountants? It's not a very obvious area to focus on.

Yeah, there was definitely about a year of confusion and looking deeply unemployed in there. So I think, okay, there was like a lot of desire of like, let's start a startup. What's startup do? I don't know, we'll figure it out. Hence year. I think in that there was definitely some just silly or very silly stuff. The broad framework was pick things either you think you— okay, pick things that either where the technology is changing and so you might have an advantage there, stuff you just really care about because you'll do it better and you kind of want to learn anyway, or if it doesn't work, you're going to feel bad, but you're going to feel as good as you can in that scenario, or places where you have an advantage. And so in that, it was like, so in the technology changing, and this was 2017, So actually spent some time on ML models and sounds like AI now, but really ML stuff. Voice was something that was new, Alexa was starting to gain steam. And so there was a vein of, can you build a microphone that dumps meetings into Slack, transcribes meetings and puts them in Slack? So granola-esque, although granola is much better than what we were prototyping and thinking about, but something there. There was this, Alexa works really well for cooking in the kitchen. What jobs look like cooking, biology work and wet labs kind of look like cooking in some ways. Can you build something there? I mean, no, was sort of the answer, but it was one of those things where you could sort of logic chain it out and every piece of logic made sense, but the results were like, why are we building an Alexa for biologists? This makes no sense. And then the just interest was security. And so that was something where I was like, again, I want the startup to work, but if I spend, I don't know, 3 years learning about internet security, I'll feel bad, but I would be as okay as I can be with that. I think it's important. I think it's interesting. I think it's complicated. I think it's fully moving. It just has all these contours. Anyway, and so it was just kind of exploring that and learning about why startups do and don't implement security practices, which I would mostly say they want to. It is often tough to prioritize because when you're looking for product-market fit, you're looking for the feature, you're going to do the things your customers are asking you for. Customers don't often ask you for security. They do actually ask you for compliance though. And so we kind of got to like, well, if you want to start a security company that changes the behavior of startups, you should actually start a compliance company. And then Vanta kind of came out of that.

And did you, how did you think about co-founders in that whole kind of company building process? Talk a little bit to us about that whole experience.

Yeah, so started the company with one other person who's around through all of that, someone I knew socially, and then we'd both worked at Dropbox, although not together. I think especially in those early days, it's really helpful to have someone to bounce ideas off of, to also just kind of be in the boat, because from the outside, or I think it sounds like a very cool time, and in some ways it is cool time as in like the world's your oyster, you can work on whatever you want. No one's really, you know, you can like literally go learn whatever you want and do whatever you want. And then the day-to-day reality is you're kind of just sitting in a room thinking of ideas, Googling them, realizing 5 people have started that company and being like, shoot, what do I do next? And like trying to email people and be like, will you talk to me about security? And they're like, uh, maybe in 5 weeks, cause I have an actual job, you know? And so just like having someone else in that period is really helpful.

Christina, in a classic YC, uh, doing things that don't scale fashion, your team's V1 product wasn't even software, right? It was just a color-coded spreadsheet. I've heard stories that you've even spent some time at Segment's office for weeks with a spreadsheet of everything that they needed for SOC to, and as you were working with them to actually help them get on that journey. How did those scrappy manual consultations and how did that rapid iteration early on help you nail the product-market fit quickly?

Yeah, so the theory of that is like my co-founder and I could both code and we were coding some stuff, but really the theory was like, it's so much easier to change a spreadsheet than a database model. And we have this vague idea of like, okay, we want to automate a SOC too, but like, what does that look like? What does that feel like? How do you actually do that? And it was just easier to prototype within a spreadsheet than again, in a database model or with a bunch of TypeScript. And so, there was, like, there was some coding that was going on in the background and it was, you know, sort of like, trying to test like, what data can we pull out of different tools a company is using? Can we use that data to like verify their security controls in place? And there was like some of that almost like, I don't know, engineering de-risking going on. But for everything customer-facing, it was a spreadsheet. Because again, it was just so much— be like, oh, you want this, not that? Okay, cool. I will like add and delete a row again. And it was just so much easier to iterate there. And then when we got to like, oh, you really like this spreadsheet that like, yes, I filled in manually. Great. Like, now how do I get software to, like, generate at least the same data that's in the spreadsheet? But it sort of let us crystallize on, like, what that end state is much faster.

So, as somebody who probably hasn't done tens of the SOC 2 compliance reports before you started Vanta, what was the actual story of you going through those spreadsheets? Like, how did it look? Did you just end up Googling every single day, hey, What is this control and how to satisfy it? Like, talk to us about the messiness of those early days.

Kind of. I mean, what we actually did was grabbed, found every SOC 2 we could get our hands on. So, we didn't buy much software at the time, but like Google Workspace, AWS, SAML, Slack, had our friends email us whatever PDFs they could, which was somewhat breaking NDAs, but like, basically it was like, can we get, you know, SOC 2 reports from like every company we can? And so, I think we got like 10 or 11 of them. And then they're just PDFs and you're like, open 'em each up and you're like, okay. And SOC 2 is broken down into the, into subsections. And so you're like, okay, subsection, you know, 1.1, what does Adobe do? Slack, Salesforce, Google Workspace, AWS. Okay. Like, what is common across all of these? What is different? Like, how do you kind of abstract what subsection 1.1 is trying to do? Okay, write that down. Okay, 1.2, go look across 11. And it was just kind of, it was that exercise basically. And then we, and then you kind of get that list and then you're choosing, I mean, you wanna validate it with customers, like, you know, a CISO, a CTO at a startup being like, hey, here's the list of things we think you need to do for a SOC 2. How do you feel about it? And then also tried to verify it with like auditors or consultants, right? So it's like, okay, does this look like, in their language, is this the control set that you would expect for a baseline for SOC 2? Uh, like, is this the list of stuff you would expect to be on there and be verified? And kind of iterating on those. But again, just so much easier to do in a spreadsheet.

It's quite fascinating to hear your journey, Christina, going from a coder to now being a product manager. The next phase of Vanta's journey was quite interesting where you end up with several hundred customers with no marketing, not even a website. Was that by design, kind of a stealth play, or talk to us about what was going on behind the scenes there?

Yeah, it was. So we were the first to kind of take this automated approach to early GRC or early stage company GRC, and we were pretty convinced it would not just work, it would open up the market because a lot more companies would go through. Like, the reason companies didn't get SOC 2s in 2015 wasn't because they didn't want to. It was because it spent a year and a half of engineering time and $100,000, and that was a tough trade-off. And so we're like, look, if we can make it spend 60 days of engineering time and $20,000, we just believe there would be more demand. I think at the time, to outsiders, it seemed like a really silly idea because it was like, we're going to spend a bunch of time and effort to automate processes in a basically $10 million global market. And so, you know, think of that as a VC and you're like, well, that's good luck over there. Like, let me know when you want a job, you know, sort of a thing. And we kind of felt like we figured out a Silicon Valley secret. Like we knew something people didn't, but as soon as they realized this was a good market, they were going to start competing with us. And so it was like, great, think we're idiots over here. Like, that's fine. And we had the word of mouth that would like create customers and would like tell us. And so it's like, okay, we will, you know, we'll do a launch when word of mouth stops delivering us customers. But word of mouth continued to deliver us customers. And then it was like, oh, well, this is working and it's working way better than kind of people on the outside expected. And so let's let them think we're confused for as long as possible. So we get to run and get ahead of everybody else as much as possible.

I'm curious, Cristina, as we kind of go from the initial stages of Vanta to talking a little bit about Vanta's growth over a period of time, give us a sense for kind of why you chose not to go and raise multiple rounds of funding early on. You had a very unique strategy. You kind of started the company within YC. You raised a little bit of angel money from a few individuals. And from Pear, I believe, as well. And then, you know, you kind of built the business for 3 years, cash flow breakeven, and you scaled it over time. And then your first true round was that $50 million Series A that I believe Sequoia did. How did you make that decision to kind of wait for these multiple years and run a business in a very different way to the rest of the world? I mean, this was a period of time when we were talking about blitzscaling and You know, everyone was raising large rounds over multiple years. And certainly that's very different to today where we are seeing very, very large seed rounds in security. So I'm curious to get your take on what did you do then and just what's your thoughts of the, the, the broader landscape and what's happened.

Yeah, so a couple of things. I think it was two pieces. One was trying to think through like, what is the constraint to growth? And in those days, it was not money in our bank account. It was we needed to hire someone in this role, but we were actually really bad at figuring out what their role is and hiring them. So, we were kind of in our own way. We actually should have hired more engineers than we did. We just weren't very good at engineering recruiting for a while. But there were kind of a bunch of things like that where you're like, the binding constraint isn't money. And two things. One, I could go take 1 to 4 weeks away from the company and raise money, and then we'd have more money in our bank account, but all the problems would still be the problems. Plus more probably in the like 1 to 4 weeks away. The second bit was like also we could have more money in the bank account and we could all own, I don't know, 10, 20, 30% less of the company. But again, like that doesn't feel like the binding constraint. And so the, the theory was like, okay, we'll raise when money's the binding constraint. And we eventually got there, but it kind of let us, I think it let us develop our own sense of like, this is a good business. And it's a good business because we know it's a good business, rather than I think what can inadvertently happen, no one wants this, but it's the feeling of, no, this is a good business because Sequoia, because Benchmark, because Accel said it was a good business and outsourcing not just the thinking, but the almost like, are we doing a good job? Which is tough because if you give somebody else control over that, then you're at their whims whether or not they even know they have that control. And so I think there was something kind of important culturally in the early days of like, why is this working? It's working because we know it's working. Wonderful that Sequoia likes us too. Like, that is great and important, but that is second. Like, they like us because it's good, because we know it's good.

Now, the one other advantage was that by the time you went and raised that round, I mean, it was very clear that there was product market fit. I think that question wasn't a problem for VCs. And because you had been a VC before, you likely knew most of the different players. How did you decide to pick Sequoia? What was the reasoning? I'm sure you had enough options on that first round. What was the decisioning behind going with Sequoia?

Yeah, it's funny. I, uh, I had this whole framework and actually I don't think I have the spreadsheet, but a spreadsheet and you're like, okay, there's these 2 or 3 attributes and we're going to go meet with folks and, you know, think through them on the 2 or 3 attributes. And like, I want to give myself time to do that and whatever. The whole thing, did the whole thing. Sequoia wasn't even on the spreadsheet because one, I didn't actually know them very well and the early conversations I'd had with them were kind of in the, have fun automating a $10 million a year business. Let us know if you change what you're doing or want a job. And I don't mean to be mean to them. That is in fact what it looked like we were doing. 90% of people we talked to had that reaction. So that is not just them. That was a very reasonable reaction. And then a friend basically said, hey, you should do this, but you're kind of an idiot if you don't put Sequoia as a row on your sheet. And so just put them on a row. Throw, see where they fall out. And so, you know, it's funny, the other rows had like thought about and spent time with in 2 or 3 months. And Andrew from Sequoia, I met and basically decided to go with over the course of 10 days, but in a way that was just like totally— has worked very well. And so it's one of those, uh, times when, yeah, you make the framework, you do all the homework, and then you kind of rip it up at the end of the day.

And was there a— is there advice that you can give founders on how you make that decision? I mean, you described this spreadsheet, there were probably a few different columns on that spreadsheet that you are grading VCs on, and you have the advantage of being both a founder and a VC. Give feedback to a few of our listeners who are predominantly founders in cyber, like how should they be grading that decision?

Yeah, I think, what do I think? I think investors are investors, not operators, but I, which is like, no kidding, but like, I mean that deeply and truly. You know your business way better than they do and you always will. And so, I do think you want, or at least for me in that, I wanted someone who saw themselves as an investor. Andrew actually very much, I mean, there's lots of people like this, but they are so good at investing, but that is not operating a large organization or a business or building a product in many ways. So, I kind of wanted someone who's clear-eyed about that. I wanted someone who had a number of successes underneath them, not just so they seemed like they were good, but actually really so they were more confident. And so, because I think early in one's venture career, you really want to win or you really want your first couple wins. Again, totally reasonable and rational and people try to deal with it, I'm sure, in the best ways they can. But that can end up pressuring a founder, right? Because you're like, oh, are you the one that's going to make this person's career? And you kind of don't want to be the company that someone is betting their career on in some ways. You kind of want them to have a couple of other of those. And so whether, I mean, you obviously want your company to work, but whether or not your company works is not existential for your investor. Because I think that drives a bunch of behavior on their side that then can come back on you. So again, as much as possible, for me, if somebody saw them as an investor who had a couple wins already, again, hungry, motivated, all that, but just like vanta success or failure was not going to be like their entire self-image. What else? I don't know. Having worked at a venture firm that I think is, was excellent and did not offer a lot of quote unquote services to the portfolio companies when I was there. I've always kind of been skeptical of those. There's parts of it that are very helpful, but I think one, it's just tough to sustain at scale. And I think that the sales and post-sales distinction that exists, like VCs have it, like when they're trying to win an investment, they will talk about their recruiting support and the council of experts and the buyer's council and this, that, and the other. And then when you're one of 200 companies trying to get those things, like it's just different. And again, it's not malice or anything, it's just Sales and post-sales are different motions, and VCs have that too. And so for me, I didn't really weight that stuff. I mean, Sequoia had some of it at the time. They have slightly less now. Actually use their recruiting stuff. It's great. You know, like I don't— people there work super hard and are really good at what they do. I just, to me, that was sort of like a tertiary variable because it also seemed like regardless of being like, do I really want to like rely on this entirely? No, it's like, even if I did rely on it entirely and it worked, it means like my company wouldn't be able to stand. Without that, and that seems bad too.

So Christina, did this come up during your pitching with Sequoia that you don't have security background, you don't have compliance background? What was their reaction to your background in particular?

No, I mean, it quite possibly should have. I think I got, you know, lucky in that the investor I was speaking to also didn't have a cyber background, doesn't consider himself a cyber person, and is just like a smart, motivated person who learns new things and is curious. And that's sort of how I see myself. And so, It worked very well because we kind of saw, I think, parts of that in one another. I think there were definitely cyber stuff we both missed for sure though. Again, pros and cons.

After Vanta started, it didn't take all that long for this $10 million market to explode and strong competitors like Drata and Secure Frame entering the space. How did that shift for you from being alone in this market that people didn't believe existed to just jumping into this incredibly crowded space. And how did all of that change your thought process about differentiation? What did you decide to deliberately double down on at Vanta, and what were some of the things that you decided to consciously not compete on?

Yeah, I had a lot of feelings and emotions on that stuff. I think in the early days, okay, we always knew competition would come because we, again, good idea, someone's gonna copy it. I think the copying was more aggressive and shameless. I don't mean shameless in a moral sense, I just mean like no shame, like fact, like just, you know, like copying that I would not be okay with, but like I might be wrong here. That just came faster and harder than expected. I think there was an initial bit of like hurt, anger, like, hey, where's the ref? Who's gonna call the foul here? And like, there aren't refs in capitalism. No one, you know, no one's gonna call the foul. And I think there is like a little bit of a period of reckoning with that. And then I, and I think a bit of too of like, well, you know, we started this and like, I mean this like politely, but like customers don't care, you know? And they shouldn't, like, again, capitalism, like you care about the thing that is the best for you right now and you believe will be the best in the future. And maybe that was the thing that started it and maybe it wasn't. And like no one remembers Betamax. And I think that kind of like there's a reckoning around that. And then from out of that, you're like a couple things. One is like, okay, well, what matters is what we ship lately. And so, how are we shipping quickly and often and iterating with customers so that we get to the right thing fastest? And build a machine that does that, also does that at speed and scale such that even if it's someone is going to read our release notes and copy everything immediately, which definitely happened. It's like, we're just going to outrun you. And so you can do that, but we're going to pile the release notes on you and like, good luck catching up. So there was some of that. There was also a shift in kind of external comms because I think in the trying to be quiet, both strategically and it's more my personality, like I would worldview almost, I'd like much rather it's just like, no, heads down, good, do good work. You don't really have to talk about your good work. Customers will know, people know, it'll filter out. Yes and no. You know, we had one competitive hyper-aggressive who at times went around and said they created the space, but even if they didn't, it was like, yeah, well, Vanta created it, but they suck. They haven't shipped anything in a while. Like, we're killing them. They're about to be dead. And none of that was ever true. Like, you know, ever. They were never larger than us, but that wasn't— or even close to it. But that wasn't the narrative from the outside. And I think I— my responsibility in that was I was quiet. So I let somebody else tell Vanta's story. I didn't like what they were saying, but like had to learn that and be like, okay, well now I got to go tell Vanta's story. Because if I don't, again, someone's going to tell a story that I deeply disagree with. It's on me letting them give that, opening that space for them to do that.

Hi Christina, I have a funny anecdote here that I want to share. I think this was right after your, maybe 6 months after your Sequoia round, you had probably spoken at some conference and some of the investors who were in the room had heard you speak and I was having coffee with this one investor who shall be unnamed and said, oh, so Mahendra, you invest in cybersecurity companies. Have you heard about Vanta? I said, yes, I've heard about Vanta. Who has not? And it's like, what do you think about the company? I said, like, I don't have an opinion yet. I had not studied the space. So I said, I don't have an opinion yet, but clearly if Sequoia is writing a $50 million check, there is something to be said. So this person said, you know, we would've loved to invest in this company, but you know, the CEO does not have the security background and so on. And so I hope that they're listening to this episode today and they realize what a marvelous job that you've done in continuing to build the company despite those perceptions and biases that existed. As you look at scaling Vanta, you started with SMB customers, small and medium size, have a certain, let's call it ACV. There is a certain market motion that goes into them. We've had in the past Duo Security and Cloudflare who both are a classic company that started going with that motion. And then, of course, sooner or later, there's pressure to go upstream. Talk to us about your philosophy and challenges and advantages of going upstream.

Yeah, so when we think about— we do think about and talk about moving upmarket at Vanta a lot. When I think about it, it's like an expansion of what we serve. So we continue to always serve startups and the smallest early-stage companies, and then we just build more and more capability for more mature companies and teams and security programs on top of it. So, that's the theory and the goal and hopefully the practice. It's hard because it means you are building both for a 5-person company and a, call it, 500, 5,000, someday 50,000-person company and doing both at once. And that is hard and there's trade-offs. Because again, in the vein of what have you shipped for me lately, like, Yes, lots of 5-person companies have used Vanta successfully for years. The product quote unquote works, but if we stop shipping and iterating on that product, the next wave of 5-person companies won't use Vanta. And so, it's a lot of fronts. I think it is much easier in, with the other, the other move you see companies do is they kind of say, okay, we started with 5-person companies, but, and now if someone comes to us and really wants to buy, we'll sell it to them. But like, Really all of our effort and focus and energy is going to be on, I don't know, 500 to 5,000 person companies. And again, we're going to stop development for anyone under 500 basically, and we're going to get some churn and we're going to decrease win rates and conversion rates, but that's fine. And that's a painful decision in different ways. It's not the one we've made. What we've done and tried to do, one is trying to be more rigorous about what are our investments at different customer segments, which is often tied to headcount, but it's really tied to the maturity of the security team. But like, how do we think about that portfolio mix of investments? And you know, there's tough trade-offs there all the time. And also then how are we building product, whether it's UI or workflow or agents that are just easy to use and bring a like prosumer level of Figma level, I don't know, user experience. Because I mean, one, it's, it's kind of an annoying statement, but one thing we do say is they're like, look, Figma doesn't have a different product for a 5-person design team and a 500-person design team. They all use Figma. And again, Vanta isn't Figma in lots of ways, but like, there is, I think, a kernel of truth to that. And so, it just pushes on being really rigorous about like who you're designing for and when and how you think about prioritization and, and all of that. But we try to do a lot at once.

In the, in the last few minutes of this conversation, we want to kind of shift and talk a little bit about leadership culture and the vision going forward at Vanta. On the topic of leadership and culture, you've talked about hiring and hiring slowly in the early days and deliberately to find folks who fit a very specific culture at Vanta. I'd love for you to talk a little bit about the DNA that you were trying to build in those early days. And then the company has obviously scaled over that period of time from tens of employees to hundreds to now thousands, and it's a very different business. And I'm assuming you can't interview every single person who comes through Vanta, how do you kind of ensure that there's certain principles that you want to keep and then there are others that you have to shift away from just at scale?

Yeah, I think in the early days we hired very slowly and it was deliberate, but I don't know if it was deliberate in the right ways. I think we made our lives comp— and our candidates and people who joined complicated. So a couple things. I do think we, we had a set of, we talked about a set of principles very early. We didn't interview on them, just in that like, The first, well, certainly the first engineering hires, it was all workdays. It was come in for a day, we'll give you, sit next to us and help build Vanta. We'll give you some tasks off our list and we'll pay you whatever, $100 an hour or whatever kind of San Francisco contract salary was then. And that was the interview because it was sort of like we're two people sitting in a room, what else are we going to do? So that worked really well. And then I think when we got out of that, there was We had a list of things. It was probably, in retrospect, pretty milquetoast. It was, you know, prioritize customers and business impact and do the right thing. And, you know, these kind of like motherhood and apple pie sort of platitudes that are both important, but I think aren't that interesting. Don't force trade-offs. Everyone wants to have them, you know, not that. And then our 7th or 8th hire was a former founder who was very strong and came in and it just didn't work. And they worked hard, cared, smart, motivated, all the things. And it was kind of like oil and water. And I think of the VaynerMistakes in the early days, they tried to make it work, they tried to pull out, we tried to make it work, we tried to dive and save, we tried 3 or 4 things, should have called it way earlier for everyone's sanity. But it was reflecting on that and being like, what was off there? Because again, when I look at my nice list of platitudes, everything is there., but like there's clearly some way about how we work and this person didn't work that I should articulate and tell people and screen them on. So like we don't put anyone else in this position. That's like not fair to them, nothing else, let alone like ineffective for us. Anyway, and so then like kind of the, the list of principles sort of got a little bit more interesting and a little bit more fleshed out. And then we created an interview that, you know, everyone went through no matter what of trying to ascertain those. Things. And that I think worked pretty well. I mean, not 100% hit rate, but there was kind of a bit of like, you know, and it's not that we always followed it. Sometimes we'd be like, ah, this person's like, feels weak on these two dimensions, but we saw strength here and like, let's just go. And then it's funny if like we ended up parting ways, it was usually because one of those two dimensions. So like there, there did feel predictive power in it in terms of scaling it. Then it was just like codifying the question, like whatever I was doing in this, it was just like trying to write it down. And train other people and have other people do. And then you kind of figure out in that, like, who's really— there were like people really excellent at it. And then like have them do or take on like writing down and what are they doing. And, you know, some people are less excellent at it and you give them fewer interviews, but like just kind of iterating from there. And so to this day, everyone, like that interview still happens, everyone at Vanta. I do it for everyone director plus, so I don't interview everyone, but did start redoing it director plus. And again, it's not, or the reason we call it principles is they're not moral right or wrongs. They're, they're things that like, it is very reasonable to disagree with or want or not want, but there are kind of things that end up mattering a lot at Vanta. And so it seems best to be upfront about them. So again, person's clear-eyed about how we want to work. We're clear-eyed. We've told it to them. People can opt in or opt out. And again, not a moral thing at all, like a match thing.

I'm curious, any advice for founders on how to hire leaders? And by leaders, I mean your first VP of sales, your first VP of marketing, your first VP of engineering who isn't your co-founder. Like, what was the learning? I'm sure there were lots of cases where things worked and they didn't work, and there are probably one or two things that you'd want to highlight that are important.

So hard. I think it's one of the hardest things because you're going to mess it up a bunch, and unfortunately you're practicing on real people. On real people's careers. And like, you don't want to mess it up when you're doing that, and you will. And that, that's one of the toughest parts. I don't know. So there's some like reckoning with that. And like, you should work really hard not to mess it up, to be clear. And then even with that, you will still mess it up. I think, what have I found helpful? These are now pretty established tips, but I do think like the calibration conversation. So basically being like, okay, I'm going to hire a VP of sales. I'm going to go ask friends, VCs, mentors, whoever to go introduce me to a bunch of VPs of sales they think are good. I'm going to shoot for 10 of these. I'm going to spend 30 to 60 minutes with 10 different VPs of sales and talk to them about what the heck they do every day and why they do it and how they think about it. And at the end of that 10 hours, like, I will probably have better opinion. Like, I like this person. I don't like this person for this reason. Or like this, or like this person, totally great. Not my, not my jam, but like they're going to go do them. I want to do something over here and just get sharper on what you actually want. So, then you're able to articulate that to yourself, to a recruiter, to the candidates in a way that again, lets smart people opt in or opt out early. But getting clear yourself when, I don't know, at least for me, not only I hadn't been those roles, I mostly hadn't worked with those roles. There's a bit of just like, I don't even know, or I have a theory in my head of what a VP of sales is, but it's wrong. What is actually a VP of sales or VP of whatever?

Kristina, I think we are all on this call super excited about the potential AI has to reinvent the way we do security for companies of virtually every size. And the compliance market and the compliance assurance, the trust assurance market is also affected quite a bit. We know that there is quite a few competitors and new entrants coming in to go after the market that, that Vanta to a large degree has created. Where do you see AI genuinely helping teams make better security decisions and compliance decisions versus just automating noise or creating a ton of false positives and giving people that false sense of confidence? And sort of subsequently, how is Vanta positioning itself for the next 5 to 10 years, particularly with the rise of AI in security?

Yeah, so we've shifted to calling ourselves an agentic trust platform. But basically, I think the, the, germane parts of that is if someone thinks they're going to be Vanta but with AI and they actually succeed, yeah, we did not do our jobs because the Vanta with AI should do Vanta. And again, I think mostly ball in our court on that. You're like, okay, can we execute on that or not? Again, nothing is given or deserved, but I think that is the opportunity and the aspiration. I think within that, think about agents and AI first taking on tasks within roles. So there's some amount of like, oh, well, you have a GRC analyst, And I think that's a, it's a tough way to reason about it and think about our security analyst or, you know, pick your area. Like, what will the GRC analyst be doing today versus a year from now versus a year ago? And I think, like, AI and agents will shift that. And so, a couple specific examples, you know, one, one tough thing about running a GRC program, especially in a larger organization with multiple business units or products or frameworks, is just keeping everything in sync. You know, the silly examples, this policy said the SLA is here, but our practice over here is, you know, actually the thing that's implemented is, you know, another SLA that we're alerting on. And our ISO 2701 ISMS says this, but like over in PCI, we have this other thing. And like so much of the job is that. And that is, I think, a great place for agents, or at least surface things for someone to then decide, you know, do I want this SLA, that SLA, do I want you know, this provision in the policy or that provision in the policy, but like keeping all of that aligned and simplified. I think another example are, you know, vendor reviews. I have lots of thoughts on third-party risk, but often companies are not, you know, reviewing all their vendors for lots of reasons. It can feel like busywork. It's a lot of time. What's actually ROI? If I don't like this vendor security posture, what, you know, decision-making authority do I actually have, right? Like there's kind of a lot going on there. And I think if you believe in like an AI taking a first pass on a vendor review or a first pass on compliance documentation, policy documentation, security questionnaire answers, and flagging things, I think then the, the kind of TPM analyst job looks more like, okay, I've got all these, I've got all these vendors, all these third parties, like there are a bunch of risks to the business in lots of ways, but like, let me think about it holistically in this portfolio. And like, where do I want to take that risk and where do I really want to push? And I can kind of like think about that on almost like a portfolio manager level versus like someone wants to use randomstartup.ai and I've gotta read their SOC 2 and put a thumbs up emoji on it and not my favorite part of my job, right? So I think there's just kind of places where the, the jobs will change, but it's because some of the tasks get kind of taken by AI and then it'll be replaced by this like higher level task, if that all makes sense.

So Christina, as we try to wrap up, one question that comes to my mind is you came as an outsider, a venture capitalist who became a founder, and quite a successful one at that. What has been the toughest part of this journey? And then on the flip side, what has been the most rewarding part for you along the way?

Yeah, I think the answer to both is the people side of things. I think on the toughest part, I mean, I said about hiring execs, but it's true across the board. So much of leading, managing, I think it's experiential.. And one can read all the books. I tried to read all the books, helpful and not, like you just kind of gotta do it and you gotta practice. And unfortunately you're practicing on real people and you mess stuff up and it sucks. It's the worst. And yeah, I mean, when I think back of like things I wish I could go change, it's like they're basically all in that category. And all you can do is be like, I had to learn this lesson on you and I am so sorry whether you know it or not. And I will try not to like repeat the mistake on anybody else. But like that, that's hard. I think on the positive side though, you get to watch people do stuff that they didn't think they could do, and that is the coolest thing. And we have lots of examples of that. You know, people who joined early, people who joined late, who are just over a like longer arc. In a short, like, you gave me this project and I thought you were crazy in a bad way, and then I pulled it off and it's kind of awesome, and you're like, it is kind of awesome. And so it's, it's kind of both sides of that coin.

Kristina, we want to thank you for your time today. It's such an inspiring story, and I think one of the few founders who's very authentic with how they see the world, how they feel, how they conduct themselves. So thank you for taking time to inspire the next generation of founders. Also, for the record, I think you're the first founder on our podcast who's actually found a secret, guarded it well, and then once you exposed it, it sort of became everyone else's. So we certainly wish you success in continuing to build Avanta as you progress.

Thank you so much. That's so kind. Had a great time.

Thank you for joining us Inside the Network.

If you like this episode, please leave us a review and share it with others.

If you really, really liked it and you have some feedback for us, wrap it on a bottle of Yamazaki and and send it to me first.

No, don't do that. Mahendra gets too many gifts already. Please reach out by email or LinkedIn.