Compliance at scale and why TAM is a distraction with Christina Cacioppo of Vanta

17:34Christina Cacioppo:You tell me where the bar is and I'll meet your bar. But like. It's a box checking. Exactly. Or it is just kind of culturally something that is like more important. You can tell me where the bar is. I'll meet it. But also I have my own internal bar, which is more the European take. But we see like demand for, say, CCPA, which is a California version of GDPR. quote unquote go in waves. And right now it is definite. I mean, all the American regulation is kind of at a total nadir, but it's down right now. Yeah. Well, it's down at a federal level. Is it also down at a state level, the kind of energy around the CCPA type things?

18:08Yes, it is.

18:08Christina Cacioppo:Even with, you know, it's not clear what California is going to do and it could go multiple ways. But I think I still think the national politics casts a larger shadow, even over like a state like California. Oh, that's interesting. Yeah. OK. And on the national side, you know, current administration is very into streamlining regulation through automation and AI. But that is the catchphrase that they deeply believe in and are driving. I would have thought that this kind of stuff is just too boring to be caught up in any reform initiative or will this be streamlined? I think there's very hardworking folks in D.C.

18:46Christina Cacioppo:in special—well, kind of across the board, but in GSA, in the Agile Arc Office, trying to do this. And the primary lever they're using is FedRAMP. Yes, I remember this. And which broadly I would think of, I'm sought to for the federal government, but basically a very onerous set of both controls and requirements and documentation in order to begin trying to think about selling to federal and often states and sometimes even local governments. How do you realize state and local governments also use FedRAMP as kind of their? The state ramps. Yeah, yeah. So there's like literally Texas ramp. But they kind of conform to FedRAMP.

19:23Christina Cacioppo:Yeah, yeah. And there is a part of GSA and one team in particular led by a guy called Pete Wasserman who is trying to modernize FedRAMP. But I would say make a like 2020 version of FedRAMP where the current version feels a bit more 90s. And it is unclear if he will get the traction to succeed. But he's fighting the good fight and he gets it. But even if they do that, I find it hard to imagine the society of accountants just copying the new FedRAMP lock, stock, and barrel. I don't think they will. I think you're just going to have even more divergence between these things. There's just less control over that.

20:04Yeah, I feel like your life is the XKCD of, you know, we have 15 standards.

20:07Christina Cacioppo:It is standards, and the answer is the 16th. Yes. Yes, yes. Yeah, yeah. That is also my answer when people are like, well, is in Vance I going to make a standard? Couldn't you make a better one? Yeah, yeah, yeah. I mean, couldn't we have that posted on the office wall? Yeah, yeah, yeah, because it is your life. Yes. But OK, going back to the effects of the European strictness, it doesn't show up in the form of kind of maybe American companies previously were looking to kind of check the SOC 2 box versus now they're like, OK, it's really important I don't cross this actually quite strict European rule.

20:35Christina Cacioppo:Right, right. Whereas I think now, and I think in the, it's funny, we are starting Vanta, Vanta as what it is now today in spring of 2018, which is when GDPR was going into effect. And so I was kind of running around and being like, will you talk to me about compliance? And everyone said, yes, I was having this great luck. And then I'd show up and I'd be like, so suck too. And I'd be like, GDPR is a priority, like next please. Yeah. And that energy is like mostly dissipated, especially in the United States. Yes. I think it's like the theory at the time was GDPR is written by lawyers at a very high level.

21:09Christina Cacioppo:It's like not a spec you can handle an engineer, like comically kind of bad as an engineering spec. But like, it's fine. We will clarify that in court over the next 10 years. And now we're seven, eight years in. Hasn't really happened. Yes. Yes. It still is kind of hand wavy. Yeah. For an engineer, at least to go implement as it ever was. And how does this work with agentic coding where the honest answer to the number of human reviewers this code is zero? Yes. How should it work? Because right now it is like, well, somebody needs to be like, I did code well. I think right now it's like agent, you know, writes code.

21:46Christina Cacioppo:Human or agent puts up PR. Yes. Maybe human or agent reviews it. Yes. And I think to a, like, naive sock to audit, you're like, those seem like two user IDs had that conversation. Yeah, yeah, yeah. And so we can go forward. But it's more about having two throats to choke as opposed to, you know, we read the code of this, you know, ATM software and guaranteed this. You didn't introduce an infinite money glitch. Yes. My interpretation from talking to folks is some of the impetus behind that or the primary impetus was insider threat. And like that's what you're preventing against. Maybe that's my macro answer is just go through the SOC2 controls and be like, what are we trying to do here?

22:25Christina Cacioppo:and be like, okay, great, let's design for that. Yeah, yeah, yeah. And that may or may not be how it's written today. That's a good question because on all the insider threat stuff, having two reviewers is kind of one way to do it. Yes. Does it suck to mandate exactly a lot of other insider threat stuff because presumably you should be logging a lot of activity, auditing a lot of activity. You know, there should be process that you have in place. No, and I think this is where actually you get to the technical standard made by folks who often aren't as in their depth in engineering, let's say. Right.

22:56Christina Cacioppo:And so the controls for like, there are a bunch of logging and monitoring controls that are suggested. One thing maybe I also mentioned, unlike PCI, SOC 2 doesn't have a prescribed control list. So PCI is kind of different and it's like you must do X, like you must buy this tool whether or not it's useful to you. I'm sure you have your own story with that. Yes. SOC 2 is like you must log useful events and have a system to look at them. I see. But it is up to you to decide what the heck that means. Which sometimes it's helpful. Yeah, yeah. I think for a startup that's never done this, it is unhelpful because it sort of opens up, you know, a maze in a way that's just not great.

23:33Christina Cacioppo:That's where being prescriptive, like, is part of, I think, the, and Vant's initial product market fit. I think it's actually largely due to that. Yes, yes. In a way that that wasn't the plan. Yeah. But I think it's like figuring out how to take that high level guidance, bring it down in some places. Yes. In a way that actually makes sense.

23:53Christina and her team at Fanta are helping their users automate compliance, which for many companies is the thing standing between them and being able to sell to enterprises. We're very familiar with this category of products at Stripe, where you have a complex web of rules that businesses need to be able to comply with so they can move on to actually improving their products. Just take tax compliance and our product, Stripe Tax. As you start selling in more states and more countries, you discover there's thousands of rules you need to follow. For example, did you know Chicago actually has a lease tax, which applies to SaaS companies too, since you're leasing out software?

24:25Stripe Tax is built to automate all of this. With one integration, it knows what you're selling, when and where you have to collect transactional taxes, and how to register and file on your behalf. So if you want to sell globally without becoming an expert in tax rules, check out Stripe Tax. You know, the kind of joking reference that everyone makes as they talk about kind of competition from cloud code for software products is, yeah, you know, you're not just going to vibe code your X in a weekend. But obviously, something like SOC 2 is actually the kind of thing that LMS or kind of coding agents are good at working with because there's just so much training data out there.

25:09and it's a, you know, codified set of rules. And so how is AI helping with what you're doing and kind of what is your plan for? You were describing some of the scale economies you have and having seen other customers, but I'm curious just kind of what the defenses are against. A customer could, in theory, say, hey, Claude, give me the plan for our SOC 2 compliance. Make no mistakes, you know? Like, that is a thing you can contemplate.

25:31Christina Cacioppo:Right. And I think, like, there's, you know, so you can do the sort of the very defensive thing, but I'm going to do the actual, the very defensive thing. It's like, wait, but like, this is a place where you don't want to get stuff wrong. Spending much time on it does not make your beer taste better. Right? Like, is this really the place? Even if you really want to vibe code a bunch of stuff, is this really what you want to vibe code? Fine. Whatever. There's all those arguments. Ignore them all. I think where the LLMs are excellent and a little dangerous in a build versus buy, but then we just need to build better experiences on top of this.

26:01Christina Cacioppo:Is like, hey, Claude, I'm going to give you a mess of data. you go make sense of it to me and like get me ready right i'm just gonna like give you a bunch of aws screenshots or api calls i'm gonna give you all my policy documentation like go i'm gonna give you my existing jira workflow go turn it into a thing and so you know you can go do that today we are building um this is our like onboarding flow or will be our onboarding flow which is oh you have an existing program that's already running that's cool give you all the stuff we will go map it into the Vanta world. Yes. And then in a like Cloudware and LM, it's like, okay, cool.

26:40Christina Cacioppo:Now you get, I don't know, files in a folder structure that you then, you know, box share that over to EY and like call that your audit. Fine. You can do that. In a Vanta world, the outcome is now hopefully we have your program mapped and is observable and monitored and alerted. And so you have continuous control monitoring. You get your dashboards. You always know what is in place and what is not. And yes, you can go, you know, send a share link to your auditor here too and they can log in and see everything. And so we sort of think about it as they have lowered the initial audit prep. Yeah. In a way, inside, outside Banta.

27:16Christina Cacioppo:Or like if they're not inside Banta, what are we kind of doing? So building that. But the continuous monitoring piece. Yes, yes. That you're not going to get out of at least LLM chat. You've got to go vibe code that whole system. Okay, so you're saying this. everyone just wants, like no one enjoys spending time in SOC 2, everyone wants to have been SOC 2 compliant as of yesterday. Yes. And so you're saying part of the advantage here in this new landscape is you can just take a whole bunch of unstructured stuff and just empty it into the Vanta hopper and Vanta will make sense of it. Yeah, we'll get widgets out.

27:49And I presume part of the defensibility comes from the fact that preference amongst practitioners, in this case, the auditors that are reviewing your SOC 2 materials is a very strong effect. And both QuickBooks and Xero, to some extent, really grew off accountants becoming familiar with those pieces of software. And companies could have opinions about what they were using, but those opinions were not that strong and they were overridden by the opinions of the auditors.

28:21Christina Cacioppo:We have a version of that. I don't think it's as strong as Zolde Fex yet, at least. But even again, we've seen 20 ,000 audits and thousands for particular firms. And so you're like, we now do AI evidence evals. So it's like, oh, you're going to provide this piece of evidence. We can just tell you, is it going to work for this auditor? Did you upload a cat picture? Did you upload a screenshot without a timestamp on it? And you're going to get told to put the timestamp back, you know, just like that feedback loop. We already have, and we've thought about doing things for auditors as well with that.

28:55Christina Cacioppo:But yeah, it sort of moves in the direction of like an AI internal audit at least. It feels like the data you have of anonymized prior audits is an incredibly powerful network effect that cannot be replicated because it doesn't exist in the public internet. Like the AIs don't have it available to them through just private data. And just like, you know, Stripe's an advantage because we have all the fraud data. We know what like a normal buying pattern looks like versus not. And so we can offer the best anti-fraud performance just because we're working with a larger data set than other people. Similarly, people going through an audit, you can tell them that this will work and this won't.

29:33Christina Cacioppo:This is our radar. Yeah, exactly. In a way that's just you cannot do it even if you decide to buy it yourself. Yes. Yeah. It's a big deal. Yeah, it's kind of cool. Where else have you seen that be useful? In relationships between a software vendor and buyer. Right. And so we so Vanta core, we think of ourselves as, you know, broadly and what we're best known for is serving software vendors, but people who make software and want to sell it to the world. Right. You know, security or is it secure? Grand. OK, then we have this third party risk product. But it's basically I think of like you're an organization.

30:12Christina Cacioppo:Maybe it's tech. Maybe it's not tech. You're buying software and you're going to go put a bunch of your customers data in it. You want that software to be secure. Because if not, you have to turn around and tell your customers. Like, I lost your data, but it's actually our email provider. But you don't care if it's our email provider. Like, you think it's me and I've sent you an email. Anyway, right? Like, no one wants to send that email. So there's a whole world of, like, third-party risk or vendor reviews. And we build a product for those folks. But is there kind of a compliance versus security tension here as you're doing this stuff?

30:42Christina Cacioppo:We haven't seen as much. What we have seen is, so the person buying software, you know, they might work at a tech company and be quite savvy and up to date on those threats. They might work when our customer is, you know, a hotel, literally a hotel chain. Right. And so not that, and they certainly don't get compliance themselves because they don't build software. Right. But they buy it. Yep. Fine. And so what we generally see is some companies will come in with their set of questions they want to ask. And, you know, maybe I will read your sock to you, maybe I will not. But like, I really want to ask you questions one through ten.

31:14Christina Cacioppo:Some companies don't have that. And again, there's some part of the value proposition is like, we'll prescriptively guide you. And so we have a product principle just around reasonable defaults. And it's like, can we make the reasonable default questionnaire? In this case, something that leans into security versus compliance or versus, you know, do you have a policy to X? And you're like, can you just ask them if they X if you care? And so that's a place where we've tried to, on the margin, nudge the buyer questions toward more security, knowing that will change the economic incentive of the vendor.

31:45One of the big debates people are having right now is how AI productivity gains show up.

31:50Christina Cacioppo:Yes. And I feel like you could have an opinion on this because we have filled out a lot of security questionnaires at Stripe. And I think we'd be very happy if the machines could take over from here. We really don't. We filled out enough. We should talk about this. Exactly. Yeah. But so one case you could make is the machines are getting quite good. They can understand what Stripe, you know, is and isn't and can do and can't do. And so every time we get a security questionnaire, AI can fill it out. The counter argument you could say is maybe Jevon's paradox will show up and there'll be even more exhaustive and elaborate and custom, you know, security questionnaires.

32:27And so, you know, the total amount will increase. But so just how do you see AI productivity showing up here on the effect?

32:33Christina Cacioppo:So the questionnaire is actually a great example because the questionnaire is so that we tried to build this product in 2018, which is before SOC 2, because it seems easier actually, but the language models were not good enough. And then we try it again in like early 21. Like BERT came out and you're like, oh, is there a moment? It was not good enough. And now it is good enough. So to that actually GitHub gets 92 % of all of the questionnaires they receive answered through Vanta. And so you're like, not at 100, but you're like, it's GitHub. They have AI tools. Like they've copiled it. It's a lot.

33:04Christina Cacioppo:And so we're absolutely seeing this. Like the models are definitely good enough. People ask GitHub to fill out security questionnaires before using GitHub. GitHub, and now they can mostly turn around and return those security questionnaires. Yes, exactly. With a 92 % filled out. Filled out. And we have a, it's kind of human, but just it's review and approve. Yeah, yeah. Right. And then like the confidence scores on like prioritizing even for the reviewer. It's like, you probably want, you can look at the section if you want, but you kind of don't have to, whereas like, will you really look at these 10?

33:34Christina Cacioppo:Yeah, yeah, yeah. Yeah. And so like all of that work, like our product does that. Yes. Yes. That's cool. Okay. So where do you think it goes broadly? I think that so much of the work of a compliance team is, again, keeping things in sync, keeping and like different sorts of text in sync, right? Adding on new compliance regimes, which is just adding controls. And then you really want to map the like, you know, new ones to the old ones and figure out what the duplicates are. That's actually a huge part classically of the work of a compliance team. And so I think there's so many opportunities for LMs at agentic workflows in Vanta's business.

34:15Christina Cacioppo:And we've, you know, we probably have a couple dozen of them. And if I think about our roadmap, you know, knock on all the things like, well, like hundreds by the end of the year. But it's just and it's kind of what we've been doing is breaking down what folks do. Right. And so you're like, OK, there's a questionnaire piece. If you send out a questionnaire, someone has to read it on the other side. And then you have to think about it and figure out, you know, where does it work? Where does it doesn't? Oh, I have this new policy update. I need to put this thing in a policy. I need to, we're going to start doing, I don't know, ISO 42001, which is a new AI standard.

34:47Christina Cacioppo:And so how do I map that in? I need to rerun a risk assessment. I'm going to change my like risk score. Anyway, all of these things, all of these tasks are all just like workflows that you You could have an AI do, write an eval against with like subject matter experts, and then he'll climb until they're quite good. And so it feels like, you know, you can reason about the number of people in a profession, especially at a certain stage of company changing. Like if you think back to ancient times, I don't know, the year 2000, if you had a 10-person company with, you know, 10 Gateway 2000 beige workstations, they probably would have had an IT person.

35:29And that IT person would have had to...

35:30Christina Cacioppo:Had the servers in the closet. Yeah, exactly. They had servers in the closet. They had Microsoft Access database. They had to do software updates for all the machines. Occasionally, lint and stuff would get stuck in the mouse ball. And they'd have to take it out and clean it. I've thought of that in one time. And all those kind of stuff. So IT was a real job. Yes. Now, I don't think a 10-person company really has an IT person. No. Because the hardware is super reliable. You just buy a new version every now and then. Everything's in the cloud, so there's no porting data over. They just use Google Workspace for everything.

35:58It works really nicely. And so IT still exists as a profession. There's lots of interesting things. But, you know, Stripe has a bunch of IT people. You don't need a bunch of IT people.

36:06Christina Cacioppo:You've got, like, mail laptops to, like, how many countries in the world, which is, like, actually kind of hard. Yeah, we have some IT challenges. But, again, we're 10 ,000 people. And, again, it naively feels like you will have a similar effect with compliance as we had with IT, where the profession very much stays around. It actually gets more skilled rather than like, I think the stuff we do in IT is harder than kind of the basic IT that a 10 person company would have done. Is that basically where compliance is going? I think that's basically true, yes. So one model we've thought about with Banta, even like pre-AI, is we will delay the point at which you have to bring on a full-time security compliance person or like a kind of consultant who's spending meaningful time.

36:46Christina Cacioppo:But, you know, in the past, if you were an enterprise company, maybe you did that at 50, 100. And it's like, can we actually push that further out? Yes, yes. Because what we see is that an engineering leader or someone in the engineering org can manage more of this. Because they kind of have the mental models and they're usually system thinkers and they can, you know. And they're responsible for it so they can kind of change the stuff. Exactly. Yeah, yeah, yeah. And so you're like, have this, what personas do you call them Amelia engineers? But like, you have the Amelia engineers just like going further here.

37:13Christina Cacioppo:And then you bring on, and then you can bring on a like unified security and compliance person versus like, oh, you have your security person. your IT person, your compliance person. But it's a little bit of like the, kind of what we're seeing in the like engineer PM designer collapse. So you have the like security compliance, IT collapse into one role. So you can keep them unified for longer. Exactly. If you can give them good tools, right? They can do that. Okay, fine. And then again, pre-AI, but then over time that team starts to grow and then you have a GRC team and CISO and all this. What we're talking about now and we haven't seen yet, but if I like had the future cast and guess, is we're going to see actually those GRC teams collapse a bit more into these single threaded owners.

37:56Christina Cacioppo:Taking a GRC team today, there's maybe one person answering questionnaires, one person just reviewing new software vendors, right? And you look at those and you're like, okay, I think you can mostly agent the work and then have someone oversee it with 20 % of your time. But like, okay, great. It's collapsed two into 40%, right? And you're like, okay, you have some person who's like the, who is responsible for bothering the engineers to get evidence for them, you know, when they, for the audit or like to get the control in place because they don't own the control, but they own the program. So they have to go to the engineer and be like, hello, I noticed you have a new database that is not encrypted.

38:35Christina Cacioppo:And like, will you please encrypt it? Right. And you're like, you can just have software go nag that person. Anyway, it collapses. And so I do think we will seek smaller GRC teams, managing agents, But actually in the future. Yeah. And then they are doing more. I'm not doing the security reviews. I'm like thinking about the findings and overall managing this like risk portfolio, this like vendor risk portfolio versus being like, oh, this vendor doesn't have this thing and I need to go get it from. Yeah. I think what you're saying is there's a strategy component to how should we be doing things.

39:08Yes. And then there's an hourly labor component to compliance, which is like, oh, we did 10 times as many sales. we need like 10 times as many bodies on the security reviews. And you're saying that AI will eat up a lot of the hourly labor part of compliance and leave people doing the strategy work.

39:24Christina Cacioppo:Yes. Yeah. Yeah, I do. I do think that. What changes are coming down the pike in the world of compliance? I think there's, to the XKCD, there's lots of folks both trying to make new compliance standards, but it's a little bit of like, what's the difference with the 22nd one? From a Vantip perspective, we've sort of taken a like, we will support them all because we have built a machine. where it is easy to add a new one in. Yeah. But obviously you only want to support ones that customers actually want to comply with. So you're not sure. Well, yeah. But like kind of what we do, actually, we used to spend a bunch of time debating which ones those would be.

39:55Christina Cacioppo:And it was honestly so frustrating. Exactly. Now you're just like build the machine that just logs them in. And so the debate and the document you would write. Do you want to support this payment method? Sure. Sure. Whatever. Yeah, exactly. We did that with compliance standards and integrations because it was just like the prioritization debates were just too intense. Yes, yes. We can take all of that debate time. Anyway, so anyway, there's a bunch of those. Would I bet on any of them? If you really pressed me, I would say ISO 42001, just because it's the European one. I don't know that ISO. 42001?

40:27Christina Cacioppo:You've got to catch me up on this new ISO. It's a good one. My recommendation is bedtime reading. So ISO, you know this, but like European standards body, and it is their version of what one should care about with AI. It ends up being pretty data privacy focused and pretty high level. But those are the counters. The pros are that European enterprises are the ones that care the most about AI, and this is where they would turn. And so it's the thing that has the most market traction so far. But again, none of these are— But none of these are, like, breakout. None of them have product-market fit.

40:58And none of them are regulatory. Like, they're all—

41:00Christina Cacioppo:Correct. You opt into— Exactly. It is like this market has, like, roughly agreed you might need this thing. So there's that. I think the—ah, okay. I'm kind of proud of this. they're like trust if you remember the trust centers they're the security status pages oh sure like trust.blahblahblah trust.vanta.com trust. I didn't know they're called trust centers it's just like a status page yeah but like for your security posture so you get the like you know green bars sort of or green traffic lights or yellow traffic lights but it's for your controls I see and but they always say the same thing like a status page is like red amber green whereas hopefully the trust center always says we're a real compliant boss Yeah, yeah, exactly.

41:44Christina Cacioppo:So there's like a version of that. And so if nothing else, what they actually are, they're ticket deflection for the GRC team. I see. Because when your sales team sends them out and you're like, doesn't it look good? And then if you have any questions, you know, here you go. Yeah, yeah, yeah. It's the pre-filled questionnaire. Yes, exactly. It's like, here's the binder of information. Please read it. And if you have questions for me thereafter, I am here. Does that work? It does, actually. And I think part of it is the just show of strength. Yeah, yeah, yeah. And the show of like, I'm on top of it.

42:11Yep, yep.

42:11Christina Cacioppo:And then there's like, yeah, yeah, read things first. And then if you want to ask me, go for it. Has outbound selling gotten harder now that everyone has a million AI bots spamming everyone? I think what I have heard is phone calls work in a way that I kind of wouldn't expect. For now, right? Until a year from now. But now with emails, like, yeah, yeah, a million AI bots. And I mean, like, how many chat GPT-written emails do you get, you know, in your inbox a day? But outbound phone calls are currently working. Got it. Yes. But again, it's only a matter of time. It's only a matter of time. And I think, you know, then we're just back to like, oh, events, right?

42:47Christina Cacioppo:And especially like small curated events. And yeah. Yes. A topic we talk about sometimes here is on-demand software. Patrick's taken to saying that software should be like pizza, you know, delivered fresh, piping hot. But why are you using software that someone coded five years ago rather than just the computer deciding what to render to you at that moment? Yes. Is that coming to Vanta? It is. It's something we're playing with internally, but like really excited about is having an agent that maybe is guiding you through the process or doing something and then, you know, needs the user to render an opinion or make a connection or, you know, do something.

43:27Christina Cacioppo:And can the agent just generate UI specific for that task so the user completes it and then move on? Yes. And you get this like bespoke agent-generated, hand-generated UI just for that. that does not exist. But are you talking about, because like maybe people have a little bit of a experience with agentic UI where, you know, an AI chat interface is like people's first experience. Has some stuff in it, yeah. And you know, maybe there's like three options you can choose, example. That's like kind of an agentic UI, but you're talking about a full UI. Or like maybe you have that agentic chat bar on, you know, half of the page or a third of the page and then the other two thirds would be a SaaS app, you can imagine, a data table with a view and columns and, you know, rather than just like customizing it.

44:06Christina Cacioppo:You're like, no, no, no, I just want you to do this thing and I will take over that right side canvas of the page, generate the UI for the thing or generate the report. I think reporting is another great use here. And what step of the process would this be? And would this be like you have 14 things you need to fix to get to? So we've thought about it in two ways. So kind of in the like you're setting it up and you're going through. And actually reporting is another, I think, great case. It's like no one wants more, you know, knobs and whistles on their reporting tool. Yes, yes. And also no one really wants to learn SQL.

44:38Christina Cacioppo:Yeah, yeah. You just want, like, I want to report for this. Go. Yes. Generate it. Yeah, yeah, yeah. Like, not quite right. Take this out. That's cool. So when will we be seeing generated UI in Vanta? This summer. Wow. Okay. What has worked well from a go-to-market perspective for you guys? In a way that we don't, we have tried to, but brand spend, honestly. The billboards. We do all the stuff people do of, like, you know, zip code tracking and all of that. Gone call mentions. so recorded sale like mentions of the word billboard on recorded sales calls and then you can track the billboard. Exactly.

45:12Christina Cacioppo:Then you track those deals through to closed one and like that. And you're ultimately doing a geo splish. You're looking at like the locations where you had a billboard versus not. Exactly. And then just like does the prospect say the word billboard in a call at some point. So some of that podcast advertising has been exceedingly effective for us. It's funny because we started doing it in late 2020 and our first salesperson, Eric, who's still at the company, really wanted to advertise, I think, on this week in startups. And I thought it was silly because my model is like the only, you know, companies that advertise on podcasts are like founders who want to hear about themselves.

45:52Christina Cacioppo:Like this is just nonsense. Or mattress companies. Exactly. Or mattress companies. But like, exactly. But like we are neither, right? Like, doesn't everybody really need to talk to you? Anyway. And so that Paulie came to me and was like, I want to spend$60 ,000 on this ad. And my deal with him was like, fine, but you got to sell four more Vantas because the Vanta basically costs$15 ,000. And the next month he sold like 34 more Vantas because of the podcast ads. And that was one where you're like, well, I know nothing. You should keep going. I call this, by the way, I think there's a real, there's the founder negative value out at times for founders have these like incredibly strong views that are wrong, but it's like really hard to remember.

46:27It's good that you let them go and do it. Because sometimes, you know, I think some people would have said, no, we're not doing that. It's silly. and it would have taken many more years to earn the last.

46:34Christina Cacioppo:Yeah, no, the deal is you have to sell four extras. Yeah, yeah, yeah. I feel like I've heard you on the Acquired podcast. We do, yeah. We do, yeah. We do, yeah. We're going to Acquired. Yeah. We do invest, like, the best. Yeah. Yeah. I like those. And I think in the early days, so this was helpful and then deeply unhelpful, but in the early days, before we had competitors, we tried to basically make this call response of, like, someone says SOC 2, someone says Vanta. And this really close association, which in the early, again, when we were just competing against consultants. We wanted to, like, own the term SOC 2, basically.

47:03Christina Cacioppo:Which worked really well until we had competitors who were like, well, we do a sock too, but we're, you know, Vanta but cheaper, but worse but better. And then you're like, oh, that got, you know, like now we're all pointing at a thing we don't own. Yep. And like, that's bad. Yeah. And so there was a, yeah, that's like kind of a, then there was a great reframe on that one. Yeah. What did you learn working with Fred Wilson? USV is a very special place in lots of ways. And I think USV is fundamentally about ideas. More so than other venture firms. Yes. I think most venture firms are sort of great man, great person firms.

47:36Yeah.

47:37Christina Cacioppo:They're about the person and this person will like do the thing. I have no idea what this is, but I like the cut of his jib. Exactly. Yes. And I think USV is, you know, it's just too black and white, but it's like basically the opposite. Whatever person can walk in, but like if it is an idea that is interesting and compelling and intellectually engaging and networked, that is like classic USV. And they've matched back some great people. I don't mean that, but it's just first thing. First, second, and third thing is the idea. And so, like, really pressing on that. It was that piece that I think is, like, very important.

48:14Christina Cacioppo:I think the second part is market sizing is bullshit. You know, you can, like, be as academic or whatever, strategery-ish as you want about it. and like the market size today is only a predictor of the market size today. And I think I like deeply learned that because if you like you just, if you looked at the SOC 2 market in 2018, my best estimate was there was$10 million spent globally and you would never start a startup on that. But the theory of Vanta was like, well, if we can make this thing easier to get and like take down the cost dollars, but really time, more people will get them. And you're like, that ended up being deeply true.

48:58Christina Cacioppo:But that was not a market, especially for startups. The market for startups getting SOC 2 in 2018 was zero dollars. Yes, yes. Truly zero. Yes. Okay, so Vanta is an example of the kind of company that being too tan-grained. Yeah, he would not come up with it. And now it's like, oh, but of course everyone gets it. And you're like, right. But like 2017. Yes. Again, when did Stripe get a SOC 2?

49:25Probably reasonably early on because it's so core. Like it's not a small part of your stack, but definitely before 2017. It's very interesting framing on USV where I feel like you can see this a little bit in Fred's blog and stuff. To ideas. It's clear. Yeah, exactly. Attraction to ideas and a prepared mind for, you know, something like crypto comes along. Exactly, comes along. You're like that thing. You're ready to strike. Yes. And is that across the firm or is that Fred in particular?

49:52Christina Cacioppo:It's Fred and Brad for sure. Brad is the undersung Fred partner. I mean, they started the firm together. Tell me about the Fred and Brad relationship. Yeah, yeah. Brad Burnham is a venture capitalist, mostly retired now, but like X also excellent, incredible track record. He and Fred started Union Square Ventures in, I think, 2002. First fund was 04. Took him two years to raise that fund. If you go look up USV 04 Vintage, like, God, we all should have invested in that, you know. But it was the two of them. And then Albert came on at the venture partner, I think in like 06. And he was on the front of the partner.

50:27Going real deep here, sorry.

50:30Christina Cacioppo:But it was like the two of them. And there is just, it's not yin-yang, it's not the right frame. Complementarity. Yeah. And so many of the ideas of the firm were back and forth by them. And then Fred was excellent at articulating those ideas in a way the rest of the world could understand. which you did on avc yes uh but i think one of the underappreciated things is like how much back and forth there there kind of was there in the creation there yes like that that pairing is i think probably should be in the annals of like you know the coastal door pairing yeah maybe like leone maritz like these venture pairings where you had two people who could play off one of another and they were just like that like i think brad and fred had that for like a decade and a What's the difference in person?

51:21Because like, as I say, Doug and Mike Moritz at Sequoia are very different people. And again, I think that's part of how it works. Yeah.

51:27Christina Cacioppo:I don't think Fred and Brad are as different as those two are. But like, yeah, Brad is cerebral, philosophical, academic, like so interesting to talk to. And you have this wonderful conversation and you'll be like, are there any ties to the business world? You know, but like, but like truly these like, and then like one thing Fred could do was like go back and forth and be like, oh, freemium. and then run with freemium. But it wasn't just, I'm going to market this term. It was a back and forth and the communication out. Wait, did Fred coin the term freemium? He did. Yeah, in a blog post in 2009, I don't know, eight, nine, something like that.

52:02Christina Cacioppo:Yeah, yeah. Right, doesn't that feel like it was just always a term? Yeah, exactly. That's what it's called. In 1952, didn't they talk about freemium? Yeah, it's like when you learn those things like, did you know, seeing the quiet part out loud, that term comes from The Simpsons. In what ways are you a different CEO coming from your experience as an investor? I mean, I wouldn't have done it. It's a real answer. That's a good start. I mean, I was really lucky in approximately 9 million ways with them. One of the ways was for two years, I just like met 15 founders a week for two years straight.

52:34Christina Cacioppo:And I think whatever model I had of like what a founder is or does, was like, yeah, that exists. But like, look at all the ways one can do it. And there's like some coming out, some more successful ones. But just like there's a lot of ways to do this thing. And I think that exposure was super helpful for me because you got to see people who I felt more affinity or similarity to in whatever dimension, like also do it. And it was just like it was kind of the role model thing, but not like one person. Just, you know, you meet a thousand of them. Yes. And you can pick out the pieces. Having all that training data.

53:12What passions do you think you see in people who went on to be successful? or maybe conversely what anti-patterns do you see in the people who

53:18Christina Cacioppo:oh I think there is a like someone said this better than me but like there is a totally a truth seeking piece of it or just sometimes you can bend reality to your will but often like reality is reality and you gotta like embrace it and figure out how to work around it like reality sometimes it's an immovable object and I think there was a there's a delusion to the unsuccessful founders exactly I'm gonna say yeah yeah the like oh no but I can change this and you're like yeah that one I don't Yeah, gravity's gravity, kind of. Yes, yes. Yeah, the version of this I talked about with Des Traynor is I feel like investor updates with a lot of words and no metrics.

53:54Oh, yeah, those are bad. Those are bad. And actually, like, no investor updates is fine. Like, you didn't have to send me a... No is either way. Yeah, yeah, exactly.

54:01Christina Cacioppo:No is either very good or very bad. Yeah, metrics is fine, but, like, a lot of words and no metrics is almost a sure sign of failure. Bad, yes. Yep. Because, again, I think it gets at that delusion. Right. failure to truth seek yes tendency um what else everything famous Etsy and Kickstarter with a bunch of these companies of this era stories where I think I developed yeah this is true this huge appreciation for product market fit that sounds so dumb but kind of now it's still like if you think you have it you don't framing or if you're asking whether you have it you don't yes and so Etsy great example you're like co-founder CEO spent 80 % of his time for kind of years like making people desks because they had this lovely cultural thing that when you joined you were getting like homemade bespoke desks because they sold homemade bespoke things.

54:53Christina Cacioppo:So there's a thing Yancey would make people a desk? Rob, Rob Galen at Etsy would make people a desk. Sorry, I'm getting confused between Kickstarter and Etsy. This is the Etsy version. Yeah, yeah. And you're just like, now you're like 80 % of a CEO's time is making desks and the business is on fire. Amazon had it figured out where you had to make your own desk. Exactly. It's a much more scalable way. Rob made the desks. Yeah. But, you know, you're just like, I mean, it's kind of a funny story, but you're like, the business was fine. Yeah, yeah, yeah. Exactly. You know, and so there are just these things that have, like, their own physical, their own immovable objects.

55:26Yeah, yeah.

55:26Christina Cacioppo:And you can be making desks for people all the time. Doing a podcast. Yeah, yeah, yeah. It doesn't matter. Yeah, yeah. And, like, if you don't have that, you know, it's not that we should all, I mean, maybe we should all go make desks. I don't know. How did, would you make, would you spend time making desks at this stage? I think woodworking is very, I. I don't do it, but I did it as a kid. It was satisfying. Yeah. Last question. Does Vanta expand from here beyond security? Do you start helping people apply with everything else? Just do you continue taking over the world until all the world runs on Vanta?

55:57Christina Cacioppo:Yeah. That's fun. Definitely taking over the world, making desks along the way. No. I think right now we do think about, especially in this world where, in theory, code has become much cheaper, which was two things. So one, it's like, can we add different pillars or verticals? And so there's a whole lot in security, especially for a small business or a mid-market business. I think enterprise, it's a different ballgame there, but there's things there. And then when we think about it, we really think about parts of the CISO organization versus, for the most part, other parts of an organization. But we would think about enterprise risk or internal audit.

56:35Christina Cacioppo:Financial audit is adjacent and interesting. What can you do in internal audit or financial audit? So internal audit is sort of easier for us, given what we've built in a way. It's like we have all of this and, you know, currently we're packaging material and sending it to the auditor. But you can imagine packaging it and sending it to an internal audit. And it's the same thing. It's a controls platform, right? It's like decide what it is that you should do and then validate that you're doing it. Prove that you're doing it. Exactly. Financial audit is the system is similar. It's a different set of integrations on data.

57:07Christina Cacioppo:And so it's thinking through, okay, what is the right point to start building out those ERP integrations, appointments integrations, all of that to get that sort of data to parcel this in. Exciting. Yeah. I'm Christina. Thank you. Thank you.