Christina Cacioppo, Founder & CEO, Vanta

29:28Like I'm really impressed. I didn't. So two things. One is a product manager. Okay. Okay. Yeah. To their point, the recruiters did not know what to do with me because I did not look like things they had seen. And so it was funny. So I went through two or three days of interviews because I was kind of doing two or three roles worth of interviews. Yeah. And then you're like, why did they even care this much? Like, with much respect, the recruiters didn't. But I just kind of knew enough people in good standing internally who were just like, no, figure out what to do with her. I see. And I was kind of like, please figure out what to do with me.

30:07And if you need me to run through five obstacle courses, I am here for that. Right. And so then, like, went through all of these. it was like a there was a bit of an engineer there's like this prototyper role they had there was a pm there might have been designer you know like it was just like go through it all and then see what's left at the end but really it was i mean i did well enough i suppose but really it was the people on the inside pushing for me honestly because they knew you were talented and they're like you should let her just hire her she'll figure it out yeah basically yeah okay okay yeah but still you must have done a good job teaching yourself to code because like she did she's being humble okay I was gonna say okay now we're getting I'm sorry for all of this background stuff but it's very critical to like my social radars you know I gotta get to know you deeply before we get in to Vanta because drop when you are a Dropbox paper that that is When Hackpad, sorry, Hackpad, oh my gosh.

31:07That is sort of one of the things that inspired you to get into the compliance automation business, right? Because Carolyn said, do you know why she chose this industry? And I was like, I do, and we're going to find out all about it. So tell us what happened at Dropbox. Yeah. So I think the little broad arcs at the stage was like 2014, 2015 Dropbox, still like height of Silicon Valley power and prowess. But I think it was also a constellation of apps era. And it was everyone being like, oh, but we're not going to have files forever. Dropbox's business is booming and continuing to whatever double, triple, like quintuple year over year.

31:51But it also felt like, I don't know, it felt like that would stop to the day 10 years later it hasn't stopped. but like right it was like they were trying to make a photo app there was like and I think the the strategy was well what do people put in Dropboxes they put in photos so we'll make carousel they might put in email so we'll buy mailbox they have lots of documents so let's buy Hackpad and turn it into a document editor and so that was kind of the overarching piece and then the um what was the paper team or the became the paper team the Hackpad team was kind of blended it was half Hackpad, half Dropbox people.

32:25And it was all the old Hackpad code base. But anyway, and so we, you know, we had them, we were totally separate from the rest of Dropbox. And we thought we were super cool because you're like, oh, we're not doing the old thing that's slow and has a bunch of people and bad process. And like, we are the cool pirates building the new thing. And we were building the new thing. And it was at this, when I walked in, it was this funny level where everyone at Dropbox had moved off of Google Docs and used paper, called it something else but paper at the time and we could not like pay someone outside of dropbox to use the product and our joke was we had two users we had aj's mom aj was an engineer on the team but we had aj's mom who had never seen google docs so thought like real-time editing was magic and we had engineering manager steve's girlfriend and they were our best users and then engineering manager steve broke up with his girlfriend.

33:17Like, actually, I thought we just had AJ's mom. Oh, no! And we kind of had other users, but we, like, sort of didn't. And that was kind of, like, the state of things. Where we would, like, write Mother's Day cards to AJ's mom. You gotta get more than that. And then everyone at Dropbox was like, this is great. Why hasn't it taken over the world? And we'd be like, can we introduce you to AJ's mom? She loves it. Loves it. And so over time, we started to figure out, you know, how can we make something that – or joke – or not joke. Well, we called them. We're Brandon Street Startups. That was our target market.

33:57We're like, we want all the Brandon Street Startups, Brandon Street in San Francisco, like 2016, to like use paper. and we did i think the short version of it is that actually it's made me like the startup within a startup concept is is very tough because there were lots of things we would have done if we were totally independent that we like structurally or legally or whatever could not do because we are part of dropbox and i think in retrospect we were not very we were like too pleased being pirates on an island and we're not good at attaching to Dropbox and taking advantage. So we just kind of had the downsides and not the upsides.

34:41Anyway, and one of those downsides is we were going to launch and we were going to launch a go to Dropbox.com slash paper and you sign up and you get into the product. And we were like very excited because we needed more users than AJ's mom. So we're going to do this and da, da, da, da. And, you know, a couple of days before one of the lawyers walks over to our desks and is like hey you can't launch to dropbox customers right and you're like pardon he's like no you can't you will violate the contracts and you're like what and he's like you know they go they're the contracts and they say things like dropbox is secure and compliant and pen tested and sock 2 and pci and like blah blah and you're like could you spell those words for me like kind of idiot pm was just like what are you talking about anyway carolyn's giving a real like sort of knowing nod here as you're telling this story being the lawyer um so you were clueless you were just like uh really okay yeah and then you're and then you and then kind of then you like try to be less clueless more clueful i suppose and you know like you're like what are these things you're asking me to do and you're like okay like suck too okay like you need an auditor to come in and vet everything so everybody else then thinks you're fine you're like that makes sense cool buy it it's like great wait, in order to prepare for that auditor, you need to take your whole engineering team away from building for a year and take screenshots out of AWS to show the accountant.

36:06And then you're like, wait, sorry, run that by me again. Like I lost you. And it was learning what it actually was and being like, I get the high level. The way you get there seems generously stuck in 1994. And again, Dropbox 2016, height of its power. Like this is how like the, you know, one of the preeminent tech, private tech companies of the day does this. Are you kidding me? Can you quickly just in a sentence or two, just describe what SOC 2 is? Because it's a, you know, big, big thing for your business. It's an audit that software companies go through. And it's an audit against their IT and security practices and policies.

36:48And so the way it works is first the company defines kind of what they're supposed to be doing. and then an auditor who's actually an accountant for weird historical reasons comes in and is like hey you told me you have two factor on everybody's email will prove it to me and you say okay i'll like log into the g suite admin console and show you this page that has all these locks on it and they say great take a screenshot of that with the date and like send it to me and then you do that basically a thousand times. The accountant will then leave. They will write up everything they saw in this 80-page report.

37:25You get this magic PDF. And for the next 364 days, you can send it to your customers and say, hey, you can have confidence in my practices because I just went through this audit. Here's the 74 pages of information to back it up. This is so painful. oh gosh i can't believe this so all these things to make sure that you're checking the boxes and i will say dropbox was very legit at that point but there's a lot of up-and-coming startups that this is the last thing they have time to do or care about so i imagine no one was doing these audits or freezing their development team for a year oh my god i mean it would have cost a lot I mean, Dropbox could have paid for it for you guys to do it in-house, but like your average startup would, I'm assuming, not be able to.

38:16I mean, not just the year of downtime, but like all of it. It was both. Yeah, yeah. It was like, do you want to give your engineering team away for a year? And you're like, no. No, I don't. No way. And so actually when I was there, to that point, Paper did not have a SOC 2. We were like, we can't give away the team. We only have AJ's mom as a user. Like, we got to solve that problem first. They did it later. But to that, it was just like even it was the same thing. Again, even with the resources that Dropbox had, it just seemed like, well, we don't have product market fit. Why would we do this?

38:46Right, right, right. So did you, just out of curiosity to close this story out, did you try to market to non-Dropbox customers? What was the solution? Yeah. Well, yeah. Basically, we used the Dropbox marketing channels to drive traffic, which was mostly Dropbox users slash early adapters, if you're a Dropbox customer in 2016 to a page where they'd log in and then hit a brick wall. And there's many reasons I think paper didn't tick off, but I think this was not helpful in the effort. Okay, so then you decided to start a startup? I think it was a combo of, to all of my jokes, it was like the pirate on the island thing is very cool, but not what this product needs.

39:30The product needs someone and a product leader who will integrate it with the rest of Dropbox. Like, given these constraints, that is the right thing. Like, that's not me. You know, like, and I can try to be that person, but like, it's not me. And so in that sense, it felt like a reasonable transition time. And then I think the background piece is I wanted to start a startup. You know, I kind of felt like I halfway tried, halfway hadn't a couple years ago. I was sort of, again, resentful. I was like, I want to actually try next time. Like if we kind of stepped up to the plate and walked back, you're like at least swing the bat.

40:08And it felt, yeah, it felt like a reasonable time to like step away from paper. Okay. So did you step away thinking, I'm going to tackle this hideous like compliance quagmire? No, not that smart. No, not that smart. Okay. So what, how did you decide to do it? Yeah, spent kind of, you know, did the thing you're not supposed to do. Spent like three months building a bunch of stuff that no one wanted. You know, being like, oh, what if this existed? cool evade it and showing it to people and they'd be like well I don't want it but maybe my friend which you know it's just like a nice maybe AJ's mom wants it exactly it was like we were like back to AJ's mom you know like bad and did that for a couple months you know it's cool because you're building stuff and then you're like wait this is terrible no one wants my things and so the rule was we were not allowed to build anything else we just can talk to people and you can kind of talk Talk to them about whatever you want, but talk to people until you find someone with a real problem.

41:06And one of the things I went to go talk to people about was security, interested in it. And through that, this like SOC 2 compliance concept came up again. And there was this like, oh, wait, I remember that. That was madness. Like, let me go back and look at it. And long story short, Vanta popped out of that. Just to go back really quick, you quit Dropbox and you had to go tell your mom and dad. Again. Guess what? I'm doing this thing again where I just am quitting with no safety net. I'm just going to do this experimental thing again. And they must have been like, wow, Christina. They were. I think it was easier the second time because they'd also – and I also had seen the like, your worst case is you get a job at Dropbox.

41:48That's quite good. Right? You can be angsty about it, but like, man, is that – are you doing fine? Yeah. Yeah, yeah, yeah. So it was like, okay, do it again. Are you keeping in touch with the people at Dropbox? Just in case. I want to also note the rule was we weren't allowed to build anything. We had to talk to people. You slipped that in, but that's an interesting sort of rule that you gave yourself because you're like, it's not worth even building something if the need isn't there. so what was then when you finally allowed yourself to build what was it it was a spreadsheet so to that because like again we could both code but we i think it was like it's actually a lot easier to change a spreadsheet than change code and so it was a spreadsheet what was called a gap assessment at the time they don't really exist anymore but it was like hey company here's what you need to do for a SOC 2, here's what you do, here's the gap, and instructions to fix in great detail.

42:51And so it was this color-coded, I don't know, 15 by 150 spreadsheet that we made, just go back to YC, we made a segment. Oh, another YC, another front and segment, two more YC touch points. Were you friends with the founders? Yeah, yes. And so that was, they kind of let us, It was like, I know you don't know anything about SOC 2, but I know you'll try hard. And also, I need to know something about SOC 2, and I don't want to deal with this. So like, sure, basically, was the trade. So they were guinea pigs. Yes. Okay. For like a spreadsheet. And so we made this spreadsheet for segment, which they liked.

43:33None of us really knew what we were doing, but we did net confines. And then we wanted to make sure we could actually standardize these because the old part of why people didn't think you could start a Vanta movie with Vanta is because every company was unique and special and had different things they do, which is both true. And when you're a small startup, best practices get you like really far. And that was our thesis. Anyway, so we made the spreadsheet for segment. And we then turned around and basically like find and replaced segment for Front and gave it to Laurent at Front. And then we're like, do you like it?

44:09Can you tell it's not for you? And he liked it. And then we had someone else who heard about it and said, hey, can I get a spreadsheet? And that's where we're like, no, you will get a web app. We will start to build said spreadsheet. Wow, that's pretty cool. Tell us just very briefly what kind of things were on this spreadsheet. You have the 2FA. What else? Just so we understand what kind of doors you need to lock around the company. So there's a bunch of, did you set up your cloud infrastructure at AWS well? Is data encrypted at rest? Is it encrypted in transit? Are the, you know, ways you can log into certain machines kind of locked down and known?

44:51Are the permissions all like closed the way you want them to be closed? So it's like a bunch of like, did you set up your infrastructure correctly? Things. Okay. There's then a set of stuff around people, which basically boils down to like, do you have a hiring process? And do people understand what their role is and their responsibilities in their role are? And do you like check in to make sure they're doing them? And so sometimes this comes out as like SOC 2 requires performance reviews, which isn't quite true. You just have to show, like, we have some structure that is baseline reasonable in how we go about doing things.

45:27I'm curious, how did you learn all this? Were you able to learn all this by just Googling and, like, or did you have to interview people or did you have to talk to government regulators? Like, how did you learn? Yeah, a couple things. So one was, like, talking to anyone who would talk to me, basically. Right? And it started with the Dropbox security team and then kind of fanned out. but it was this whole host of folks there. It was, there was some content marketing online but not nearly what there is today. Actually, the other thing that was really helpful was now lots of companies but big companies at the time you could get their Sock 2s and so it was getting Sock 2s from AWS, Slack, Google, Salesforce, Zendesk and then actually just like opening all of that.

46:17opening all of them and just comparing and saying, okay, for this regulation, what do these six companies do? Okay, for this one, what do these six companies do? And I think that was helpful because you read them and you're like, it's all different words, but it's kind of all the same stuff. And again, there's some nuance, but you can 80-20 it. And like kind of realizing, oh, you can 80-20 this, great. That software can solve. So, Levy, are you super excited about this? that you're this is more interesting once it's broken down it's actually really interesting um as a general concept it sounds kind of unsexy and boring but actually the more you get into it the more you realize like oh this i get it like i can see why this is important and it's actually pretty interesting this is what i like was so gripped learning all about all this stuff and i also have a thing I love when startups solve a problem that any startup could then use and doesn't have to build in-house.

47:17Were you thinking about that? Were you like, let's build something that we can just sell to startups, they all need it, and they'll pay us because they don't want to have to recreate the wheel? Yes, and I think in two ways. One was like, I think one thing I have found helpful in product development, and this might be a YC thing, or it's definitely adjacent to YC stuff is if you like your users, you will spend more time with them and you will build better stuff. And so if you like choose users you want to hang out with and whether that's hanging out in person or hanging out in a WhatsApp group, just like you will build a better thing if you like your users.

47:55Yin Wu of Pulley said this. Yeah. She said just practically the same thing. She's like, I got to talk to startup founders all day and it was so much fun. Right. And so I think there was that, you know, and then you're like, especially then you're like, do we want to hang out with startup founders? Do we want to hang out with, you know, GRC professionals at Fortune 500 companies, which is like now more of my day, right? But at the time, you're like startup founders all day long. So there was that piece of it for sure. I think the other pieces, there's an economist named Ronald Coase who had a theory of the firm.

48:26And it was kind of, it was like trying to reason about what does a firm do and what did they like outsource? And there's like all this economic, like microeconomic literature on it, whatever. I kind of like think it's interesting and cool, but to your point, there's like also a practical application here of in the past teams did all of this in house. And then they might've built their own software. Like this Dropbox would like, because it was pre good recruiting systems, like all the recruiting software Dropbox built itself. Right. And then as like a, um, Greenhouse or an Ashby or a Lever got started, right?

49:00Like no one had to do that anymore. Right, right, right. And so I think, what was this, 2016, 2017, like there'd been enough of you'd seen that greenhouse Ashby lever thing enough to be like, oh, this could have that property. And that is a good property to have. Right, right. You can tell Christine is an econ major, by the way, and reads a lot of books. Yeah. You went through YC in winter 18. So what made you decide, hey, we're going to apply to YC? yeah we talked to so clearly knew yc like a new know it very well um what we actually did was talk to a bunch of people who went through it twice really yeah and to be like why'd you do it the second time tell me more and then people who didn't do it the second time you know and i think the like didn't do it the second time those were more similar it was like i know everybody like everyone's an email away like um good sure i think people who did it the second time were like oh no because the cohorting is really helpful the community is real and if you are doing a business and there was a bit like if you're doing a business focused on startups why would you not and so one of the ways we also thought about it was um did not know how to sell like my way out of a paper bag you know my joke is like prior to vanta the last thing i sold was girl scout cookies which is kind of true you're getting so you're like okay i'm gonna need all the help i can get But it would be really nice to have like a cohort of like happy startups to like experiment, inadvertently experiment on.

50:32You don't obviously want to, but you're like, I'm going to mess it up for a while. Might as well mess it up in a like bumper lane sort of environment than like off a cliff. That makes sense. So you apply, you get in and tell us anything like that was important from that three months and what you remember. Okay, to me, the structure of YC is, and I know I don't have this quite right, but is like week one, week one, week two, get your C legs. Like week three, pick a metric. And if you're B2B, it should be revenue. And if you're a consumer, it should be users. But like pick a metric and then pick a place where it's going to be in three months.

51:16Then do it, basically. and like show up every two weeks you know and tell people where you are where you tell people where you are and where you're going to get to and we call like the accountability scarecrow is you know you have to like um go tell someone you know oh i i said i would have 14 customers and i only have 12 but i feel badly saying this to you so i will have 17 next week right and you have to like do that and then at the end you have to stand up and like say the result and And you remember what it was like to be in that audience. There aren't many people who went through YC that had previously been in the audience as an investor.

51:57How did it feel to be up on that stage? Oh, totally bizarre. I bet. Totally bizarre. But did you make a lot of progress during YC? And I imagine you had a bunch of your batch mates using it. So we actually didn't because then no startup that small got us talked to at all. Okay. But it was YC companies that were like 50 employees. That was kind of the sweet spot. Okay. But you could easily say, I'm Christina from this winter's batch. Exactly. Which 100 % worked. And what I tell people now is like YC companies are just way nicer to each other than they should be rationally. Right? And it's just like, you send those emails, people actually reply.

52:38They might be like, thanks, but no thanks. But like, you'll generally hear something back. They might forward it. they're way more likely to get on the phone with you to talk than, you know, rationally they should. And just like that is helpful at every stage. Did you land any sort of big YC startup that you remember? I did. The thing that's honestly most salient is we so silly in that like first three weeks, you know, set a number and you're like, OK, well, there's basically nine weeks left. And I think I can tell two Vantas a week and they cost$10 ,000. So we'll be at$180K in March. cool ten thousand dollars they cost ten thousand bucks they cost yeah vanta cost no wonder none of your batch mates were uh signing up yes okay and like cool like that seems doable it was so hard but we hit it and i remember being like man i have like crawled across the finish line but like i might feel my head's at ease but like cross the line did you raise money at demo day basically yes did the did the um i think five or six days after yc the round was closed just talk to seed investors like no one who could write an a check because figured if we're gonna speed run this process like i don't want to touch a board i don't want to touch like it's not really a board member but it's gonna be like just just don't touch that with did you turn them away when VCs reached out.

54:07Were you like, no, thanks. We're not looking. We're only doing seed money now. So yes. And then the advice I got was, but like, let's meet the week after. Because like, you're in pitch mode. And you're kind of also like, you're like dialed at that point. But you want to be like, you want to show up and be like, hi, Series A investor. Great to meet you. I just closed a seed round in five days. Like, what do you want to talk about? Yeah. And so did that. did you meet the usv analyst at your day i don't know if they said some actually i think they said a partner at that point oh that's nice you know by the way fred wilson used to come to our demo days in boston i remember he was he wrote i was so psyched he like wrote maybe in his blog or something he remarked on how lovely the cheese plates were.

55:01Like I got these fancy cheese platters and Fred was like, the cheese platters are really, you know, good. But he used to come, bless him. So you raise, you quickly raise a seed round and you get back to work after meeting with the VCs and saying, well, let's keep in touch. Exactly. And you kept in touch for a while though, because I know for, I read that you did not raise a proper Series A until you were$10 million ARR. It's true. Nice. Wow. Nice. Like, again, the dream. Like, no one does that. That is so amazing. Before we go into that, I have a seed story from YC. When I was in the batch, this was when – there were not established norms about when companies started to engage with VCs.

55:54but it was all getting pulled earlier right but it was like NYC would be like don't talk to anyone but then you know the VCs were like sort of attacking and you know whatever and I think having seen that game I knew you just tell them you're too busy earning lots of money and closing deals and so whenever we get an email be like thanks I look forward to meeting with you you know maybe we can set something the day before demo day but like I'm too busy closing deals you know I was more polite, but like, hey, doing a lot of building, working with a lot of customers. Like, I look forward to talking to you at the time we will talk.

56:30See, you followed our rules. Like we say, if you want to be impressive to investors, you got to be making progress. And you're not making progress if you're meeting with them a month before dinner day. So I love that you did that. And I bet that made them more interested in you. Oh, 100%. Yes. Yeah, totally. 100%. So you closed them right away after demo day. Yeah. Okay. So then what made you decide to say, okay, I know there's some VCs interested, but we're really going to push them off until we're ready? For the seed round or the Series A? For the Series A. For the Series A. Yeah. So that was – it was actually kind of similar logic.

57:12and I think again confidence having like a pre I felt like a pretty good model of how early stage investors thought which was the business was working it kind of felt like again I could get I could find a founder get on a couple calls with them and like I don't know 50 percent two-thirds probability they would become a customer and so then you're like okay I have two hours should I spend it like walking to South Park and having coffee and walking back or should I spend it to getting a customer? And like the answer was kind of always get the customer. Yeah. And then, you know, you go to the VC and you're like, well, I have an extra customer, you know, like it was just like, and that will make them want to invest more, not less.

57:51Like, you know, my joke is like, they want to invest in million dollar series A's, error. They'd rather invest in two million error. They'd rather invest in three, like you are getting more, to the extent it works, like it gets more compelling, not less. But you've must have been really good at controlling your burn because from a practical perspective, yeah, what you're saying is obviously desirable, but sometimes you just need the money. You need to hire. So you guys must have been fantastic at managing your business. Yes. So I think there's two things. One was incompetence and one was more planned.

58:20The incompetence is we were just terrible at hiring. Like so bad. Why? So you put it off. No, it was worse. We tried. I think we were coming out of Dropbox that had very structured interviews and like structured rubrics for each interview and intense debriefs and just lots of stuff. And then we tried to do that, which like, I think actually kind of worked in engineering because we had a better idea of what we were doing. But for literally other, every other role, like I couldn't spell CSM. And so then I tried to construct this interview to like find a customer success manager. And it ended up being like seven stages.

58:58And again, like somebody had to go through an obstacle course. Yeah, it was just, and then we like, at the end, we're like, well, you got through the obstacle course, but like, what is a CSM really? You know, we just like did not. We were just like did not. We were doing a totally overcomplicated in it. And so hired really slowly. So there was that. Which is good if you're trying to control the burn, though. Hiring slowly. The other thing we did, which was more purposeful, and shout out Peter Reinhardt from Segment, is he had a blog online that had like five posts on it. You know, he'd like write a post every nine months.

59:33But they were all really, really, really good. and he had this like two-part series on like finance for startup founders and he had this post about cash and charging annually up front versus quarterly versus monthly and this like cash flow chart and I didn't totally understand it except I could tell that like oh annual is better and so selling Vanta for$10 ,000 at the time I just say oh yeah it's like$10 ,000 and like all 10 ,000 are due tomorrow, basically. And people are like, okay. And be like, okay. And so we, that's also how it worked is like we'd basically take the new business revenue for the month, pay people with it, and then like do that again and again.

1:00:17And the bank balance kind of stayed the same. But this is really critical because you reduced the friction by reducing the decision-making process. So customers didn't have to think, gosh, should I just get Vanta for a short audit or pay monthly? Or it was just one option, annual cost there. And the 10K, how confident were you guys in that number when you first threw it out? And how did you come up with it? Because it obviously was kind of like the right number. So when there was still a spreadsheet, I did take the spreadsheet around to some founders who'd seen it and said, okay, what is a reasonable price, an expensive price, prohibitively expensive price?

1:01:04And basically people said expensive was$10 ,000. Okay. But what's a prohibitively expensive? So that's kind of where we started. That's what I would think too. Like 10K doesn't like knock your socks off and feel like, oh, it's terrible. But it also feels like, okay, this is really going to matter because I'm paying for it. Like, yeah, I get that. That's really smart. Yeah. And then when I was kind of after YC, when I was selling a bit more, I would try to do the like, oh, if somebody doesn't blink, when I tell them the price, I'll tell the next person the price two times higher. But then I got a little scared and I started just emailing invoices and then people would ghost me.

1:01:41And, you know, you're like, you learn all that stuff not to do. But I was sort of like walking it up, trying to figure out where people would really oof. and the first salesperson I hired three, six months after that, I think kind of quickly realized and was more right, was like, I can play that game, but I have to go back and forth five times. If I say 10K, everyone just bails me money. And so he just said 10K and he was selling, you know, lower than I was, but he was closing four or five times as much as I was. And you're like, ah, you're better at this. So you continued to do your own sales for a while, it sounds like.

1:02:16I did the first$500 ,000 of sales. Okay. Yeah. Which I do tell, I mean, you know, of course you give advice that you feel like work for you for good or bad, whether or not it did. Um, but I feel like it helped cause you're like, and I would sell like a product manager for good and bad, but you'd like show somebody something and be like, well, what do you think? Like, would you use this? Would you use this? And I found it, I think cause I was telling to engineers that worked. And then I found that really helpful and like, okay, what should we build? What should we do? What do people understand?

1:02:44What do they not? I know we're coming up on the end of our time together, but I need to ask you about being a female founder, because you are up there on YC's leaderboard for successful startups with a female founder. And, you know, you're a role model, and that's a byproduct of your success, which is amazing. Do you feel like one? does it impact you or you do you ever think about that i mostly try not to honestly because i don't uh i haven't figured out how to channel that into something that feels like obviously helpful i do entirely wish there are more and it was less notable like my again i have a couple quips but one of them is like well more women should start an enterprise software company like it should be less notable um right right and like deeply that you know and again it's kind of a quip because it's easy to say and harder to figure out how to action.

1:03:42But I do deeply believe that. I, by the way, I don't think you need to channel it into anything other than doing what you're doing. Vanta is taking over the world and you are the CEO and founder. I'm going to like start to cry because it doesn't, it is, it doesn't happen every day. And, you know, YC has been around now for 20 years and there aren't a lot. And so like, I'm going to cry only because I'm so proud and happy about it, but just, just keep doing what you're doing. And that's how you're the role model, I think. Thank you. Well, speaking of keeping doing what you're doing, so you've been doing it for a little while and you're pretty young.

1:04:29And so, and we've talked about this with Paul, for example, when we had him on and he said, didn't he say, don't, someone said to him, And don't let this be the last cool thing you do about YC, right? So do you ever think about like what's the next cool thing I'm going to do? Or are you still too – like is it just too early to even think about that? I think too early. You know, I think people – I do get asked would you like start another startup? And yeah, I kind of give the like honest and somewhat incohate answer of like yes, sometimes I have days where you're like, man, if I did this again, I would like be so much better at it.

1:05:04or at least make like very different mistakes next time. And then sometimes I have days where you're like, this is really hard. And can I just go make art somewhere? And it doesn't matter if anyone likes my art, you know, there's no consensus. It doesn't matter. It just is art. And I don't know where I'd actually fall on that. Good. Because if you'd said there are all these other things, I'd be getting nervous because that would not be good for Vanta. for you not to be focused. Well, awesome. We will let you get back to running your company. Thank you for coming on the show. I think the listeners are going to love this one.

1:05:48Thank you so much. Thanks, Christina. It was great to chat with you. Thank you so much. Bye. That was so fascinating. And I just love her story. I hope the listeners find this fascinating because this is like a different entry into the startup world than a lot of the people we've interviewed. And like she taught herself to code in her 20s. I know. That's so cool. It's beyond cool. I wish that had been me. I know. I'm so impressed. And she's one of Y Combinator's most successful female founders. Well, and the other thing that she said early on that I just hope we all remember is how like having your boss say you're not the fake it till you make it type, I think is a huge compliment because it just means like you're genuine.

1:06:34You are not bullshitting anybody. You're really legit. And I think that's it. I think that's awesome. I think it's a huge compliment. And I wonder if she was saying, you know how she was saying she'd rather get another new customer than go meet with a VC. I wonder if that's because she had such great product market it fit that it's actually super fun to go through that sort of sales process. Oh, I'm sure. I'm sure that's part of it. Also, just like, I'm not going to sit here and tell bullshit about this product that I'm not done building, haven't sold enough of, waste my time having coffee. I'd rather just build it, sell it.

1:07:11Yeah. I mean, I think that's how genuine she is about this. I feel like if someone's like, what, how should, what do you think a good founder is? I feel like I'm going to point people to this episode because she did so many things the right way, even though it's tempting not to. It's tempting to do things like meet with investors instead of closing customers. You know, whether people want to admit it or not, they do it the wrong way. Yeah, I'm really glad we talked to her. Well, this is going to be a great episode and I can't wait for it to come out. Yeah, same. All right, Carolyn. I'll talk to you soon.

1:07:47Bye. music music music