In short
Vanta’s CEO Christina Cacioppo explains how Vanta turned SOC 2 security/compliance into a scalable product, why distribution and constant delivery mattered, and how AI agents are now being used to automate GRC (governance, risk, compliance) work and move toward continuous, real-time trust signals instead of static questionnaires.
Guest backgrounds
Christina Cacioppo is CEO of Vanta (founded 2018; YC alum). She previously worked at Dropbox on products. Vanta serves ~16,000+ customers across startups and larger firms, including Lovable, Snowflake, and Icelandair, plus healthcare companies.
Key claims
Early investors doubted compliance was a “product category.” Vanta won by making SOC 2 faster/cheaper (months vs 18+ months; ~$25–30k vs $50–100k) and by doing the real work behind the scenes. AI agents now learn from 10,000+ security programs to guide next steps and reduce manual compliance labor.
Notable examples
SOC 2 questionnaire automation; “two-factor on all email accounts” as a prescriptive control; integration count growth (80 to ~300); agent-driven dashboarding vs rebuilding Power BI; continuous visibility to prevent offboarding/access mistakes.
Written by AI. May contain mistakes. Listen to the episode to check what was said.
Chapters
Tap a time to open that second in VOUnderstanding Vanta's Value Proposition
0:57 to 2:58
Exploration of how Vanta simplifies compliance and security for startups.
“Also, this has nothing to do with the show, but go Knicks.”
The Shift in Startups' Approach to Compliance
2:58 to 6:10
Insights into how Vanta helped startups prioritize security during rapid growth.
“How did you get startups to see the need for this solution, to care about this?”
Tech Innovations and Customer Engagement
6:10 to 9:30
Discussion on Vanta's tech developments and customer engagement strategies.
“You would have just punted it off and like kept doing questionnaires.”
The Role of AI in Compliance
9:30 to 12:40
Exploration of how AI is changing compliance and security operations at Vanta.
“And so, for example, it's like we've seen over 10 ,000 startups, security programs, and we've seen them mature.”
Christina's Journey to Building Vanta
12:40 to 14:00
Christina Cacioppo shares her personal journey and insights on security and compliance.
“And this is both a great skill and a great detriment at various points.”
Christina's Journey from Dropbox to Compliance
14:00 to 16:43
Learn about Christina's unexpected path from Dropbox to launching Vanta amidst skepticism about the compliance market.
“And like that is valuable and interesting.”
The Lean Startup Approach
16:43 to 19:58
Discover how Christina and her team achieved significant revenue before raising major funding through a lean startup strategy.
“Given those priors, given the fact that like I was selling initially and I did not know what I was doing and it was working.”
Financing vs. Company Building Success
19:58 to 20:12
Understand the crucial difference between securing funding and building a sustainable business.
“And I think the founders that optimize for private market valuation will get that.”
The Dangers of Valuation Hype
20:12 to 22:34
Explore the implications of rapidly rising valuations in the tech industry and how it affects startups.
“That is different than actually having a good business.”
The Dangers of Valuation Hype
23:03 to 23:43
Explore the implications of rapidly rising valuations in the tech industry and how it affects startups.
“These days, you can chat with AI about almost any business problems.”
Show all 19 chapters
Scaling and Product Velocity at Vanta
23:57 to 26:21
Delve into the strategies that enabled Vanta to scale rapidly and remain competitive in a crowded market.
“When you think about what really did get you to that escape velocity, where you guys did start to scale faster.”
Navigating Company Growth and Change
26:21 to 28:00
Christina discusses the challenges of managing a growing team and adapting to new technologies.
“We talk on the show about this moment also like an upstart moment where you were really back to the wall punching above your weight.”
Challenges of Dashboarding in Vanta
28:00 to 29:06
Explore the challenges Vanta faces in providing effective dashboarding solutions for enterprise clients.
“Everybody's always asking for more dashboards to see product usage.”
The Role of Agents in Security Processes
29:06 to 30:48
Discussion on how agents can enhance security processes and provide real-time visibility.
“Could I like have a dashboard with some filters, please?”
Evaluating Security Practices and Compliance
30:48 to 32:58
Delve into the balance between compliance checkboxes and meaningful security practices.
“But two, I think that's actually also a lever to improve security.”
Future-Proofing Vanta Against Competition
32:58 to 35:08
Insights on how Vanta aims to stay competitive and relevant in the evolving market.
“Like, leading with like, here are reasonable security things.”
Navigating Competition in the Tech Landscape
35:08 to 36:24
Discussion on handling competition and maintaining focus within the tech industry.
“Or is it annoying because does it create churn or noise about the category?”
The Evolution of Challenges at Vanta
36:24 to 37:51
Reflections on how challenges at Vanta have evolved over the years and staying motivated.
“Like, what are they doing that's interesting that we're not?”
Reflections on Growth and Future Aspirations
37:51 to 40:35
Christina reflects on her journey, the growth of Vanta, and future aspirations.
“To me, that's when like fatigue, burnout sets in.”
Transcript
Automatic transcript. May contain errors.0:00If you found a money printing machine, you probably wouldn't tell everyone about it right away. Vanta figured out how to talk about security and compliance before anyone else was taking it seriously. Today, it's valued at$4.2 billion. Our guest today is the CEO of Vanta, Christina Cacioppo. Vanta and Christina help brands like Lovable, Snowflake, and Icelandair with their security and compliance. But when Christina and her co-founders started out, investors told them, this isn't a business.
0:27Christina Cacioppo:The polite version, which everyone was polite, to be clear, but was like, this is not a product category today. This is like a fragmented service category. But again, not in like the cool 2026 way, like in the like, that's not a business 2018 way. They're going to acquihire themselves to somebody in a couple months and like, they're not actually going to work on this. Who wants to work on compliance? And no one totally said that outright, but that was like very much the vibe. This episode is brought to you by Rippling AI, work AI tools that are more than just talk. Today on the podcast, we're going to talk about why distribution can sometimes matter more than product, how Vanta cleverly reversed engineered access to top VCs, and how the rise of AI agents has changed everyone's security needs and how Vanta builds internally.
1:11Also, this has nothing to do with the show, but go Knicks. I'm Alex Conrad, founder and editor of Upstarts Media, and this is the Upstarts Podcast, our weekly show about startup founders who punch above their weight and take on the status quo. Christina, welcome to the podcast.
1:27Christina Cacioppo:Thanks so much for having me. Vanta is a company that's been around since 2018. You started out with this sort of wonky security thing called SOC 2, right? How do you explain what Vanta is to a normal human? Yeah, we help companies understand their security posture. So it's like layman speak of like what security practices they have and they don't have and perhaps should have. So like understand the lay of the land and then implement those security practices. and that's a bunch of hard work. And then we help them get credit for all that hard work with their customers who audit security questionnaires, but it's basically we help companies earn trust by doing good security and then prove that trust to their customers.
2:06And so you went through Y Combinator, you started working with other startups. Yeah. But today I know you also work with non-startup companies too, like Iceland Air, a bunch of healthcare companies. Yes. When we look at those maybe 16 ,000 plus customers who use Vanta, what is the sort of ideal customer or typical customer today?
2:21Christina Cacioppo:It's funny. We actually thought we would start with like 50-person companies because that was like where the market for SOC2 started back in 2018. And then I think because Vanta's guidance made it so much easier to get because it was just here's a set of things. Like here's the security practices you should have as a small company. We started serving other YC companies. So we still call that the like two founders on the couch. So that's where we started. And then right now we have expanded into like kind of small enterprise, I would say. We have so much larger companies, but in general, kind of like anywhere from two founders to like a couple thousand people.
2:57Christina Cacioppo:And at that, it's a whole team that's running audit, certainly, but like risk, compliance, security operations, like much broader scope and sense. How did you get startups to see the need for this solution, to care about this? Because when you're building really fast, focused on day-to-day survival, you may not think, oh, how am I going to be audited? Yeah. So we also thought that would be quite hard and running around and I did some of this in early days running around and being like, hey, startup, don't you want to be more secure in general? Wasn't the best pitch. Like generally folks would say like, well, yes, I do want that.
3:34Christina Cacioppo:But when I go into the office and think about what I work on next, it's whatever the customer asked me for, not like what I desire. And so what we did was we leveraged SOC2, which was this existing thing that at the time was like this like procurement gate or blocker. We'd be like startup trying to sell to big company. Big company would say, hey, cool technology startup, but you're going to take a bunch of our data. How can we like be confident you're going to do reasonable things with it? And the answer was either like get on the phone with them, be like, I went to Stanford and I am a good engineer and I worked at shiny companies and like you can trust me and this whole song and dance.
4:07Christina Cacioppo:Or the answer is basically get a SOC 2 audit done, which like shorthand for that is like do a bunch of work, have a trusted third party come in, verify you did the work, have them write it up and then send that PDF to everybody else. And so like we were just like, hey, founders, we'll help you implement a bunch of security things. And then that PDF will come. You'll get that report and you can go use it. And so think of Vanta being the way you get SOC 2. So it was like a painful questionnaire that you might have to fill out versus weeks of phone calls. But that questionnaire would be manual and really time consuming and something no one really wanted to prioritize.
4:46Yeah.
4:47Christina Cacioppo:And it'd be painful and manual because it was like, what encryption standard do you use on customer data? And you'd be like, oh, I can't remember that off the top of my head. Let me like log into the AWS console and just repeat for 500 questions. And, you know, encryption standards don't change that often, but some of the stuff did. And it would just take all of this time. When you're doing that, you're just like looking up facts in a database somewhere, right? Which even pre-LLM felt like a very silly use of like an engineer's time. Obviously, AI is going to change some of that and already has.
5:16And let's talk about that more in a bit. But I guess early on, I'm curious, was it really just the time saved and sort of the headache removal that made Vanta valuable?
5:26Christina Cacioppo:I think it was actually like founders and earlier stage companies could get something they couldn't get otherwise. Really? And like, could they go get a Sokta without Vanta? Totally. But it would take, you know, 18 plus months. It would probably cost 50 to$100 ,000. And so the Vanta at the time was like, maybe it'll take three months. So down from 18 and it'll cost you all in 25,$30 ,000 down from like 50 to 100. and like you can have your new engineer do the work instead of your CTO. And so is that combo of like overall time, dollar cost and like CTO time. You couldn't even have done this before.
6:10Christina Cacioppo:You would have just punted it off and like kept doing questionnaires. And now you can get the, we used to call it the like the monopoly, like, you know, pass, go and collect$200 card. That was kind of what a SOC 2 was without the, you didn't collect$200. It was like pass go in enterprise procurement. You could like go to the next stage. It was like that monopoly card. When you think about sort of what you guys were doing behind the scenes to make that happen. Yeah. Was it a tech unlock? In the early days, we actually we did a bunch of scoping work and spreadsheet work basically to convince ourselves we could build automation for all parts of a SOC too.
6:45Christina Cacioppo:And we got ourselves confident on that and then we had to go build it. And in the process, we wanted like intermediate validation. So we'd like work with customers. And the pitch to our customer was like, we will get you through this audit. Some of it will be software, some of it will maybe not, but we promise we will get you through. And to our customer, they're like, great. I don't really, you know, again, I'm paying you for the outcome. I don't really care how you get there. That worked behind the scenes. Again, we had folks, we were like both building things. And then there was one or two GRC experts, like compliance experts on the team who are running around and doing things manually in the background.
7:19Okay.
7:19Christina Cacioppo:And we weren't charging. Like now we would call this a like forward deployed engineering motion. It was 2018. So we didn't call it that. We just like mostly didn't talk about it. And investors would be like, aren't you a services business? And we'd be like, no. Anyway, we should have just called ourselves forward deployed engineers. and maybe we'd be like valued at 10x where we were. Well, I guess Palantir had those, but it hadn't become this moment. But it wasn't as cool. And it was, I think it was seen as like, oh, you need those, not today, where it's like, oh, you have those? Maybe we should add a zero to your valuation, right?
7:46Christina Cacioppo:Which is like a little, you know, anyway, it's a statement on the times. So there was some amount of like fake it till you make it. But by fake it, we were like running around, scurrying behind the scenes, like doing the work manually. And I draw that contrast because I think there have been some newer and now more defunct entrants to the space that may have gotten popular on Twitter in the last couple of months, where it was fake it till you make it, but also just like don't do the work. Like people are not compliant and you're not running around and doing it, which is just a contrast to how we ran things in the early days because we figured if we want to be a compliance company, if we want to be a trust company, we've got to actually like do the thing we tell people they're doing.
8:24Christina Cacioppo:And again, maybe it's our software, maybe it's not, but that's our problem, not the customers. That is one interesting place where this AI moment has kind of changed the startup paradigm. It used to be fake it till you make it was sort of what you're describing, which is maybe it's a more manual. Do things that don't scale. Yes. Just like me vetting people for my upstarts events by hand, checking LinkedIn accounts. Like hopefully we don't do that forever, but at least we are vetting the people. And I think now there's this fake it till you make it, which is let's vibe code or use AI to sort of approximate substance, which is not what you were doing.
8:56Christina Cacioppo:It's not what we were doing. It's not what we were doing today. And I think there are spaces in which you can do that. I've never believed security, compliance, trust are spaces in which you can do that. You're selling an outcome that is high anxiety and kind of morally laden. When you've got that combo of things, you've got to do it all the way through. We'll dive into it more later, but at the highest level, where would you say AI has been the biggest difference then in how you guys are thinking about your sort of back end or what that value prop is for the customer? Yeah, we're reorienting pretty much everything we're doing around an agent that understands GRC generally, but, you know, the models do that, our, like, aggregated sense and anonymized sense of, like, customer patterns and data.
9:44Christina Cacioppo:And so, for example, it's like we've seen over 10 ,000 startups, security programs, and we've seen them mature. And so it's just like our agent knows what at every stage, like what might you want to do next? What are your peers doing? Let's slice it that way. Constantly teaching our agents more tasks and skills to use here with the idea that most teams cannot hire a compliance expert or a security expert. And then if they do, that person is like very quickly snowed under with work. And I don't think that job will go away. But I think to your point, those people's jobs have a lot of check the security questionnaires, draft the policies, track people down to see if they did their training, nag the engineer to fix the thing in the cloud infrastructure account, deprovision the accounts.
10:29Christina Cacioppo:It's just like all of this like manual work that is not additive or like risk adjusted. And it's important. It needs to be done. But we want to give those folks and engineers this agent that can go do all of that so they can think at kind of a higher level. It's sort of the like agents doing tasks, not jobs framework. Right. I think these jobs will still exist. I think they'll just like have very different tasks in them. Now, you mentioned GRC. I know what that is because I've written about Vance before and I should disclose that we have partnered with Vance on a few events, which has been really fun for people who are totally cold here.
11:04They're learning about this again for the first time. Redefine GRC.
11:07Christina Cacioppo:Yeah. So it is this like old school acronym for governance, risk and compliance. And it's basically this bundle of three pieces where governance think of is deciding what it is, like what security practices your company has and what you're following. Risk is being like, what are the risks and what should we do about them? And then compliance is like, OK, given the kind of philosophical governance pieces, given those risks, how should we think about guarding against them and implement what security people call controls and normal people just call like rules you follow? But it's like the bundle of that.
11:43Christina Cacioppo:And so in a larger company, they might have a GRC person or a GRC team. A smaller company does not have that. And this often falls to an engineer who is like Googling or clotting like what does GRC mean? How do I GRC? How to GRC? Yeah, yeah. Literally. And I think to your AI point, it's like the Vanta AI agent can be there like how to GRC. That person knows their business. They might know the tech stack much better. The agent knows GRC and the combo creates like much better security outcomes for the business. When you were growing up, did you think to yourself, someday I'm going to run a GRC unicorn leading startup in the compliance software category?
12:25Definitely.
12:26Christina Cacioppo:We used to joke. It's like some founders can do the like, when I was five, I wanted to put, you know, people on Mars. Yeah. No. No, when I was five, I did not want to be a JSC person. I think, and sometimes to a fault, like one of the through lines across my career and kind of my life is like, I can just, I can, I'm someone who can be interested in lots of things. And this is both a great skill and a great detriment at various points. But I think I got, you know, eight, 10 years ago now, really interested in security on the internet. Just seemed big, important, unsolved, competitive. Like there were a bunch of like getting worse.
13:01Christina Cacioppo:The more we were worried about security, the less we would trust software. And I'm like, you know, like I think software can, I still think in 2026, software can do great things for the world. We have to trust it to do it. And like this burgeoning security threat anyway, just started to like learn about all of that. And then through that kind of got to compliance. And very much initially it was like, oh, like who, you know, again, who wants to, who dreams of working on compliance? Like whoever thinks they're going to do that. But then I realized like we read. It's actually just kind of misunderstood.
13:29Christina Cacioppo:Like it is seen as this like nonsense tax checkbox BS, basically. And it can be that. But I also think it can be the way you get credit for all the security work you did. Because unfortunately, like no one wants to like read your, you know, vulnerability scan that has zero results. Like no one cares. Right. But when it's kind of rolled up into something closer to the business, that's when this stuff starts mattering. And so I thought of compliance as like the output of good security and how you communicate that good security to your customers and regulators and board. And like that is valuable and interesting.
14:06You were at Dropbox working on products there. And I think the lore, at least, is that you kind of see the problem firsthand at Dropbox. Yes. Is that, OK, you see this problem. You think, oh, this is actually kind of interesting. Was it sort of obvious then that you should build a startup? No, I wish.
14:23Christina Cacioppo:That's like the much cleaner story. And the much more like founder prestige story, it's not true. I think the like meta take is like it was like prepared mind, like ran into the problem on Dropbox and then heard compliance, heard what you had to do, like ran screaming from room, like did not return. Like don't want to work on that. Doesn't sound helpful. Not going to help put a room in a good fit. Like eject. And then flash forward like a year and a half. And again, in this like going and looking at security, I start to hear about compliance again. And I kind of remember it as like, oh, that was that like terrible scream from the room thing.
14:57Christina Cacioppo:But people keep bringing it up. What was that again? And so, yeah, it kind of it's the more complicated and real story is there are these two parts. There was like no enough about it to kind of remember the words and have a place to like think about them. And then two years later, like run into it again and go much deeper. So you were initially more interested in sort of the wider security issues? Yeah. Which is ironic because you're being pulled into those today, right? Yeah, it's actually really satisfying, honestly. So when you start the company, did people think this is too small a market?
15:31Yes.
15:32Christina Cacioppo:The polite version, which everyone was polite, to be clear, but was like, this is not a product category today. This is like a fragmented service category. But again, not in like the cool 2026 way, like in the like, that's not a business 2018 way. Maybe talented team, shiny backgrounds, but like they're going to they're going to acquihire themselves to somebody in a couple of months. And like they're not actually going to work on this. Who wants to work on compliance? And no one totally said that outright, but that was like very much the vibe. Now you get credit for taking an approach that is very popular.
16:05this lean startup approach where you reach 10 million in ARR, annual recurring revenue, before you raise a big Series A funding round. I think you had a little bit of funding.
16:14Christina Cacioppo:Yes, which you wrote about. Which I did. Yes. I guess to this idea that you reach all this revenue before you raise. Yeah. In hindsight, how much of that was necessity versus priority? Priority. And I pushed it too far in retrospect. There was definitely the chip on shoulder underdog. Like, y 'all think this is a small market. You're wrong. You know, y 'all think we won't stick with this. You're wrong. Totally. There were definitely parts of that. But then there was also the like, oh, my God, this is working. And we are scaling revenue so much faster than we should be able to. Given those priors, given the fact that like I was selling initially and I did not know what I was doing and it was working.
16:49Christina Cacioppo:And that is like a credit to product and problem space. Then it was this, oh, if we go like tell everybody, run around Soma and tell everybody this is working, we will have seven copycats tomorrow. and while they will copycats will come eventually and they did would rather that happen you know six months from now not now so like we can get more of a lead in zero to one peter thiel had this concept of like a startup secret and it was just like what's the thing you know that others don't that you can run on and it felt like we had one of those or something approaching that it was like we know this is a great market we know it's going super quickly everyone else thinks we're running down a dark alley fine great you know like we're not but you think that well we keep running I remember now when we wrote I was at Forbes at the time and we wrote about you getting backed by Sequoia, obviously a very famous firm.
17:38I remember the story at least was that the partner there kept seeing Vanta popping up in their portfolio companies and was like, who is this software that all my companies are using? Yeah, yeah.
17:50Christina Cacioppo:That actually we did realize that at some point it was less. We didn't play the game with him, but we did realize because investors would message us again in the early days and be like, how do you know about us? And it was like, oh, you came up in two board meetings this week. The sort of metagame thing was like, oh, if we find an investor we want, we should just go sell all their companies. Because like that is how you do get that deal done. Did you ever do it? Yeah, we did. Amazing. Amazing. I mean, the VCs pull similar games, so I think it's only fair. Yeah, yeah, yeah. Right. If you understand their games, you can like figure out the proportional games and measures and countermeasures.
18:22There's a great quote you gave me in 2021 that I'm excited to share. If you confuse financing success with company building success, you'll only get one of those things. Yes. I think that's deeply true still. What did you mean by that? And do you think it still applies? I think it still applies.
Read the full transcript
18:37Christina Cacioppo:And I think there's lots of folks who are like messing it up and are well intentioned. What's the original idea of the quote? The original idea of the quote is the ultimate game is to build a good business. Like that is the goal and what you're applying for. And if you have a good business, it will be hopefully easier to get acquired for lots of money. It will be easier to go public. It will be easier to like make a thing that's very valuable in whatever kind of form or fashion you want. And raising money and having, you know, some smart private market investor put a private valuation is like really cool and feels good and kind of doesn't mean more than that.
19:11Christina Cacioppo:Like one person decided to wake up that morning and pay that price for your company. And I think, you know, you see it and Vance is private. So, again, I live in a glass house, so got to be careful with my stone throwing. But like, you know, you see it in the private markets and the public markets and all the public market CEOs. You're like Dylan Field and, you know, Drew Houston and everyone being like public markets are different and good and like enforce a different rigor. But like it is a different, more rigorous thing than like private valuations. It is a lot easier to optimize for high valuations in the private markets.
19:47Christina Cacioppo:Because, again, you've got it still hard, but like you've got to incrementally convince a small group of people that your company will be like the next thing said sliced bread. Fine. And you can do that, but it is a small group of people, whereas the public market, it's a large group, like weighing, you know, Buffett weighing machine, like large group of people. And I think the founders that optimize for private market valuation will get that. Like founders are probably good at optimizing or like people who are good at optimizing are good at optimizing truly. That is different than actually having a good business.
20:19There have been several startups that have gotten a lot of attention recently for raising multiple big rounds within a couple months of each other. And from a narrative standpoint or at least a momentum standpoint, it seems like they get a lot more attention and publicity for that.
20:35Christina Cacioppo:They do. And these valuations, to your point, are quite high. Like you guys are valued at$4.2 billion as of last year, which in the old days when we were starting our careers would have made you one of the most valuable startups in the world. And now there are AI companies that don't have a product yet that sometimes get that kind of valuation. Is there a disadvantage from playing that game? I think in the short term, yeah. Like, OK, there's definitely a short term disadvantage. I used to believe there was a long term advantage because, again, there is to the fake it till you make it. There's also a hype cycle game that sometimes works.
21:08Christina Cacioppo:And one model someone gave me was like B2B SaaS or B2B software, not SaaS per se, AI, whatever. However, B2B in 2026 is much more like crypto in 2021 than B2B in 2021. The hype matters. The hype goes into the next round. When you have that round, you have the valuation, you get more investors, you get more customers, you get more employees. Hopefully then you're like using that to build real things and rinse and repeat. But there is like a hype fake it till you make it game that I think can work. And I think we probably both know of like strong companies that have played that well. We also probably know of some less strong companies that are going to play that into a wall.
21:46Christina Cacioppo:But yeah, I don't think it's as clear as, you know, which works better in the long term as it used to be. I do talk to founders who are like, I feel like we've always had a better product than Competitor X. But Competitor X has just always gotten more attention. And so with some people, it doesn't even matter because we can't get in front of them. Yes, this is so real. So I think this is very real. I think Vanta went through a phase of this and then we started just like punching back and, you know, feel infinitely better now. But, yeah, I think it's like better product should always win and doesn't.
22:19Christina Cacioppo:I think another lesson I actually want to start a cruise of 2010s tech was like, and this is more consumer, but I think it shows up now in B2B, is like distribution matters so much. How many, you know, Snapchat, Instagram stories, like great case study we're all super familiar with, right? The joke's what happened in Spiegel. It's like Facebook's chief product officer, right? Like they're funny because they're true and they're painful because they're true. Anyway, and so in B2B, I do think there's like you have to have a good product, but you have to have distribution too. If somebody is out distributing you with a reasonably good product, that is tough.
22:55Christina Cacioppo:Now, if they're out distributing it with a bad product, I do think like, again, that works out, but it works out in the long run and you got to be alive in the long run too. These days, you can chat with AI about almost any business problems. Rippling AI is built to actually solve them. That's because Rippling AI is built on your live workforce data. That gives you full visibility into your startup and the ability to take action across every department. Say you have a new hire starting Monday. Just ask Rippling AI to get them set up and it will provision their laptop, grant them access to your systems, assign their onboarding tasks, and loop in their manager.
23:29But it doesn't stop there. Rippling AI can flag missing paperwork, set up their first one-on-ones, and make sure they're ready to ship on day one. All you have to do is tap confirm and get back to building. Don't settle for AI that's all talk. Head to rippling.ai slash upstarts and get AI that turns insights into action. That's r-i-p-p-l-i-n-g dot a-i slash upstarts.
23:54Christina Cacioppo:Sign up for exclusive access today. When you think about what really did get you to that escape velocity, where you guys did start to scale faster. Yeah. What was the big unlock and how much do you think it might apply if you were doing it over again today? I think it's the same stuff. I think it was concentrating on product velocity and like delivery of useful things to our customers. And we picked a couple axes to compete on, some of which were like logically correct and some of which were logically fine. And then it was also talking about it constantly. in kind of a cringy, like, how many LinkedIn posts were there?
24:33Christina Cacioppo:And there was a period where I felt like, I was like, joke, but I was like the launch PMM, kind of, of just like posting on LinkedIn of like, here's one new ship, one new thing we launched. Like, I think - I post on LinkedIn every day right now. So I feel this deeply. Yeah, you know, I do think LinkedIn's easier than Twitter because like LinkedIn, it's just cringe. Like, it's just like, I'm hashtag crushing it and I'm hiring Banner. It's like so, so silly. But I think for us, it was those two things. And so, like, yes, we did have to, like, increase velocity a lot of some of the things we were delivering to our customers.
25:05Christina Cacioppo:And then we just had to talk about them constantly. One of the places we pushed were integrations. The number of integrations is a proxy for how automated Vanta is. It's not the best proxy. The best proxy is actually much more nuanced and wonky and hard to explain and reason about. Integration, like, how many integrations does Vanta have today over 400? That is an easy number. And it's like, that's automation-ish. At the time, we had maybe 80 integrations. And we kicked off a year and the project was get to 100. And we called the project infinite integrations or get to an additional 100 to just under 200.
25:40Christina Cacioppo:And we ended the year like just under 300 in a way where the team initially was like, this is crazy. Christina is, you know, politely psychotic. There's like no way we can do this. And that was, I think, a good, like, be the right amount of unreasonable being like, nope, I think you can. And we can sit down and talk about it and be supportive. And then just blitzed through and then, you know, emoji posted on LinkedIn constantly about, like, new integrations and what the number was and how fast we were moving and how the rate, like, month over month was increasing. And it just, like, built this narrative of, like, wow, Vanta moves so fast and so much more automated.
26:15Christina Cacioppo:And while their competitors, like, why would you use one of those? I think I learned a lot from that whole experience. We talk on the show about this moment also like an upstart moment where you were really back to the wall punching above your weight. Maybe it's something where you're really proud you got through it, but you wouldn't want to necessarily go through it again if you didn't have to. Would it be that or would there be another moment that comes to mind where you were like, thank goodness we weathered this or flourish during this critical moment? There was like definitely some stuff then, but I've kind of talked about it elsewhere.
26:46Christina Cacioppo:I think we're like coming out of another version of that. All of the numbers, they're up. The growth rates are like the second derivatives are up. Like everything is going. And yet we were founded in 2018. We were not founded in 2024. And there's now more people who work at Vanta than there are at a two-year-old company, right? And so how do you get a large group of people to think differently, build differently, work differently now that we have these like magic LLMs that are both magic and not, but like pretty damn magic. And you can't just, you know, you do the like, oh, and on all hands, like, here's a new thing and like expect everyone to absorb it.
27:29Christina Cacioppo:Like that doesn't work. And so I think we will look back on like 2026, first half of 2026 at BAMTA as like this kind of AI transformation. I hate those words, but that's kind of what it is or kind of the words people use of like how do we go from an older way of working to a like new way of working. OK, so if your upstart moment is literally right now, what has been the hardest or sort of biggest weighty decision or refocusing that you had to make from a resources or priority standpoint to really seize that? So the meta version of it is, do we satisfy the things customers say they want now, which is a lot of SaaS UI for good reason.
28:09Christina Cacioppo:But it's like a specific example. Reporting, classic upmarket feature. Everybody's always asking for more dashboards to see product usage. They are working, right? Like, can you have a dashboard for this in Vanda, that, the other thing, right? And most enterprise SaaS companies have ended up, I joke, but like rebuilding Power BI or some dashboard product like inside their product. Right. And we hadn't gotten there yet. But like I can tell you, you know, if we have dashboards that do X, Y and Z, we will unlock X million dollars in deals that are blocked or stalled on not having dashboarding in VAMTA.
28:42Christina Cacioppo:Should we do that today or should we not? And should we be like, you know what? We shouldn't rebuild Power BI or, you know, any version thereof. we should teach our agent how to dashboard and chart and have that do it. And we think we can solve a 5 ,000 person company's problem that way. And they maybe are bought into this and maybe they're probably just like, what are you talking about here? Could I like have a dashboard with some filters, please? Right. And we've been going the agent route. So trying to teach the agent how to fish versus just give the fish. Yeah. That's interesting because I find this impact of agents on Vanta, in my head, it gets pretty meta pretty fast.
29:23Because first I'm like, okay, how does the agentic process change how you go through one of these security processes? Then I think to myself, the bigger question, which is, do you need that security process in the same way at all in the AI era?
29:36Christina Cacioppo:Yeah. And I'm sure you have these questions too, right? Definitely. And it's like, as much as, you know, like we have a questionnaire automation product. Look, I hate questionnaires as much as the next person. Like no argument. I think the reason that, and by questionnaires, I mean, these, you know, 200 question Excel spreadsheets of like, how do you encrypt data? How do you X, Y, Z stand on your head? Whatever. The reason companies send them is like more complicated than they need answers to all those things. And so just trying to rip them out is much harder than it seems like it would. OK, because to me, it seems like what if there's a future where the customer just wants its agents to basically be verifying in real time?
30:14I don't want a questionnaire. I want sort of a real time visibility.
30:17Christina Cacioppo:I really want real time visibility, too. So here's the thing in which we provide for our customers themselves. And then you're like, OK, what will it take for them to expose that to their customers? Tough. Still a work in progress. I still think it's possible. But I think it's like much more gated and restricted. And it's like not any agent can come, you know, ask about my security practices and get super high fidelity answers. But Alex from Upstarts who has his contract or like this opportunity can, yes. And then having it be real-time information. One, like less work for everyone. But two, I think that's actually also a lever to improve security.
30:53Christina Cacioppo:Because again, when you know I'm going to provide real-time information on whether we off-board people correctly when they leave the company, whether we like cut off access to all the accounts under their email address. You know, and it's like, well, if I have to provide a screenshot and I can go fix things before I take the screenshot, I'll fix things before I take screenshot. Totally. And not in a malicious way, just in a like, I'm busy, I'm doing lots of things. Versus like if that status is always just continuously visible. you will make sure that dashboard looks clean at all points. We used to talk about it, about cleaning your apartment or your house before your parents come visit you for the weekend.
31:27Christina Cacioppo:Right? That is the weekend your apartment is cleanest. And it's like, does continuous visibility end up being parents constantly visiting? So just trick ourselves to think that our parents, or in my case, probably my in-laws I'm more scared of, are visiting all the time. Always visiting. Your kitchen counters will be so nice. Got it. I could see sort of an interesting tension point where with some of the AI companies we've had on the show, we've thought about evals and sort of like, what is a good model? Are you kind of playing to the test? And I think one existential question for Vance could be, are you helping sort of play to the test of SOC 2 or sort of these check marks that are not as relevant in real life in the AI world?
32:08How do you think about that?
32:09Christina Cacioppo:Yeah, what the check marks are, what the evals are really important. And again, security speak, it's like what the controls are, but what the rules you're following are. And a critique of Vanta that I think is pretty fair, especially in the early days, is we were super prescriptive about what controls or what practices a company had to have. And we did things that you didn't strictly have to have for SOC 2, but things that made better security. Classic example is two-factor on all email accounts. Nowhere in SOC 2 does it say you have to do that at all. We made all of our users do that. It's sort of annoying, but also it takes you.
32:41Did they know you were doing that?
32:42Christina Cacioppo:Mostly no. And then it did come out because one of our competitors used it against us, you know. Sorry that we're forcing you to brush your teeth. Kind of. You know, and there's like lines around. And then as a company matures, like they have opinions about how often they should brush their teeth. Fine. Like, don't mean to mess with that. But I think for someone who's coming and being like, I don't know how often I should brush my teeth. You tell me. Like, leading with like, here are reasonable security things. Also, here's some more bookkeeping or note-taking things that we will try to handle for you because Sock2 demands it.
33:11Christina Cacioppo:But like kind of separating those. Okay. Yeah. I guess now I'd say the haters take or sort of the concern would be that also with AI, customers could build this themselves. Yep. Or, you know, and we've already seen this, the next gen YC company, and you are a YC alum yourself, but the YC alum. They have to actually do compliance this time. But yeah, totally. But they might think that they could rebuild this from first principles faster or play the innovator's dilemma against you. So how do you think about future proofing and sort of keeping Vanta best in breed there? Yeah, a couple of folks. So one, and we've run in both like more one shotty and long running tasks of rebuild Vanta ourselves and be like, just like, how's it go?
33:52Christina Cacioppo:How good is like Cloud47 at this? Right. Like we have a version of like GRC bench or we call it GRC bench, but like a benchmarking kind of internally against the models. And again, it's also it's just like how close are we to this? How good? And we have an objective sense, not just a vibe sense. So there's some kind of parent, I think, useful paranoia we have on that. I think the other stuff is like, look, if you want to spend enough tokens, you can totally rebuild this. I do think there's a part where we are learning building software is not the hard part. It's maintaining the software and running it.
34:23Christina Cacioppo:And you got to keep doing that. So there's that piece. Fine. I think the actual moats are one we can debate, but kind of in the evals and the prompts and the improvement there. The other one is what we're calling like private tokens, but it's just data we have no one else has. 16 ,000 customers. Again, we've seen thousands of audits with insert auditor firm here. We know what they're looking for for specific things and what they'll accept and what they won't. We can coach customers toward that. We've seen thousands of enterprise procurement cycles. We know what enterprises are looking for. Coach customers toward that.
34:58Christina Cacioppo:It is the data mode of the last 10 years, but I think recast is. These are private tokens we can use in our evaluations on our products and our agent that no one else has. When a new gen startup comes out and says they're Vance at 2.0, does your kind of outlasting them or proving that maybe your product is better, does that end up net better for you? Or is it annoying because does it create churn or noise about the category? But like it is like as annoying as competition is, it totally makes us better. And it's way better for the customer. Like Adam Smith was correct here. That's very true. I think we've, to the spin, I think we've gotten better at just kind of anticipating that spin and then getting folks on the same page of like, here's what we are doing.
35:45Christina Cacioppo:Here's what they are doing. Here's the differences that are interesting and not interesting. And here's what we're watching and like what to do about it. Also, if you're a seller, here's, you know, go off and do that. But just it sounds so silly and obvious, but I think sending even that Slack message or writing that one page document and then sending it to 20 people and being like, if it's useful to your team, share it. If you do not, don't, whatever. Like just kind of keeping people corralled in. Because I think some of the spin is they say they're around to do point out. Like, are they? Are we worried?
36:16Christina Cacioppo:Are we not? I don't know. Right. And it's just like writing that, again, that one pager, very helpful. And then also like watching for it and again, trying to understand, are they actually Vanta 2.0? Like, what are they doing that's interesting that we're not? And having a hypothesis of like where they made different decisions, what that means. One thing is that you can tell from your, you know, your experienced founder, you don't name the competition. You've taken sort of the high road. I haven't seen you mudslinging on Twitter slash X. You call it Twitter. Every day now I see this new generation of founders getting very personal and sort of fighting each other.
36:52But it seems, is it intentional that you stay above the fray or is it just experience talking?
36:58Christina Cacioppo:Intentional. I think I subscribe to the like, never let them see you blink school of thought. And like, maybe I have to blink somewhere else. But like, yeah, yeah, that's not here. Got it. Well, so what's keeping you from blinking just at the fact that you've been working on this company now for almost a decade? Drew Houston, who you mentioned, he is finally stepping back, gradually as CEO of Dropbox. What keeps you motivated and excited for the next eight or plus years at Vanta? The problems change, which I think we are very, I mean, there's always problems. Everything is always, you know, half the things are always broken all the time.
37:30Christina Cacioppo:But I think that like one of the things I feel very grateful for amongst many is like the stuff that's broken generally changes and the problems generally change. And that I find like interesting and rewarding when you solve them. And like, I don't know, whack-a-mole isn't the right because it is actually fun. It feels like learning and getting better. Versus I think where the times at Vanta that have been hardest, the times that I've been working on other things have been the hardest is when like the problems don't change and you don't know what to do about it. You're like, I've tried seven things.
38:01Christina Cacioppo:Maybe I could try an eighth. But like this is still the problem. To me, that's when like fatigue, burnout sets in. And so Vanta, there's like infinity amount of work, infinity amount of problems. But again, they're different. And I find that like so much better. Your employees say that you are known for these intense frameworks. You framework yourself. You framework the company. Does that help you have that sort of lasting power or maybe grapple with the fact that there's infinity things you can be doing? Yes, I think it is. There's infinity things. And you just need like some way to focus and prioritize.
38:37Christina Cacioppo:And I kind of subscribe to like, I mean, definitely done is better than or good is better than perfect here. like it sort of doesn't matter does matter but as long as you're like doing things and moving through it versus I think the failure mode of being like there's infinity problems and doing this one and that one and the other one you know or like half of this one and whatever and just like you don't move on any of them and so it's kind of like just pick figure out how you're going to filter them again maybe it's right maybe it's wrong pick one and move and you will like learn as you're going I think that about decision making I think that about product development It's like movement is so much better than trying to figure out what to do because that is that I think, yeah, just one like fatigue craziness sets in.
39:20So I've had the privilege to get to interview you kind of throughout the journey. Do you think the earlier iterations of Christina Vanta would look at you today and say, good, she's having fun. This is this is where we hoped we would be. What do you think would be the meta conversation?
39:36Christina Cacioppo:I think there's a little bit. Again, I say this, but it's so true. I think when you start a company, you have like two competing ideas in your head. You have the like, yes, of course, like that is that is the plan and that's what will happen. And the like, statistically, that is not what happens. Right. And like both are both are true and you've got to kind of figure out something. And so I think there's a little bit of like, oh, yeah, that's always going to happen with like the self-awareness of like there's some subterfuge in that. And then I do think like that person would be very surprised by, oh, big organizations are interesting and fun in ways that like I didn't expect.
40:13Well, in whatever iteration this show looks like in five years, I will have you back and I will read you a quote from today. Oh, gosh. And we will see how you react then and we'll just keep it going. We will realize I live in a glass house. It could be, you know, just a bigger and bigger glass house, right? Perhaps.
40:28Christina Cacioppo:Yeah. Amazing. Well, thanks so much for coming on the show, Christina. Thanks for having me.
40:34Thank you.
From the publisher
When Vanta co-founder Christina Cacioppo first pitched investors on compliance software, she faced a frosty reception.
It wasn’t a viable product category, she was told. They’d sell for peanuts within a couple of months. No one actually wanted to work on compliance.
But Cacioppo had felt the pain first-hand. She was convinced: software could prove the perfect painkiller for fellow startups to handle security audits and grow faster.
Today, Vanta works with more than 16,000 customers like Lovable, Snowflake and Icelandair. It’s valued at $4.2 billion – and it’s successful enough that Cacioppo is now fending off a new wave of startup copycats. She welcomes the challenge. “I subscribe to the ‘never let them see you blink’ school of thought,” she says.
On The Upstarts Podcast, Cacioppo shares how she created hype in a sleepy category; how she prioritizes “infinity things” as a startup unicorn CEO; and why when it comes to good security hygiene, we could all spend more time brushing our teeth.
Plus, she shares her Upstart Moment: working to re-think, and attempt to future-proof, Vanta’s software business for the era of powerful AI models.
CHAPTERS
00:00 Introduction
1:39 What Vanta does
5:26 Selling to other startups
9:28 How AI agents change ‘pretty much everything’
14:06 Christina’s *real* founder origin story
16:23 Underdog fundraising and gaming VCs
18:59 The problem with startup valuations
24:08 Turning LinkedIn ‘cringe’ into customer traction
26:41 Reinventing Vanta with AI
33:43 Whether AI could clone Vanta
35:23 ‘Never let them see you blink’
37:24 Avoiding burnout with ‘infinity things’ to do
For more, visit https://www.upstartsmedia.com/
Season 2 of the Upstarts Podcast is presented by Rippling
Produced & edited by Eric Johnson from LightningPod
