Compliance at scale and why TAM is a distraction with Christina Cacioppo of Vanta

Christina Cacioppo, founder and CEO of Vanta, joins the pub to discuss building the future of agentic trust. She explains why compliance has a “vitamin vs painkiller” dynamic, the drama behind their famous 101-billboard campaign, and why she believes "market sizing is bullshit." They cover the tension between vibe coding and rigorous security, how Vanta is using agents to generate UI, and why the best founders are relentless truth-seekers. Timestamps (00:00:17) Vanta (00:12:30) How compliance works (00:15:06) Breaches (00:23:52) Stripe Tax (00:24:43) AI and compliance (00:44:50) Go-to-market (00:47:22) Lessons from USV

• 0:01Speaker 00

  Cristina Cassioppa founded Vanta in 2018 to solve a problem most founders didn't even know they had: compliance. Under her leadership, the company has defined the trust management category, growing to over 15,000 customers. Cheers.

• 0:13Speaker 01

  Cheers.

• 0:14Speaker 00

  Good to see you.

• 0:17Speaker 00

  Tell the Vanta story.

• 0:19Speaker 01

  We help companies start or build out their security programs, and then get credit for all that work through an audit, through a security questionnaire, a trust center. But it's basically like, do all the work to improve your security, and then go get credit for that with your customers.

• 0:35Speaker 00

  All the Vanta billboards I see use the word "compliance" rather than "security."

• 0:39Speaker 01

  Yes.

• 0:39Speaker 00

  What's going on there?

• 0:40Speaker 01

  It is one of those where you're like, we're a vitamin and painkiller, I think, right? And I think compliance is, SOC 2 is a word that no one knows what the heck it means until they deeply know and then they want it.

• 0:52Speaker 00

  They know that they have to do it this quarter.

• 0:53Speaker 01

  Exactly. Yeah. And so it's kind of like, and one of the original founding hypotheses of the company is if you want to start a security company for startups, you should actually start a compliance company. Because your customers never ask you for security, but they do ask you for compliance.

• 1:07Speaker 00

  So compliance is like the buying moment for startups.

• 1:09Speaker 01

  Exactly. And then when you're going through that, you have to implement a bunch of, like, do a bunch of best practices, maybe buy some tooling. But you don't, even if you want to, you don't do it before that moment.

• 1:20Speaker 00

  Yeah, yeah.

• 1:21Speaker 01

  Because you're doing the thing the customer wants.

• 1:22Speaker 00

  And I guess at a later stage, the buyer would be split, where security would be the CISO versus compliance would be the CFO, GC, something like that.

• 1:30Speaker 01

  So I actually think Stripe is like a little, I don't know, in what I see, which is biased, but different. In that usually, compliance is, there's this unified GRC, Governance, Risk and Compliance function, and that lives in the CISO org.

• 1:42Speaker 00

  Okay.

• 1:43Speaker 01

  And that will centralize internal audit, it'll centralize like enterprise risk.

• 1:46Speaker 00

  Okay, so you're mostly...

• 1:47Speaker 01

  You put those teams together.

• 1:49Speaker 00

  Yes.

• 1:49Speaker 01

  Third-party risk. Those teams are all together in CISO org.

• 1:52Speaker 00

  So you're mostly some of the CISOs?

• 1:54Speaker 01

  Yes.

• 1:54Speaker 00

  Okay. How did you, you woke up in the morning and you decided you were passionate about starting a compliance company?

• 2:01Speaker 01

  When I was three years old, it was my first word.

• 2:02Speaker 00

  Yeah, exactly.

• 2:02Speaker 01

  Jokes in the early days, we'd like never be able to pull that story off. I don't know, I heard training businesses are good.

• 2:08Speaker 00

  I've heard, I've heard more absurd founding myths, so I think you could just go for it.

• 2:13Speaker 01

  Yeah, go. No, it's, it's, the real story is twofold. So one, prior to Vanta, I worked at Dropbox. I worked on what at the time was a new product, Dropbox Paper. We were trying to take it to market and didn't take it to market as well as we could have for several reasons. One of which was, turned out at the time, all the Dropbox contracts had written into them, like, we're secure, we're compliant, we're pen tested, we're XYZ. Our new thing had none of those. And so it was like, in order to talk to someone with a Dropbox account, which was, you know, 100 million people or whatever it was, we had to go through this process. This was Dropbox 2015, so like the height of its Silicon Valley power, you know, year and a half, 10 engineers, no feature building, all that.

• 2:58Speaker 01

  I like, that all happened. I was not smart enough to then be like, aha, startup idea. And instead, like this, like Dropbox, what are you doing? This sounds bad. It was about a year and a half later, just talking to startups and founders about security, trying to figure out, like, why, is there a company to be built here? How do you get more startups to care about security? How do they be able to do it? And kind of came across, basically, companies that either sort of did nothing for security, but felt really badly about it sometimes, still did nothing. And then companies that had a lot of stuff in place. And a lot of stuff in place was because they'd gotten a questionnaire, they'd gotten sucked to because of an enterprise customer. And that was kind of the like, oh, that thing.

• 3:41Speaker 01

  I remember that being crazy and onerous and sort of terrible. But also kind of if you do it, like... Yeah, that is like Pasco collect $200, like huge benefit on the other side.

• 3:53Speaker 00

  Yeah.

• 3:53Speaker 01

  And it's kind of the combo of those two things.

• 3:56Speaker 00

  What you're describing, I think, is just so commonly the experience in founders who start companies. I mean, it was our experience with Stripe as well, where we had just run into the problem before. But it's funny, I often run into people in university who are excited about starting a startup. And that's generally, and you know, obviously, there's lots of sexy stories of people who dropped out of college to start something. It's generally a bad time because you talk to university students and often their ideas for companies are pretty half-baked.

• 4:25Speaker 01

  Find my friends.

• 4:26Speaker 00

  Yeah, it's find my friends. It's like a college textbook exchange app.

• 4:30Speaker 01

  Yeah.

• 4:30Speaker 00

  You know, there's like the five apps or whatever, whereas so frequently what happens is people go out and they build successful products in the world and they do Dropbox paper or they get some experience. And it turns out there are huge markets available with problem spaces that most normal people have not heard of with things like SOC 2. But you have to kind of spend a while seeing how the value flows in the real world work to discover those big opportunities.

• 4:55Speaker 01

  Okay, so how do you feel when you go to YC now and you have these founders who've like dropped out and been like, my passion is sales enablement? But they actually kind of do know surprisingly much about it, kind of?

• 5:06Speaker 00

  I mean, if you truly manage to learn enough about sales enablement to be, you know, to be able to field a strong product there, then good on you. I just think you're more likely to discover those areas after, you know, five or 10 years. What's changed the business at now?

• 5:19Speaker 01

  And we have 15,000 customers. Our growth rate's actually quickened the last couple of years and quarters and months. And so it's been 60% annual plus for the last couple of years since that milestone. So a ballpark number there.

• 5:34Speaker 00

  Yeah, yeah, yeah.

• 5:35Speaker 01

  Yeah, it's a proper business.

• 5:36Speaker 00

  Yeah. And you go to market, it's all sold?

• 5:39Speaker 01

  All sales.

• 5:40Speaker 00

  Yeah.

• 5:40Speaker 01

  Yeah, it's one of the blessings and curses of them.

• 5:43Speaker 00

  With what company sizes?

• 5:44Speaker 01

  All, so we do the like, we call them the two founders on the couch. But it's like the two founders on the couch are building their thing and someone asks them for SOC 2 and they're working on it on, you know, Friday night because like, when else are you going to do the thing? All the way up to at least one member of the Fortune 50.

• 6:01Speaker 00

  I would have taught those. Compliance is very different for

• 6:04Speaker 01

  It kind of is.

• 6:05Speaker 00

  founders who have never even heard of it versus companies who have a lot of existing teams here with opinions and stuff built out.

• 6:13Speaker 01

  Yeah, that is true. So down market, or down market, I kind of, we're not quite TurboTax, but I think that is the kind of experience a founder wants.

• 6:21Speaker 00

  I see.

• 6:21Speaker 01

  It's like, this is high stakes and I don't want to get it wrong and I don't really know, but just guide me through. And then, so that's, that's more of the product experience and then the output is like, here's a set of controls with like, security rules you follow that are monitored on an ongoing basis. And because of that, whenever you're, you're kind of constantly audit ready. You always have everything in place. Great. And so that, that's sort of the experience a founder wants, but the output is still a security program that's monitored all the time. Upmarket, I, so I'm talking to an engineer, it's like, it's more data dog for your compliance controls, right? You're like, I have my program, I have my thing, but it's, it lives in a spreadsheet, it lives in Jira, custom Jira, it lives in something like that. And I want real-time dashboards and visibility.

• 7:05Speaker 00

  I see.

• 7:05Speaker 01

  And like, you know, deviations and auto remediation and like, I want that world.

• 7:09Speaker 00

  Okay, so there's almost like two layers to Vanta. There is what your controls should be and then how the controls are monitored and implemented. And kind of early-stage companies want both.

• 7:18Speaker 01

  Yep.

• 7:18Speaker 00

  Later-stage companies may want more of the latter.

• 7:20Speaker 01

  Exactly, exactly. And then the tie to audit is like, great, well, you know, in some ways it's like, if control is monitored, you just pass the logs to an auditor.

• 7:26Speaker 00

  Yes.

• 7:26Speaker 01

  It's more complicated than that, but that's the base model.

• 7:30Speaker 00

  Well, okay, you're getting to a question I had, which was like, compliance at some level is not a thing you can just buy, it's a thing you have to do. And so like, if you actually talk about all these rules, like, I don't know about SOC 2 in particular, but for example, a lot of compliance regimes have this notion of, you know, doer and approver being separate for some thing. And so it's like the, you know, the

• 7:50Speaker 01

  Pro review is the famous one.

• 7:51Speaker 00

  Right, exactly. The nuclear submarine where, you know, you have to have the two keys turned simultaneously to launch the PR, I guess.

• 7:57Speaker 01

  Right, exactly.

• 7:58Speaker 00

  In this analogy. And again, Vanta can't do that for you, it has to do that. And so what you do is, one, for say a startup, you actually just let them know the complete list of things they actually need to do. And I've seen this on You can talk about some logic of only telling them the stuff that actually applies to them.

• 8:16Speaker 01

  Yep, exactly.

• 8:17Speaker 00

  And then there's actually, how do you enforce, say, separate doers and approvers in something like Code Review?

• 8:22Speaker 01

  Yeah, so for something like, so this is where, this was the first thing we built, and we call it tests. So it's advanced work, but like modeled after unit tests. You're like turning each of these controls into a unit test.

• 8:31Speaker 00

  Yes.

• 8:31Speaker 01

  And so pull from version, you know, GitHub, GitLab, whatever. Look at every pull request and check, you know, these fields or this thing, or some run some logic over it.

• 8:40Speaker 00

  Yep.

• 8:41Speaker 01

  And that is our test for the control.

• 8:43Speaker 00

  Ah.

• 8:44Speaker 01

  And so that was, that was kind of the, again, the first thing we built were these tests. But tests are just ways to prove controls.

• 8:49Speaker 00

  Ah, so you're just a test suite. You're the battery of unit tests for the compliance rules.

• 8:54Speaker 01

  Exactly.

• 8:54Speaker 00

  Ah, why don't you just say that?

• 8:56Speaker 01

  Sorry.

• 8:56Speaker 00

  Why don't you just billboard say that?

• 8:59Speaker 01

  There was a niche audience of separate discos that would be like, oh, now I understand.

• 9:02Speaker 00

  Yeah, but I think for the 101 billboard.

• 9:04Speaker 01

  Yeah, yeah.

• 9:05Speaker 00

  Oh, what's the controversy with your 101 billboard?

• 9:07Speaker 01

  Oh, my goodness. How, how much do we want to do this? We had a great 101.

• 9:12Speaker 00

  Great billboard. I used to drive by it every day.

• 9:14Speaker 01

  Yeah, yeah. Compliance, it doesn't suck too much. Arguably, you know, hundreds of millions of dollars in market cap attributed to that billboard. It's funny, that was just in the, you know, annuals and Vanta and startups. The, the person who came up with that billboard, very pleased with herself, as she should.

• 9:30Speaker 00

  As she should be.

• 9:30Speaker 01

  As she should have been.

• 9:31Speaker 00

  Yeah, yeah.

• 9:31Speaker 01

  Hundred percent right.

• 9:32Speaker 00

  Yeah, yeah.

• 9:32Speaker 01

  Her manager at the time was very skeptical of that billboard.

• 9:36Speaker 00

  That's a can level tagline.

• 9:37Speaker 01

  Are we negging our users? Yeah, yeah. Is this so, are we too far over the line?

• 9:41Speaker 00

  Yeah.

• 9:42Speaker 01

  Anyway, you can guess which one of those people is still at Vanta today.

• 9:46Speaker 01

  That's just because of that.

• 9:47Speaker 00

  Yeah, yeah, yeah. Yeah, it's kind of a cultural test.

• 9:49Speaker 01

  Exactly.

• 9:49Speaker 00

  Yeah, yeah, yeah.

• 9:50Speaker 01

  Anyway, so we had this billboard, it was great.

• 9:52Speaker 00

  For many years.

• 9:52Speaker 01

  For many years.

• 9:53Speaker 00

  Yeah.

• 9:53Speaker 01

  I used to joke that we've had it locked up for years. Turns out we didn't, and I'm an idiot.

• 9:58Speaker 00

  Oh, you forgot to renew it?

• 9:59Speaker 01

  Not even.

• 10:00Speaker 00

  You should have had a little Vanta check for that.

• 10:02Speaker 01

  I know, it was like, it was like you're Dwayne, and you're just like, that thing you're not supposed to, yeah. It was slightly better, but still bad. The agency we worked with, one, I always should have caught this, our, our contract was just written in crayon. And we got lucky to be able to ask about our billboard, we'd introduced them to lots of startups. You know, some of the startups were also buying with that agency.

• 10:23Speaker 00

  Wow.

• 10:24Speaker 01

  And so that.

• 10:24Speaker 00

  A startup you introduced to them went and took your billboard.

• 10:28Speaker 01

  They didn't even do it on purpose. The agency went to them and was like, oh, we have this great inventory. Would you like it? And then we found out.

• 10:35Speaker 00

  Okay.

• 10:35Speaker 01

  Yeah.

• 10:36Speaker 00

  That's rough, but people will learn about.

• 10:38Speaker 01

  This is the drama of the compliance world.

• 10:40Speaker 00

  People will learn about Vanta in other ways.

• 10:42Speaker 01

  They do like, we do like to market.

• 10:43Speaker 00

  Yeah.

• 10:44Speaker 01

  Yeah.

• 10:44Speaker 00

  And, okay, and then go back to the other part of the question. So how does the layer work for, you know, the rulebook might be a thousand pages long, compiling that rulebook into the steps that are actually actionable for me? Because I am not a farm and so all the farm parts of the rulebook don't apply to me.

• 10:59Speaker 01

  Yeah, okay, so the initial, so the initial version of it actually was, this is like back when we were founders on a couch, with getting like as many SOC 2s as we could, it's like Salesforce, Slack, AWS, right?

• 11:13Speaker 00

  Yeah.

• 11:13Speaker 01

  Whatever, and actually opening them all and just comparing them.

• 11:16Speaker 00

  Yes.

• 11:16Speaker 01

  And trying to extract what was common and sort of doing it that way. So that was the first cut. What we do now is hopefully more advanced, but there's a bit of, now that we have probably 30,000 audits completed.

• 11:30Speaker 00

  Yes.

• 11:31Speaker 01

  We can just go back and be like, okay, for a company that looks like you and board this auditor often, what sorts of controls are there?

• 11:38Speaker 00

  Yep.

• 11:39Speaker 01

  So with that input in, then we can also layer in, both for a company in particular and in general, like you get questionnaires. What are the themes and the questions you're being asked?

• 11:49Speaker 00

  Yes.

• 11:49Speaker 01

  We just launched a new commitments product that ingest contracts and scans at contracts for like things that are contracted. So you can then even like pull them out and say, hey, this should be a control.

• 12:00Speaker 00

  Yes.

• 12:00Speaker 01

  And, you know, God forbid, something happens, but you're like, what are my obligations to my customers? And you can just have, you know, you basically have all that structured data. But one of the most important things, I just want to see progression over time and increase maturity over time. And you've probably had this at Stripe where you wanted to use some cool new tool that like had no security posture.

• 12:20Speaker 00

  Yes.

• 12:20Speaker 01

  And a contingent, sorry, hack that maybe, but like, you know, one, one part of it was like, oh, can you just like walk this up over time and show me you're making progress?

• 12:29Speaker 00

  Yes, yes. Is SOC 2 the main?

• 12:34Speaker 00

  Bible, you know.

• 12:35Speaker 01

  Basically, I mean, we don't, it's funny, we don't, we don't break it out by framework anymore because it's all just here, like, they're all just inputs into the system.

• 12:44Speaker 00

  Sure, but like ultimately you need to comply with some specific thing.

• 12:47Speaker 01

  Yeah, yeah, but like, yes, most customers will come to us for that first.

• 12:50Speaker 00

  Yep.

• 12:51Speaker 01

  Number two is ISO 2701, which is if you part.

• 12:54Speaker 00

  Who demands ISO 2701?

• 12:56Speaker 01

  European enterprises.

• 12:58Speaker 00

  Okay.

• 12:58Speaker 01

  Yeah, yeah, yeah. And so if you're, if you're a European company selling to Europeans, you will start with that. If you're European, start selling to Americans, you'll start with SOC 2.

• 13:05Speaker 00

  Okay. How aligned are they?

• 13:08Speaker 01

  I think our official like mapping is like 60-ish, 65%.

• 13:12Speaker 00

  Okay.

• 13:12Speaker 01

  And the additional ISO stuff is often documentation.

• 13:15Speaker 00

  Okay.

• 13:15Speaker 01

  Just like a great place for software.

• 13:17Speaker 00

  Sounds like Europe, yeah.

• 13:17Speaker 01

  Yeah, yeah, exactly. Yeah, there's like less, you know, please implement these six more rules.

• 13:22Speaker 00

  Okay, so is it SOC 2 and its international equivalents is basically that captures most of what you're doing?

• 13:27Speaker 01

  Uh, it is probably plurality, not majority.

• 13:31Speaker 00

  Okay.

• 13:31Speaker 01

  And so we see a lot of growth and there's this like whole host thousand flowers boom of AI standards right now. It's like the whole thing there, there's healthcare specific things.

• 13:41Speaker 00

  Sure.

• 13:42Speaker 01

  There's the PTI piece, which I know you're very familiar with, there's that.

• 13:45Speaker 00

  On healthcare, is this which?

• 13:48Speaker 01

  There's HIPAA, which is US law. You can just declare yourself compliant with HIPAA.

• 13:53Speaker 00

  Yeah, self-compliant.

• 13:54Speaker 01

  Yeah, exactly. The downside of doing that is if you do that and are breached, the fines are enormous. And so that's the check that there's semi-market check there.

• 14:03Speaker 00

  Can you describe the policy goals that something like SOC 2 seems to accomplish? And you might say, oh, it's simple. It's just, you know, security. But yeah, like, as we know, there's many different facets to that. And so it could be preventing information leaks or it could be preventing fraud against the customer or it could be all these different things. And so if you're at a stack rank, what is SOC 2 actually trying to accomplish at a policy level?

• 14:31Speaker 01

  I would say it is trying to ensure customer data is protected. And that is what it is trying to do.

• 14:39Speaker 00

  And you're just to round out the point, your Java, JavaScript comparison is that, Java was a very popular language before the emergence of web browsers with JavaScript. And so when they invented JavaScript, they wanted to kind of ride off the Java halo as it needs to do the programming language, despite the fact Java and JavaScript share no exactly commonality at all. But it was just good branding. And what you're saying, is that a similar with SOC 2 here? Okay, so you're saying the primary goal is to ensure that the data that you're giving this company.

• 15:11Speaker 01

  Your software provider, whatever.

• 15:13Speaker 00

  Is adequately protected. Many companies have had humongous data breaches.

• 15:21Speaker 01

  Equifax was a great, easy version.

• 15:23Speaker 00

  Equifax, AT&T, I believe.

• 15:26Speaker 01

  Kind of all of them.

• 15:26Speaker 00

  Exactly.

• 15:27Speaker 01

  Assuming every big company has a SOC 2.

• 15:29Speaker 00

  Yeah, but there's a difference between some data was leaked in some context versus like in the Equifax case. Sorry, we lost all of your data.

• 15:38Speaker 01

  The vulnerability. Yeah, we didn't fix the database.

• 15:40Speaker 00

  Which data did you lose, like all of it? Yeah. It's very hard to find that moment in the Equifax stock price chart.

• 15:46Speaker 01

  Yes.

• 15:47Speaker 00

  What's going on there? As in, we think society cares, society should care. It's valuable to not lose this data. And yet it does not seem to impair what investors deem to be the terminal value of the company.

• 16:00Speaker 01

  Yes. What are investors betting on? They're betting on like, will anyone churn off of Equifax because this happens? And I think the cynical but correct take is no. Sometimes because you're like, you know, Equifax or Delta, you're not like, am I going to stop, you know, like I'm not going to stop playing Delta. Especially 10 to 15 years into this where you're like, oh, another one. All at an eighth credit monitoring service, right? Like, and I think there is a cynicism there that is probably correct.

• 16:30Speaker 00

  The other thing that feels like it's changing in this ecosystem is that the costs of having data breaches.

• 16:40Speaker 00

  Are going up because Europe in particular is getting very strict about notifications and sometimes fines around these breaches. How is that changing your world?

• 16:56Speaker 01

  We see more. So we also cover some of the data privacy standards, so your GDPR, your CCPA, there's a whole, again, alphabet soup of acronyms here. Honestly, we see demand for that that goes in waves. And it kind of tracks what you'd expect. It's higher in Europe. I mean, Vanta as a product in general does kind of even better in Europe and better than you would guess for a California company that doesn't have European roots. And I do think there's some cultural affinity and just seriousness there.

• 17:29Speaker 00

  Yes, yes.

• 17:30Speaker 01

  Versus the easy critique of Americans and compliance is like, I'm just checking. You tell me where the bar is and I'll meet your bar, but like...

• 17:37Speaker 00

  It's a box checking society.

• 17:38Speaker 01

  Exactly. Where it is just kind of culturally something that is like more important. You can tell me where the bar is, I'll meet it, but also I have my own internal bar. It's more the European take. But we see like demand for, say, CCPA to the California private, California version of GDPR, quote unquote, go in waves. And right now it is definite. And all the American regulation is kind of at a total mid-year, but it's down right now.

• 18:02Speaker 00

  Yeah. Well, it's down at federal level. Is it also down at a state level, the kind of energy around these CCPA type things?

• 18:08Speaker 01

  Yes, it is. Even with, you know, it's not clear what California is going to do and it could go multiple ways, but I think, I still think the national politics casts a larger shadow, even over like a state like California.

• 18:22Speaker 00

  Oh, that's interesting.

• 18:23Speaker 01

  Yeah.

• 18:24Speaker 00

  Okay.

• 18:25Speaker 01

  And on the national side, you know, current administration is very into streamlining regulation through automation and AI. But that is the catchphrase that they deeply believe in and are driving.

• 18:35Speaker 00

  I would have thought that this kind of stuff is just too boring to be caught up in any reform initiative, or will this be streamlined?

• 18:41Speaker 01

  I think there's very hardworking folks in DC, in special, well, kind of across the board, but in GSA, in the AI office, trying to do this. And the primary lever they're using is FedRAMP. Yeah.

• 18:55Speaker 00

  Yeah.

• 18:57Speaker 01

  And which broadly I would think of SOC 2 for the federal government, but basically a very onerous set of both controls and requirements and documentation in order to begin trying to think about selling to federal and often states, sometimes even local governments.

• 19:15Speaker 00

  I realize state and local governments also use FedRAMP as kind of their

• 19:18Speaker 01

  State ramps? So there's like literally Texas ramp?

• 19:21Speaker 00

  But they kind of conform to FedRAMP.

• 19:23Speaker 01

  Exactly. Yeah, yeah. And there is a part of GSA and one team in particular led by a guy called Pete Wasserman, who is trying to modernize FedRAMP, but I would say make a like 2020 version of FedRAMP, where the current version feels a bit more 90s. And it is unclear if he will get the traction to succeed. But he's fighting the good fight and he gets it.

• 19:48Speaker 00

  But even if they do that, I find it hard to imagine the Society of Accountants just copying the new FedRAMP block stock and barrel.

• 19:56Speaker 01

  I don't think they will. I think you're just gonna have even more divergence between these things. Yeah.

• 20:02Speaker 00

  Your life is

• 20:03Speaker 01

  There's like less control overlap.

• 20:04Speaker 00

  Yeah, I feel like your life is the XKCD of, you know, we have 15 standards.

• 20:07Speaker 01

  It is, and the answer is a 16.

• 20:09Speaker 00

  Yes, yes.

• 20:09Speaker 01

  Yeah, yeah. That is also my answer when people are like, well, isn't Vanta gonna make a standard? Couldn't you make a better one?

• 20:13Speaker 00

  Yeah, yeah.

• 20:14Speaker 01

  I mean, couldn't we have that posted on the office wall?

• 20:17Speaker 00

  Yeah, yeah, because it is your life.

• 20:19Speaker 01

  Yes.

• 20:19Speaker 00

  But, okay, going back to the effects of the European strictness, it doesn't show up in the form of kind of maybe American companies previously were looking to kind of check the SOC 2 box versus now they're like, okay, it's really important I don't cross this, actually quite strict European rule.

• 20:36Speaker 01

  Right, right. Whereas I think now, and I think in the, it's funny, we were starting Vanta, Vanta as what it is now today in spring of 2018, which was when GDPR was going into effect. And so I was kind of running around and being like, will you talk to me about compliance? And everyone said yes, I was having this great luck. And then I'd show up and I'd be like, so SOC 2. And they'd be like, GDPR is a priority, like, next, please.

• 20:58Speaker 00

  Yep.

• 20:59Speaker 01

  And that energy has like mostly dissipated, especially in the United States.

• 21:02Speaker 00

  Yes.

• 21:03Speaker 01

  I think because it's like

• 21:05Speaker 01

  The theory at the time was GDPR is written by lawyers at a very high level. It's not a spec you can enter an engineer, like comically kind of bad as an engineering spec. But it's fine. We will clarify that in court over the next 10 years. And now we're seven, eight years in. Hasn't really happened.

• 21:22Speaker 00

  Yes, yes.

• 21:22Speaker 01

  It still is kind of hand wavy for an engineer, at least to go implement as it ever was.

• 21:28Speaker 00

  And how does this work with agentic coding where the honest answer to the number of human reviewers, this code is zero?

• 21:36Speaker 01

  Yes. How should it work? Because right now it is like, well, somebody did code well. Like right now, it's like agent writes code, human or agent puts up PR. Maybe human or agent reviews it. And I think to a naive SOC two audit, you're like, those seem like two user IDs had that conversation. And so we can go forward.

• 21:59Speaker 00

  But it's more about having two throats to choke as opposed to, you know, we read the code of this ATM software and guaranteed this, you didn't introduce an infinite money glitch.

• 22:11Speaker 01

  My interpretation from talking to folks is some of the impetus behind it or the primary impetus was insider threat. And that's what you're preventing against, which maybe that's my macro answer is just go through the SOC two controls and be like, what are we trying to do here? And be like, okay, great. Let's design for that.

• 22:28Speaker 00

  Yeah.

• 22:28Speaker 01

  And there may not be how it's written today.

• 22:30Speaker 00

  That's a good question because on all the insider threat stuff, having two reviewers is kind of one way to do it. Does SOC two mandate exactly a lot of other insider threat stuff? Because presumably you should be logging a lot of activity, auditing a lot of activity. You know, there should be process that you have in place.

• 22:46Speaker 01

  No, and I think this is where actually you get to the technical standard made by folks who often aren't as in their depths in engineering, let's say, right? And so the controls for like, there are a bunch of logging and monitoring controls that are suggested. One thing maybe also mentioned, unlike PCI, SOC two doesn't have a prescribed control list. So PCI is kind of different and it's like you must do X, like you must buy this tool, whether or not it is useful to you. I'm sure you have your own story with that. Yes. SOC two is like, you must log useful events and have a system to look at them.

• 23:20Speaker 00

  I see.

• 23:20Speaker 01

  But it is up to you to decide what the heck that means, which sometimes it's helpful. I think for a startup that's never done this, it is unhelpful because it sort of opens up. You know, a maze in a way that's just not great. And that's why I'm being prescriptive.

• 23:34Speaker 00

  Yes.

• 23:35Speaker 01

  Is part of, I think, the, and Vanta's initial product market fit. I think it's actually largely due to that.

• 23:41Speaker 00

  Yes, yes.

• 23:41Speaker 01

  In a way that that wasn't the plan. But I think it's like figuring out how to take that high level guidance, bring it down in some places.

• 23:48Speaker 00

  Yes.

• 23:49Speaker 01

  In a way that actually makes sense.

• 23:54Speaker 00

  Christina and her team at Vanta are helping their users automate compliance, which for many companies is the thing standing between them and being able to sell to enterprises. We're very familiar with this category of products of Stripe, where you have a complex web of rules that businesses need to be able to comply with so they can move on to actually improving their products. Just take tax compliance and our product Stripe Tax. As you start selling in more states and more countries, you discover there's thousands of rules you need to follow. For example, did you know Chicago actually has a lease tax, which applies to SaaS companies too, since you're leasing out software? Stripe Tax is built to automate all of this. With one integration, it knows what you're selling, when and where you have to collect transactional taxes, and how to register and file on your behalf. So if you want to sell globally without becoming an expert in tax rules, check out Stripe Tax.

• 24:42Speaker 00

  You know, the, the kind of joking reference that everyone makes is they talk about kind of competition from Claude Code for software products is, yeah, you know, you're not just going to vibe code your X in, in a weekend. But obviously, something like SOC 2 is actually the kind of thing that LMS or kind of coding agents are good at working with because there's just so much training data out there and it's a, you know, codified set of rules. And so how is AI helping with what you're doing? And kind of what is your plan for? You're describing some of the scale economies you have and having seen other customers. And I'm curious just kind of what the defenses are against.

• 25:24Speaker 00

  A customer could, in theory, say, hey, Claude, give me the plan for our SOC 2 compliance. Make no mistakes, you know? Like, that is a thing you can contemplate.

• 25:31Speaker 01

  Right. And I think like there's, you know, so you can do the, sort of the very defensive thing. The actual, the very defensive thing is like, right, but like, this is a place where you don't want to get stuff wrong. Spending much time on it does not make your beer taste better. Right? Like, is this really the place? Even if you really want to vibe code a bunch of stuff, is this really what you want to vibe? Fine, whatever. Ignore them all. I think where the LLMs are excellent and a little dangerous to build versus buy, but then we just need to build better experiences on top of this are is like, "Hey Claude, I'm going to give you a mess of data. You go make sense of it to me and like, get me ready."

• 26:09Speaker 00

  Yep.

• 26:10Speaker 01

  Right? I'm just gonna like, give you a bunch of AWR screenshots or API calls. I'm gonna give you all my policy documentation. Like, go, I'm gonna give you my existing JIRA workflow. Go turn it into a thing. As you know, you can go do that today. We are building, this is our onboarding flow or will be our onboarding flow, which is, oh, you have an existing program that's already running.

• 26:31Speaker 00

  Ah, that's cool.

• 26:32Speaker 01

  Give you all the stuff. We will go map it into the Vanta world.

• 26:35Speaker 00

  Yes.

• 26:35Speaker 01

  And then in, you know, like Claude, we're an LLM. It's like, okay, cool. Now you get, I don't know, files in a folder structure that you then, you know, box share that to over to EY and like, call that your audit. Fine. You can, you can do that. In a Vanta world, the outcome is now hopefully we have your program mapped and is observable and monitored and alerted. And so you have continuous control monitoring. You get your dashboards. You always know what is in place and what is not. And yes, you can go, you know, send a share link to your auditor here too, and they can log in and see everything.

• 27:06Speaker 00

  Yep.

• 27:07Speaker 01

  And so we sort of think about it as they have lowered the initial audit prep.

• 27:14Speaker 00

  Yeah.

• 27:15Speaker 01

  In a way, inside, outside Vanta. Or like, if they're not inside Vanta, what do we, what do we end up doing? So building that. But the continuous monitoring piece.

• 27:22Speaker 00

  Yes, yes.

• 27:23Speaker 01

  That you're not going to get out of at least LLM chat. You've got to go vibe code that whole system.

• 27:27Speaker 00

  Okay, so you're saying that everyone just wants, like, no one enjoys spending time in SOC 2. Everyone wants to have been SOC 2 compliant as of yesterday.

• 27:36Speaker 01

  Yes.

• 27:36Speaker 00

  And so you're saying part of the advantage here in this new landscape is you can just take a whole bunch of unstructured stuff and just empty it into the Vanta hopper.

• 27:46Speaker 01

  Right.

• 27:46Speaker 00

  And Vanta will make sense of it.

• 27:47Speaker 01

  We'll get widgets.

• 27:49Speaker 00

  And I presume part of the defensibility comes from the fact that preference amongst practitioners, in this case, the auditors that are reviewing your SOC 2 materials is a very strong effect. And both QuickBooks and Xero to some extent, really.

• 28:07Speaker 00

  Grew off accountants becoming familiar with those pieces of software. And companies could have opinions about what they were using, but those were generally, those opinions were not that strong and they were overridden by the opinions of the auditors.

• 28:21Speaker 01

  And so We have a version of that. It's not, I don't think it's as strong as so the facts yet at least, but even again, we've seen 20,000 audits and thousands for particular firms. And so you're like, to control, you know, to be like, we now do AI evidency valves. So it's like, oh, you're going to provide this piece of evidence. We can just tell you, is it going to work for this auditor? Did you upload a cat picture? Did you upload a screenshot without a timestamp on it? And you're going to get told to put the timestamp back, you know, just like that feedback loop. We already have, and we've thought about doing things for auditors as well with that.

• 28:55Speaker 00

  Yes.

• 28:56Speaker 01

  But yeah, it's sort of, it sort of moves in the direction of like an AI internal audit at least.

• 29:00Speaker 00

  It feels like the data you have of anonymized prior audits

• 29:07Speaker 01

  Yeah.

• 29:07Speaker 00

  is an incredibly powerful network effect that cannot be replicated because again, it doesn't exist on the public internet. Like the AIs don't have it available to them. It's just private data. And just like, you know, Stripe's an advantage because we have all the fraud data. We know what like a normal buying pattern looks like versus not. And so we can offer the best anti-fraud performance just because we're working with a larger data set than other people. Similarly, people going through an audit, you can tell them that this will work and this won't.

• 29:33Speaker 01

  This is our radar.

• 29:34Speaker 00

  Yeah, exactly. In a way that just you cannot do, even if you're, you decided to buy it yourself.

• 29:41Speaker 01

  Yes.

• 29:41Speaker 00

  Yeah.

• 29:41Speaker 01

  Yeah.

• 29:42Speaker 00

  It's a big deal.

• 29:43Speaker 01

  Yeah, it's kind of cool.

• 29:45Speaker 00

  Well, where else have you seen that be useful?

• 29:47Speaker 01

  In relationships between a software vendor and buyer, right? And so we, so Vanta Core, we think of ourselves as, you know, broadly and what we're best known for is serving software vendors, but people who make software and want to sell it to the world, right? You know, is it security work? Is it secure? Grand. Okay. Then we have this third-party risk product, but it's basically, I think of like, you're an organization, maybe it's tech, maybe it's not tech, you're buying software and you're going to go put a bunch of your customers' data in it. You want that software to be secure because if not, you have to turn around and tell your customers like, I lost your data, but it's actually our email provider. But you don't care if our email provider, like you think it's me and I have sent you. Anyway, right? Like, no one wants to send that email.

• 30:31Speaker 01

  So there's a whole world of like third-party risk or vendor reviews. And we build a product for those folks.

• 30:38Speaker 00

  But is there kind of a compliance versus security tension here as you're doing this stuff?

• 30:42Speaker 01

  We haven't seen as much. What we have seen is, um, so the person buying software, you know, they might work at a tech company and be quite savvy and up to date on those threats. They might work when our customer is, you know, a hotel, literally a hotel chain. Right? And so not that, and they certainly don't get compliance themselves because they don't build software. Right? But they buy it.

• 31:00Speaker 00

  Yep.

• 31:00Speaker 01

  Fine. And so what we generally see is some companies will come in with their set of questions they want to ask. And, you know, maybe I will read your stock to you, maybe I will not, but like, I really want to ask you questions one through 10. Some companies don't have that. And again, there's some part of the value proposition is like, we'll prescriptively guide you. And so we have a product principle just around reasonable defaults. And it's like, can we make the reasonable default questionnaire in this case? Something that leans into security versus compliance or versus, you know, do you have a policy to X? And you can just ask them if they X if you care. And so that's a place where we've tried to, on the margin, nudge, nudge the buyer questions toward more security, knowing that will change the like economic incentive of the vendor.

• 31:45Speaker 00

  One of the big debates people are having right now is how AI productivity gains show up.

• 31:50Speaker 01

  Yes.

• 31:51Speaker 00

  And I feel like you could have an opinion on this because we have filled out a lot of security questionnaires at Stripe. And I think we'd be very happy if the machines could take over from here. We really don't need to. We've filled out enough.

• 32:04Speaker 01

  Talk about this.

• 32:05Speaker 00

  Exactly. Yeah. But so one case you could make is the machines are getting quite good. They can understand what Stripe, you know, is and isn't and can do and can't do. And so every time we get a security questionnaire, AI can fill it out. The counter argument you could say is maybe Jevon's paradox will show up and there'll be even more exhaustive and elaborate and custom, you know, security questionnaires. And so, you know, the total amount will increase. But so just how do you see AI productivity showing up here and the effect?

• 32:33Speaker 01

  So the questionnaire is actually a great example because then questionnaires, so that we tried to build this product in 2018, which before we talked to you because it just, it seems easier. Actually, but the language models were not good enough. And then we tried again in like early 21, like BERT came out and you're like, oh, is there a, it was not good enough? And now it is good enough. So to that actually GitHub gets 92% of all of the questionnaires they receive answered through Vanta. And so you're like, not at 100, but you're like, it's GitHub, they have AI tools, like they have Copilot, it's a lot. And so we are absolutely seeing this, like, the models are definitely good enough.

• 33:08Speaker 00

  People ask GitHub to fill out the security questionnaires before using GitHub. And now they can mostly turn around and return those security questionnaires.

• 33:17Speaker 01

  Exactly.

• 33:18Speaker 00

  With 92% filled out.

• 33:20Speaker 01

  Filled out. And we have a kind of human, but just it's review and approve, right? And then like the confidence scores on like prioritizing even for the reviewer. It's like you probably don't, you can look at the section if you want, but you kind of don't have to. Whereas like, will you really look at these 10?

• 33:34Speaker 00

  Yeah.

• 33:34Speaker 01

  Yeah. And so like all of that work, like our product does that. Yes.

• 33:38Speaker 00

  That's cool. Okay. So where do you think it goes broadly?

• 33:40Speaker 01

  I think that so much of the work of a compliance team is again, keeping things in sync, keeping, and like different sorts of text in sync, right?

• 33:54Speaker 01

  Adding on new compliance regimes, which is just adding controls. And then you, but really, if you want to map the like, you know, new ones to the old ones and figure out where the duplicates are. That's actually a huge part classically of the work of a compliance team. And so I think there are so many opportunities for LMs at Agentic workflows in Vanta's business. And we've, you know, we probably have a couple dozen of them. And if I think about our roadmap, you know, knock on all the things like, well, like hundreds by the end of the year.

• 34:24Speaker 00

  Yes, yes.

• 34:24Speaker 01

  But it's just, and it's kind of, what we've been doing is breaking down what folks do, right? And so you're like, okay, there's a questionnaire piece. If you send out a questionnaire, someone has to read it on the other side. And then you have to think about it and figure out, you know, where does it work, where does it doesn't? Oh, I have this new policy update. I need to put this thing in a policy. I need to, we're going to. Start doing, I don't know, ISO 42001, which is a new AI standard. And so how do I map that in?

• 34:50Speaker 00

  Yes.

• 34:51Speaker 01

  I need to rerun a risk assessment. I'm going to change my like risk score. Anyway, all of these things, all of these tasks are all just like workflows that you could have an AI do, write an eval against with like subject matter experts and then he'll climb until they're quite good.

• 35:07Speaker 00

  And so it feels like, you know, you can reason about the number of people in a profession, especially at a certain stage of company changing.

• 35:16Speaker 01

  Yes.

• 35:16Speaker 00

  Like if you think back to ancient times, I don't know, the year 2000, if you had a 10 person company with, you know, 10 gateway 2000 beige workstations.

• 35:26Speaker 01

  Yeah, yeah.

• 35:27Speaker 00

  They probably would have had an IT person.

• 35:29Speaker 01

  They probably would have.

• 35:29Speaker 00

  That IT person would have had.

• 35:30Speaker 01

  Had to like service in the closet.

• 35:31Speaker 00

  Yeah, exactly.

• 35:32Speaker 01

  Yeah, yeah, yeah.

• 35:32Speaker 00

  Service in the closet, they had Microsoft Access Database.

• 35:35Speaker 01

  Right.

• 35:35Speaker 00

  They had to do software updates, you know, for all the machines.

• 35:38Speaker 01

  Right.

• 35:38Speaker 00

  Occasionally like lint and stuff will get stuck in the mouse ball.

• 35:41Speaker 01

  Oh, yeah, yeah.

• 35:41Speaker 00

  And you have to take it out and clean it.

• 35:42Speaker 01

  Take it out.

• 35:43Speaker 00

  Exactly.

• 35:43Speaker 01

  I thought for that one time.

• 35:44Speaker 00

  And all those kind of stuff. So IT was a real job.

• 35:47Speaker 01

  Yes.

• 35:47Speaker 00

  Now, I don't think a 10 person company really has an IT person. Because the hardware is super reliable and you just buy a new version every now and then. Everything's in the cloud, so there's no porting data over.

• 35:56Speaker 01

  Yes.

• 35:56Speaker 00

  You just use Google Workspace for everything and it works really nicely. And so IT still exists as a profession, there's lots of interesting things.

• 36:02Speaker 01

  Yeah.

• 36:03Speaker 00

  But, you know, Stripe has a bunch of IT people. You don't need a bunch of IT people at the.

• 36:06Speaker 01

  You have to like mail laptops to like how many countries in the world, which is like actually kind of hard.

• 36:10Speaker 00

  Yeah, for sure, yeah. We have some IT challenges, but, but again, we're 10,000 people. And again, it naively feels like you will have a similar effect with compliance as we had with IT, where the professional very much stays around. It actually gets more skilled rather than like, I think the stuff we do in IT is harder than kind of the, the basic IT that a 10 person company would have done. Is that basically where compliance is going?

• 36:32Speaker 01

  Yes, so one, one model we've thought about with Banta. Even like pre-AI is we will delay the point at which you have to bring on a full-time security compliance person or like a kind of consultant who's spending meaningful time. But you know, in the past, if you were an enterprise company, maybe you did that at 50, 100 and it's like, can we actually push that further out?

• 36:53Speaker 00

  Yes.

• 36:54Speaker 01

  Because what we see is that like an engineering leader or someone in the engineering org can manage more of this because they kind of have the mental models and they're usually system thinkers and they can, you know.

• 37:04Speaker 00

  And they're responsible for it so they can kind of change the stuff.

• 37:06Speaker 01

  Exactly. Yeah. And so you're like, have this persona, if you call them Amelia engineers, but like you have the Amelia engineers just like going further here. And then you bring on, and then you can bring on a like unified security and compliance person versus like, oh, you're a security person, you're IT person, you're a compliance person.

• 37:22Speaker 00

  Yeah.

• 37:23Speaker 01

  But it's a little bit of like the, kind of what we're seeing in the like engineer PM designer collapse. You have the like security compliance IT collapse into one role.

• 37:31Speaker 00

  You can keep them unified for longer.

• 37:33Speaker 01

  Exactly. If you can give them good tools.

• 37:35Speaker 00

  Yes.

• 37:36Speaker 01

  Right, they can do that. Okay, fine. And then again, pre-AI, but then over time, that team starts to grow and you have a GRC team and CISO and all this. What we're talking about now and we haven't seen yet, but if I like had the future cast and guess, is we're gonna see actually those GRC teams collapse a bit more into these single dreaded owners. Taking a GRC team today, there's maybe one person answering questionnaires, one person just reviewing new software vendors, right? And you look at those and you're like, okay, I think you can mostly agent, agent the work and then have someone oversee it with 20% of your time. But like, okay, great, you've collapsed 2 into 40%, right? And you're just kind of, and you're like, okay, you have some person who's like the,

• 38:19Speaker 01

  who is responsible for bothering the engineers to get evidence for them, you know, when they forward the audit or like to get the control in place because they don't own the control, but they own the program, so they have to go to the engineer and be like, hello, I noticed you have a new database that is not encrypted and like, will you please encrypt it, right? And you're like, you can just have software go nag that person. Anyway, it collapses and so I do think we will seek smaller GRC teams managing agents, but actually in the future. Yeah. And then they are doing more, I'm not doing the security reviews, I'm like thinking about the findings and overall managing this like risk portfolio, this like vendor risk portfolio versus being like, oh, this vendor doesn't have this thing and I need to go get it from.

• 39:04Speaker 00

  Yeah, I think what you're saying is there's a strategy component to how should we be doing things?

• 39:08Speaker 01

  Yes.

• 39:09Speaker 00

  And then there's an hourly labor component to compliance, which is like, oh, we did 10 times many sales. We need like 10 times many bodies on the security reviews. And you're saying this AI will eat up a lot of the hourly labor part of compliance and leave people doing the strategy work.

• 39:23Speaker 01

  Yes.

• 39:24Speaker 00

  Yeah.

• 39:24Speaker 01

  Yeah, I do. I do think that.

• 39:26Speaker 00

  What changes are coming down the pike in the world of compliance?

• 39:29Speaker 01

  I think there's, to the XKCD, there's lots of folks both trying to make new compliance standards. But there's a little bit of like, what's, what's the difference with the 22nd one? From a Vanta perspective, we've sort of taken a like, we will support them all because we have built a machine where it is easy to add a new one in.

• 39:46Speaker 00

  Yeah, but obviously you only want to support ones that customers actually want to comply with. So you're not.

• 39:50Speaker 01

  Well, yeah, but like kind of what we do, actually, we used to spend a bunch of time debating which ones those would be. And it was honestly so frustrating. Exactly. Now you're just like, build the machine that just lobbed them in. And so the debate and the document you would write.

• 40:02Speaker 00

  Do you want to support this payment method? Sure.

• 40:04Speaker 01

  Sure, whatever. Yeah, exactly. We did that with compliance standards and integrations because it was just like the prioritization debates were just too intense.

• 40:12Speaker 00

  Yes, yes.

• 40:13Speaker 01

  We can take all of that debate time. And anyway, so anyway, there's a bunch of those. I would I bet on any of them. If you really like pressed to me, I would say ISO 42001, just because it's the European one.

• 40:25Speaker 00

  I don't know that ISO.

• 40:26Speaker 01

  You, 42001?

• 40:27Speaker 00

  You've got to catch me up on this new ISO.

• 40:28Speaker 01

  It's a good one. My recommendation is about time reading. So I saw you're, you know, this, but like European standards body. And it is their version of what you, what one should care about with AI.

• 40:40Speaker 01

  It ends up being pretty data privacy focused and pretty high level.

• 40:44Speaker 00

  Yep.

• 40:45Speaker 01

  Those are the counters. The pros are that European enterprises are the ones that care the most about AI. And this is where they return. And so it's a thing that has the most market traction so far.

• 40:55Speaker 00

  But again, none of these are-

• 40:56Speaker 01

  But like, none of these are like breakout. None of them have product-market fit.

• 40:58Speaker 00

  And none of them are regulatory, like they're all-

• 41:00Speaker 01

  Correct.

• 41:01Speaker 00

  You opt into-

• 41:02Speaker 01

  Exactly. It is like this market has like roughly agreed you might need this thing. So there's that. I think the, ah, okay. Um, I'm gonna part of this. They're like trust, if you're familiar with trust centers? They're the, um, security status pages.

• 41:19Speaker 00

  Oh, sure.

• 41:19Speaker 01

  Like trust dot blah blah blah, trust dot vanta dot com, trust dot-

• 41:22Speaker 00

  I didn't know they're called trust centers. It's just like a status page.

• 41:24Speaker 01

  Yeah, but like they're for your security posture. So you get the like, you know, green bars, sort of, or green traffic lights or yellow traffic lights. But it's for your controls.

• 41:33Speaker 00

  I see.

• 41:34Speaker 01

  And I-

• 41:35Speaker 00

  But do they all just say the same thing? Like a status page is like red, amber, green, or hopefully the trust center always says, "We're a real compliant boss."

• 41:43Speaker 01

  Yeah, yeah, exactly. And so there's like a version of that. And so if nothing else, what they actually are, they're ticket deflection for the GRC team.

• 41:50Speaker 00

  I see.

• 41:50Speaker 01

  You know, because like one, your sales team sends them out and you're like, doesn't it look good? And then if you have any questions, you know, here you go.

• 41:57Speaker 00

  Yeah, yeah, yeah. It's the pre-filled questionnaire.

• 41:59Speaker 01

  It's a pre, yes, exactly. It's like, here's the binder of information, please read it. And if you have questions for me thereafter, I am here.

• 42:05Speaker 00

  Does that work?

• 42:06Speaker 01

  It does, actually. And I think part of it is the just show of strength.

• 42:09Speaker 00

  Yeah, yeah, yeah.

• 42:10Speaker 01

  And the show of like, I'm on top of it.

• 42:11Speaker 00

  Yep, yep.

• 42:12Speaker 01

  And then there is like, yeah, yeah, read things first and then if you want to ask me, go for it.

• 42:16Speaker 00

  Has outbound selling gotten harder now that everyone is, has a million AI bots spamming everyone?

• 42:22Speaker 01

  I think it has. What I have heard is, um, phone calls work. In a way that I do kind of wouldn't think-

• 42:28Speaker 00

  For now, right?

• 42:29Speaker 01

  For now. But now with like emails, like, yeah, yeah, a million AI bots. And I mean, like, how many chat GPT written emails do you get, you know, in your inbox a day? But outbound phone calls are currently working.

• 42:41Speaker 00

  Got it.

• 42:42Speaker 01

  Yes.

• 42:42Speaker 00

  But again, it's only a matter of time until-

• 42:44Speaker 01

  It's only a matter of time. And I think, you know, then you're just back to like, oh, events, right? And especially like small curated events and yeah.

• 42:51Speaker 00

  Yes. A topic we, um, talk about sometimes here is on-demand software. Patrick's taken to saying that software should be like pizza, you know, delivered fresh, piping hot. But why are you using software that someone coded five years ago?

• 43:04Speaker 01

  Right.

• 43:05Speaker 00

  Rather than just the computer deciding what to render to you at that moment?

• 43:09Speaker 01

  Yes.

• 43:09Speaker 00

  Is that coming to vanta?

• 43:11Speaker 01

  It is. It's something we're playing with internally, but like really excited about is, um- Having an agent that maybe is guiding you through the process or doing something and then needs the user to render an opinion or make a connection or do something. And can the agent just generate UI specific for that task? So the user completes it and then move on.

• 43:33Speaker 00

  Yes.

• 43:34Speaker 01

  And you get this bespoke agent-generated, hand-generated UI just for that.

• 43:38Speaker 00

  But are you talking about, because like, maybe people have a little bit of an experience with agentic UI where, you know, an AI chat interface is like people's first experience. And maybe there's like three options you can choose. Example, that's like kind of an agentic UI, but you're talking about a full UI.

• 43:54Speaker 01

  Or like, maybe you have that agentic chat bar on, you know, half of the page or a third of the page, and then the other two thirds would be a SaaS app. You can imagine a data table with a view and columns and, you know, rather than just like customizing it, you're like, no, no, no, I just want you to do this thing and it will take over that right side canvas of the page.

• 44:12Speaker 00

  Yeah, yeah.

• 44:12Speaker 01

  Generate the UI for the thing or generate the report. I think reporting is another great use here.

• 44:17Speaker 00

  And what step of the process would this be in? Would this be like you have 14 things you need to fix to get?

• 44:23Speaker 01

  Yeah, so we thought about it in two ways. So kind of in the like, you're setting it up and you're going through. And actually, reporting is another, I think, great case. It's like, no one wants more, you know, knobs and whistles on their reporting tool.

• 44:35Speaker 00

  Yes.

• 44:35Speaker 01

  And also, no one really wants to learn SQL.

• 44:37Speaker 00

  Yeah.

• 44:38Speaker 01

  You just want like, I want to report for this, go, generate it.

• 44:42Speaker 00

  Yeah, yeah, yeah.

• 44:42Speaker 01

  Like, not quite right, take this out.

• 44:44Speaker 00

  That's cool. So when will we be seeing generated UI in Vanta?

• 44:48Speaker 01

  The summer.

• 44:48Speaker 00

  Wow, okay. What has worked well from a go-to-market perspective for you guys?

• 44:52Speaker 01

  In a way that we don't, we have tried to, but brands, honestly, the billboards. We do all the stuff people do of like, you know, zip code tracking and all of that. Gong call mentions. So recorded sale, like, mentions of the word billboard on recorded sales calls. And then you can track.

• 45:10Speaker 00

  To measure the billboard.

• 45:11Speaker 01

  Exactly. Then you track those deals through to closed one and like that.

• 45:15Speaker 00

  And you're ultimately doing a geosplash. You're looking at like the, yeah, yeah, locations where you had a billboard versus not.

• 45:21Speaker 01

  Exactly. And then just like, does the prospect say the word billboard?

• 45:25Speaker 00

  I see.

• 45:25Speaker 01

  In a call at some point. So some of that podcast advertising has been exceedingly effective for us. It's funny because we started doing it in late 2020 and our first salesperson, Eric, who's still at the company, really wanted to advertise, I think, on this week in startups. And I thought it was silly because my model is like, the only companies that advertise on podcasts are founders who want to hear about themselves. Like, this is just nonsense.

• 45:53Speaker 00

  Or mattress companies.

• 45:54Speaker 01

  Exactly, or mattress companies. But like, exactly. But like, we are neither, right? Like, doesn't everybody really need a SOC 2? Anyway, and so that Paul, he came to me and was like, I want to spend $60,000 on this ad. And my deal with him was like, fine, but you got to sell four more Vantas because a Vanta basically costs $15,000. And the next month, he sold like 34 more Vantas because of the podcast ads. And I was wondering, like, well, I know nothing. You should just keep going.

• 46:18Speaker 00

  I call this, by the way, I think there's a real, there's the founder negative value add at times where founders have these incredibly strong views that are wrong, but it's like really hard to remember. It's good that you let them go and do it because sometimes, you know, I think some people would have said, no, we're not doing that. It's silly. And it would have taken many more years to run the deal.

• 46:34Speaker 01

  The deal is you have to sell four extras.

• 46:36Speaker 00

  Yeah, I feel like I've heard you on the Acquired podcast.

• 46:39Speaker 01

  We do, yeah. Because I'm acquired. We do Invest Like The Best.

• 46:42Speaker 00

  Yeah, I like those.

• 46:43Speaker 01

  And I think in the early days, so this was helpful and then deeply unhelpful, but in the early days, before we had competitors, we tried to basically make this call response of like, someone says SOC 2, someone says Vanta. And there's really close association, which in the early, again, when we were just competing.

• 47:00Speaker 00

  You wanted to like own the term SOC 2, basically?

• 47:02Speaker 01

  Yes, basically. Which worked really well until we had competitors who were like, well, we do a SOC 2, but we're, you know, Vanta, but cheaper, but worse, but better. And then you're like, oh, that got, you know, like, now we're all pointing at a thing we don't own. And like, that's bad. And so there was a, yeah, that's like kind of a, then there was a great reframe on that one.

• 47:20Speaker 00

  Yeah. What did you learn working with Fred Wilson?

• 47:23Speaker 01

  USV is a very special place in lots of ways. And I think USV is fundamentally about ideas.

• 47:31Speaker 00

  More so than other venture firms.

• 47:32Speaker 01

  Yes, I think most venture firms are sort of great man, great person firms.

• 47:36Speaker 00

  Yeah.

• 47:37Speaker 01

  They're about the person and this person will like do the thing.

• 47:39Speaker 00

  I have no idea what this is, but I like the cut of his jib.

• 47:41Speaker 01

  Exactly, yes. And I think USV is, you know, in a, it's just two black and white, but it's like basically the opposite.

• 47:48Speaker 00

  Hmm.

• 47:49Speaker 01

  Whatever person can walk in, but like if it is an idea that is interesting and compelling and intellectually engaging and networked.

• 47:57Speaker 00

  Yes.

• 47:58Speaker 01

  That is like classic USV. And they match back some great people. I don't mean that, but it's just first thing, first, second and third thing is the idea. And so like really pressing on that was that piece.

• 48:12Speaker 01

  That it is like very important. I think the second part is market sizing is bullshit.

• 48:20Speaker 01

  You know, you can like be as academic or whatever, strategery-ish as you want about it. And like the market size today is only a predictor of the market size today. And I think I deeply learned that because if you like, you just, if you looked at the SOC 2 market in 2018, my best estimate was there was $10 million spent globally and you would never start a startup on that. But the theory of Vanta was like, well, if we can make this thing easier to get and like take down the cost, dollars for really time, more people will get them.

• 48:53Speaker 00

  Yep.

• 48:54Speaker 01

  And you're like, that ended up being deeply true. But it, that was not a market, especially for startups. The market for startups getting SOC 2 in 2018 was zero dollars.

• 49:05Speaker 00

  Yes, yes.

• 49:06Speaker 01

  Truly zero.

• 49:06Speaker 00

  Yes. Okay, so Vanta is an example of the kind of company that being too tan-brained.

• 49:13Speaker 01

  Yeah, you would not come up with it. And now it's like, oh, but of course everyone gets it. And you're like, right, but like 2017.

• 49:19Speaker 00

  Yes.

• 49:19Speaker 01

  Again, when did Stripe get a SOC 2?

• 49:23Speaker 00

  Probably reasonably early on because it's so core. Like, it's not a small part of your stack, but definitely before 2017. It's very interesting framing on USV where I feel like you can see this a little bit in Fred's blog and stuff where it's clear, yeah, exactly, attraction to ideas and a prepared mind for, you know, when something like crypto comes along.

• 49:46Speaker 01

  Exactly, comes along, you're like, that thing.

• 49:47Speaker 00

  You're ready to strike, yeah. And is that across the firm or is that Fred in particular?

• 49:52Speaker 01

  Fred and Brad, for sure. Brad is the undersung Fred partner. I mean, they started the firm together.

• 49:58Speaker 00

  Tell me about the Fred and Brad relationship.

• 50:00Speaker 01

  Yeah, yeah. Brad Burnham is a venture capitalist, mostly retired now, but like, also excellent, incredible track record. He and Fred started Union Square Ventures in, I think, 2002. First fund was '04. Took them two years to raise that fund. If you go look up USV '04 vintage, like, oh, God, we all should have invested in that, you know? But it was the two of them, and then Albert came on as the venture partner, I think in like '06, and he was on the fund as a partner. Going real deep here, sorry. But it was like the two of them, and there is just, I don't know, yin yang, it's not the right frame, but like, yeah, like, and so many of the ideas of the firm were back and forth by them.

• 50:42Speaker 01

  And then Fred was excellent at articulating those ideas in a way the rest of the world could understand, even on AVC.

• 50:53Speaker 00

  Yes.

• 50:54Speaker 01

  But I think one of the underappreciated things is like, how much back and forth there kind of was there in the creation there.

• 51:02Speaker 00

  Yes.

• 51:02Speaker 01

  And like, that pairing is, I think, probably should be in the annals of like, you know, the coastal door pairing, maybe like Leonie Marat, like, these venture pairings where you had two people who could play off one another, and they were just like, that, like, I think Brad and Fred had that for like, a decade and a half.

• 51:20Speaker 00

  What's the difference in person? Because like, say Doug and Mike Morris at Sequoia are very different people. I mean, again, I think that's part of how it works.

• 51:27Speaker 01

  Yeah. I don't think Fred and Brad are as different as those two, but like, yeah, Brad is cerebral, philosophical, academic, like, so interesting to talk to, and you have this wonderful conversation, and you'll be like, are there any ties to the business world of that? You know, but like, but like, truly, these like, and then like, one thing Fred could do was like, go back and forth and be like... Oh, freemium, you know, and then like run with freemium, right? But it wasn't just, I'm going to market this term. It was like, it was a back and forth and then the communication out.

• 51:56Speaker 00

  Wait, did Fred coin the term freemium?

• 51:57Speaker 01

  He did. Yeah, and like a blog post in like 2009, I don't know, eight, nine, something like that. Yeah, yeah, yeah. Right, like, doesn't that feel like it was just like always a term?

• 52:05Speaker 00

  Yeah, exactly. This is what it's called.

• 52:06Speaker 01

  In 1992, didn't they talk about freemium?

• 52:09Speaker 00

  Yeah, it's like when you learn those things like, um, did you know, um, the saying the quiet part out loud? That term comes from The Simpsons. In what ways are you a different CEO coming from your experience as an investor?

• 52:19Speaker 01

  I mean, I wouldn't have done it. It's a real answer.

• 52:22Speaker 00

  That's a good start.

• 52:23Speaker 01

  I mean, I was really lucky and heard from like nine million ways with them. One of the ways was for two years, I just like met 15 founders a week for two years straight. And I think whatever model I had of like what a founder is or does was like, yeah, that exists. But like, look at all the ways one can do it. And there's like some coming out, some more successful, but just like, there's a lot of ways to do this thing. And I think that exposure was super helpful for me. Cause you got to see people who I felt more affinity or similarity to in whatever dimension, like also do it. And it was just like, it was kind of the role model thing, but not like one person, just, you know, you meet a thousand of them.

• 53:08Speaker 00

  Yes.

• 53:09Speaker 01

  Uh, and you can pick out the pieces.

• 53:10Speaker 00

  Having all that training data, what passions do you think you see in people who went on to be successful? Or maybe conversely, what anti-patterns do you see in the people who?

• 53:18Speaker 01

  Oh, I think there is a like, someone said this better for me than me, but like, there is a totally a truth-seeking piece of it. Or just sometimes you can bend reality to your will, but often like reality is reality. And you gotta like embrace it and figure out how to work around it. Like reality, sometimes it's an immovable object. And I think there was a

• 53:37Speaker 00

  It's a delusion for unsuccessful founders?

• 53:39Speaker 01

  Exactly.

• 53:39Speaker 00

  I've never seen that.

• 53:40Speaker 01

  Yeah, yeah, they're like, oh no, but I can change this. And you're like, yeah, that one, I don't, you know, gravity's gravity, kinda?

• 53:45Speaker 00

  Yes, yes. Yeah, the version that I talked about with, uh, with Dez Trainer is I feel like investor updates with a lot of words and no metrics.

• 53:54Speaker 01

  Oh yeah, those are bad.

• 53:56Speaker 00

  Those are bad. And actually like, no investor updates is fine, like you didn't have to send me

• 54:00Speaker 01

  Either way.

• 54:00Speaker 00

  Yeah, yeah, exactly.

• 54:01Speaker 01

  No, it's either very good or very bad.

• 54:02Speaker 00

  Yeah. Um, metrics is fine, but like a lot of words and no metrics is almost a sure sign of failure.

• 54:09Speaker 01

  Bad, yes, yep.

• 54:10Speaker 00

  Because again, I think it gets at that delusion.

• 54:12Speaker 01

  Right.

• 54:13Speaker 00

  Failure to truth seek.

• 54:14Speaker 01

  Yes.

• 54:15Speaker 00

  Tendency.

• 54:18Speaker 01

  What else? I think famous Etsy and Kickstarter, but a bunch of these companies of this era stories, where I think I developed, yeah, that's true, this huge appreciation for product market fit. That sounds so dumb, but kind of now it's still like if you think you have it, you don't.

• 54:34Speaker 00

  Yeah.

• 54:34Speaker 01

  Framing, but you're just like.

• 54:36Speaker 00

  Or if you're asking whether you have it.

• 54:37Speaker 01

  You don't, yes. And so Etsy, great example. You're like, co-founder, CEO spent 80% of his time for kind of years, like making people desks, because they had this lovely cultural thing. When you joined, you would getting like homemade bespoke desks, because they sold homemade bespoke things.

• 54:53Speaker 00

  So there's a thing, Yancey would make people a desk?

• 54:56Speaker 01

  Rob, I think it was Rob Kalin at Etsy, he would make people a desk.

• 55:00Speaker 00

  Yeah, I'm getting confused between Kickstarter and Etsy.

• 55:02Speaker 01

  This is the Etsy version.

• 55:03Speaker 00

  Yeah, yeah.

• 55:03Speaker 01

  And you're just like, now you're like, 80% of a CEO's time is making desks and the business is on fire.

• 55:09Speaker 00

  See, Amazon had it figured out where you had to make your own desk. It's a much more scalable life.

• 55:14Speaker 01

  Right, Rob made the desks. But you know, you're just like, I mean, it's kind of a funny story, but you're like, the business was fine.

• 55:18Speaker 00

  Yeah, yeah, yeah, exactly.

• 55:20Speaker 01

  So there are just these things that have like their own physical, their own immovable objects.

• 55:26Speaker 00

  Yeah, yeah.

• 55:26Speaker 01

  And you can be making desks for people all day long.

• 55:30Speaker 00

  Yeah, yeah.

• 55:30Speaker 01

  It doesn't matter. And like, if you don't have that, you know, it's not that we should all, I mean, maybe we should all go make desks. I don't know. How did, would you make, would you spend time making desks? At this stage?

• 55:40Speaker 00

  I think woodworking is very, I don't do it, but I did it as a kid. It was satisfying, so.

• 55:45Speaker 01

  Yeah.

• 55:45Speaker 00

  Last question. Does Vanta expand from here beyond security? Do you start helping people apply with everything else? Just do you continue taking over the world until all the world runs on Vanta?

• 55:56Speaker 01

  Yeah.

• 55:57Speaker 00

  What's fun?

• 55:57Speaker 01

  Definitely taking over the world, making desks along the way. No.

• 56:02Speaker 01

  I think right now we do think about, especially in this world where in theory code has become much cheaper, which was two things. So one, it's like, can we add different pillars or verticals? And so there's a whole lot in security, especially for a small business or a mid-market business. I think enterprise, it's a different ballgame there, there's things there. And then when we think about it, we really think about, we would think about parts of the CISO organization versus for the most part, other parts of an organization. But we would think about enterprise risk or internal audit, financial audit is adjacent and interesting.

• 56:38Speaker 00

  What can you do in internal audit or financial audit?

• 56:40Speaker 01

  So.

• 56:42Speaker 01

  Internal audit is sort of easier for us, given what we've built, in a way. It's like, we have all of this and currently we're packaging material and sending it to the auditor. But you can imagine packaging it and sending it to a internal.

• 56:54Speaker 00

  And the same thing, it's a controls platform, right? It's like, decide what it is that you should do and then validate that you're doing it.

• 57:00Speaker 01

  Prove that you're doing it, exactly. Financial audit is, the system is similar. It's a different set of integrations on data. And so it's thinking through, okay, at what is the right point to start building out those ERP integrations, so payments integration, all of that, to get that sort of data to parcel, listen.

• 57:18Speaker 00

  Exciting.

• 57:19Speaker 01

  Yeah.

• 57:19Speaker 00

  Christina, thank you.

• 57:20Speaker 01

  Thank you.