Christina Cacioppo - Building an Enduring Software Company in the Age of AI - [Invest Like the Best, EP.496]

My guest today is Christina Cacioppo, founder and CEO of Vanta, which helps more than 16,000 companies manage security and compliance. Five years after our first conversation, we discuss how Vanta became a category leader, what it takes to reinvent a successful software business in the age of AI, and why Christina is betting on agents to do the work rather than simply assist users. We also explore the changing economics of software, the war for exceptional talent, AI's impact on cybersecurity, and what it takes to build an enduring company in Silicon Valley's rapidly changing environment. Please enjoy my conversation with Christina Cacioppo. For the full show notes, transcript, and links to mentioned content, check out the episode page here. ----- Become a Colossus member to get our quarterly print magazine and private audio experience, including exclusive profiles and early access to select episodes. Subscribe at ⁠colossus.com/subscribe⁠. ----- ⁠Ramp’s⁠ mission is to help companies manage their spend in a way that reduces expenses and frees up time for teams to work on more valuable projects. Go to⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ ⁠ramp.com/invest⁠⁠ to sign up for free and get a $250 welcome bonus. ----- Trusted by thousands of businesses, ⁠Vanta⁠ continuously monitors your security posture and streamlines audits so you can win enterprise deals and build customer trust without the traditional overhead. Invest Like the Best listeners get a special offer of $1,000 off Vanta when you go to ⁠vanta.com/invest⁠. ----- WorkOS⁠ is the infrastructure B2B and AI-native companies use to sell to enterprise. It covers everything enterprise security requires: SSO, SCIM, RBAC, Audit Logs, AI governance, and more. Trusted by 2,000+ fast-growing companies, including OpenAI, Anthropic, Cursor, and Vercel. ----- Rogo is the AI platform for finance. They're building agents for Wall Street that are trained to understand how bankers and investors actually do work: from diligence and modeling, to turning analysis into deliverables. To learn more, visit rogo.ai/invest. ----- ⁠Ridgeline⁠ has built a complete, real-time, modern operating system for investment managers. It handles trading, portfolio management, compliance, customer reporting, and much more through an all-in-one real-time cloud platform. Visit⁠ ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ridgeline.ai⁠. ----- Editing and post-production work for this episode was provided by The Podcast Consultant. Timestamps: (00:00:00) How Vanta Won a Crowded Category (00:03:12) Living Through the Software Selloff (00:05:41) Building an Agent-First Product (00:07:39) Why Vanta Eats the Cost of AI (00:10:35) The Search for Outcome Pricing (00:14:31) Getting People to Actually Use AI (00:17:46) Why Comp for Top People Is Up 10X (00:22:13) Valuations, Tenders, and the Endgame (00:24:20) What’s Overhyped and Underhyped (00:27:54) The Problem With FDEs (00:29:34) Why French Startups Use Chinese Models (00:30:22) Vanta as a Security Company (00:36:57) What Makes a Great Talk (00:40:14) Where She Would Invest Today (00:45:19) The Billboard War (00:49:35) The AI Trust Crisis (00:51:39) Security Five Years From Now

Speaker names marked ? are inferred from speaking time and the show’s known hosts — they are not voice-verified.

• 0:00Patrick O'Shaughnessy?

  Ramp is the only platform built to make your finance team leaner, faster and better, saving businesses 5% annually on average, so you can stay focused on growth. Ramp just opened for business in the United Kingdom, so if you're running a business in the UK, you can now use Ramp's AI-powered finance platform to manage cards, expenses, bills, approvals and accounting, all in one place. I run my business on Ramp and so should you. Learn more at ramp.com/invest. OpenAI, Cursor, Anthropic, Perplexity and Vercel all have something in common. They all use WorkOS. And here's why. To achieve enterprise adoption at scale, you have to deliver on core capabilities like SSO, SCIM, RBAC and audit logs.

• 0:45Patrick O'Shaughnessy?

  That's where WorkOS comes in. Instead of spending months building these mission-critical capabilities yourself, you can just use WorkOS APIs to gain all of them on day zero. That's why so many of the top AI teams you hear about already run on WorkOS. WorkOS is the fastest way to become enterprise-ready and stay focused on what matters most: your product. Visit workos.com to get started. Rogo is the AI platform purpose-built for financial institutions, serving tens of thousands of bankers and investors at hundreds of leading firms worldwide. Rogo's AI agents autonomously execute large chunk of your firm's workflows. They can screen deals, draft SIMs, run buyer outreach and do diligence on data rooms, all with full security and compliance handled.

• 1:29Patrick O'Shaughnessy?

  Every action feeds Rogo Intelligence, the firm's context layer, turning years of deal experience into a secure, governed institutional memory that makes each new transaction stronger than the last. To learn more, visit rogo.com/invest. So Christine, I've been so excited to do this with you. I think it's been five years since we last did it. A lot has happened.

• 1:53Speaker 01

  A lifetime ago.

• 1:54Patrick O'Shaughnessy?

  A lifetime ago. You've been very successful in the interview in five years, so I'm excited to catch up. Can you give us like the one-minute history of Vanta? I know we've done this before, but just to level set for people. When you started it, why, what it did then, how it's evolved, what it does now? Quick overview?

• 2:07Speaker 01

  Started Vanta about eight years ago, which feels about 8,000. Yeah, exactly. You're like in 17 centuries ago with the premise of can we help companies build and earn trust? And build trust is like start security programs and compliance programs or mature them and then go get credit for their customers through audits like a SOC 2 or ISO 2701 HIPAA, etc. Security questionnaires, trust centers. But basically this idea of can we build a security company by helping companies implement security because it's what their customer is asking for? So we're initially known for SOC 2 billboard. We do have a billboard on the 101 that we're mostly known for making billboards. I joke, but it started very compliance, very audit-centric.

• 2:52Speaker 01

  The idea was always, hey, that's just one way to get a company started on this. Since then, we've gone into different areas of security. We've gone into different ways of earning trust with your customers. Today, we're about 16,000 customers global with about five products.

• 3:08Patrick O'Shaughnessy?

  How did you win? This was a new category when you started and I remember I had to go through it. My old business gets SOC 2 compliant and certified in order to win certain accounts or whatever. So it became an important thing, kind of in the software era. There were many companies, I could probably name a handful, that were trying to do what you're trying to do.

• 3:25Speaker 01

  Yes.

• 3:26Patrick O'Shaughnessy?

  You've emerged as sort of the only major winner. What would you attribute it to over the last, since we last talked? Like, how did you win?

• 3:31Speaker 01

  Execution. Software, the blessing and the curse, and this is more true now even than it was five years ago. You're really only as good as the last thing you shipped. You can be first and you can start it and it doesn't really matter. And it was more true now because it's like someone can vibe code your thing in a weekend. So you've just got to constantly be shipping new products, new features that make the experience better for customers, running on that differentiation. There's some feature level. I think the other thing we really invested in when it got competitive that was very good was integrations, pulling in data from other tools. So now you can connect Vanta to one of 400 tools.

• 4:11Speaker 01

  We pull a ton of data out of those tools and that's what powers the automation, the agent, the AI, all of that. We call it our trust graph. It's really just like a security data lake and that is bigger, broader than any other provider, including some of the security providers because we touch areas they don't. And I think in retrospect, that data foundation has let us build new things faster. Software and agent, that piece. And then I think on the go-to-market side, it was like just keep pushing. Good billboards. Shockingly good. Compliance that doesn't suck too much, which got really popular on r/accounting, which none of us knew was a bucket list item in our lives. When r/accounting likes your things, you're like, okay, something worked.

• 4:54Speaker 01

  And then the lived experience is just you can feel like you are going as fast as you can and you should in fact lean in further and push harder.

• 5:00Patrick O'Shaughnessy?

  What was the scariest moment?

• 5:02Speaker 01

  The last 12 months, SaaS apocalypse. You're like, okay, great job building a system of record. You're now screwed.

• 5:08Patrick O'Shaughnessy?

  You're now worthless.

• 5:09Speaker 01

  Yeah, exactly. You're worth, like, good job playing the game. Here's some steak knives. Parts of that are true and parts of it are not true. In the vein of you're only as good as the last thing you shipped, you're like, great. What is the agent? You have all this data and a system of record. Fine. What the heck are you doing with it?

• 5:22Patrick O'Shaughnessy?

  Say more about what that's felt like. Roughly, Vanta is a business that is growing very fast by historical standards with very high margins.

• 5:29Speaker 01

  Yes.

• 5:30Patrick O'Shaughnessy?

  Which four years ago is considered like the best business model ever. Nothing changed about that. I think you're probably growing faster.

• 5:35Speaker 01

  Yes.

• 5:36Patrick O'Shaughnessy?

  And the margin's still really high. And yet the market has decided that the multiple for a business like yours is a third of what it used to be or a quarter of what it used to be. What has it been like to live through that as one of those entrepreneurs?

• 5:46Speaker 01

  Cognitive dissonance. You've got to hold two things in your head, right? And one is, I think of the fullness of time. An 80% growth business with 80% margins will actually be better than, over the same time period, run it out long enough, a 160% growth business with 30% margins. One of these will like return more cash in the fullness of time. But today, the latter is valued at 3X, 4X the multiple of the former. It's a 10X the multiple of the former, right? And so there's a part where you're like, hey, guys, everyone's being irrational here. This is a good business and you have to keep doing things that make business sense and doing the things that customers want, which may or may not be token pricing models that put you more in the latter category than the former profile.

• 6:30Speaker 01

  And then there's like a very clear like game on the field piece. Well, if you need to be financed, again, you're looking at investors today, many of whom are kind of AI maximalists. Talk to firms that are like, yeah, we'll invest in the labs and we'll basically invest in tractors in Iowa, nothing in between. Robo-tractors in Iowa at a lab. I'm like, everything else. And you're like, huh, interesting point of view. And from a like talent perspective, you hire ambitious people who want to do things. And if it feels like they're not in the right boat, they're going to change boat. The talent war part is very real too. And so you've just got to live with the fullness of time. I think this will all sort itself out and you have to live for the fullness of time.

• 7:12Patrick O'Shaughnessy?

  So there's this funny fear that now like bending spoons is the Grim Reaper in the all way, you know, meme or whatever. No one wants to be a Ben Spoon. Love bending spoons, by the way. I think it's an interesting question of the siren song right now is sell tokens via agents for security and compliance, I'm sure, or something like this.

• 7:28Speaker 01

  Lots of thoughts on this.

• 7:29Patrick O'Shaughnessy?

  I'm just so interested by companies like yours that were sort of winners of this last era that now have to make a set of decisions. Look at the 10-year rate, the cost of capital is going up because you can put lots of money at really high return in AI stuff for the time being. Someone looking at your business is like, well, I want higher returns or the same returns and I get that through agents or something. Talk me through what it's been like to make the decisions. What are you thinking today? Do you think of yourself as an AI business? What's that like?

• 7:54Speaker 01

  So we do. When we go benchmark where we are from an agent and our product perspective against quote unquote AI applications, we have yet to find someone who is further along. You could be like, we're doing a bad job looking is the obvious critique there. We are like constantly going to the set of names you're a man to when you think AI applications and generally finding they're not yet where we are, where an agent is doing most of the work. It's chat-based, but there's like long-running agents. Our agent is auto-generating UI on the fly because sometimes you want chat, right? And sometimes you want UI, but we just have an agent that is. Building UI, user can do something, comes back in the flow, keeps it going.

• 8:38Speaker 01

  Very much optimized around the like, keep the user going in the flow loops.

• 8:43Patrick O'Shaughnessy?

  So I make sure I understand, meaning you are like a watchdog that's always on watching the security.

• 8:49Speaker 01

  So we are definitely that, but in some ways you're like, you could do that in the past with just like monitoring and alerting. This is more like Devanta product experience is now oriented around an agent that is bringing you as a user things and often saying, hey, I went and did this for you. Are you good with it? Then I will go do it. Okay, great. The next thing I think I should go.

• 9:08Patrick O'Shaughnessy?

  What's an example? Just like ground that in example?

• 9:10Speaker 01

  Someone just left your company and you didn't get them out of their accounts. I just wrote a custom agent for you that will go do that. Do you want me to go turn this on? Great. Do you also want me to go remove accounts access from these three people? Great.

• 9:22Patrick O'Shaughnessy?

  So it's not just here's a red alert that someone didn't meet the monitoring stack. It's like too many of them.

• 9:27Speaker 01

  It's like, would you like me to go do this? We're taking a lot from the AI labs in their UI, but it's like, you want me to do this once? You want me to do this always? Great. The idea is like the agent will just be doing more of this work with the user's permission, but it's like, if they tell us to go do it, we are just going to go. In the course of that, we end up using a lot of tokens. We have talked to our customers a lot about token based pricing, and I think what we've generally heard is like, people are real smart. So if you try to charge them based on tokens, they are very quick to say, oh, you've just marked up a Claude token for X. Are you Forex as good as Claude? I don't know. Let me go try it out. You actually put yourselves in a competitive position against the models that probably no application really wants to.

• 10:11Speaker 01

  Like we can talk about harm it is. You don't want to get there. What we've seen on token pricing is if you're trying to mark up at all, users are very smart and you will lose on that comparison. You can like not mark up, and this gets to the margin question, but anyone who is marking up Claude tokens for X and trying to pass that off to their users, I think.

• 10:30Patrick O'Shaughnessy?

  So what are you doing?

• 10:31Speaker 01

  We're eating the token cost right now.

• 10:33Patrick O'Shaughnessy?

  We're just taking lower margin.

• 10:34Speaker 01

  We're taking lower margin and really concentrated on usage. That experience that I just talked through where the agent is going off and doing things, we just fundamentally believe that is a much better user experience. And we've got 25% of all of our customers in that sort of flow right now. We can get that to 75%. One, I think we'll like much better retention, much better customer experience. And then if we need to go sort out pricing later, we should go sort out pricing later. This is a usage phase and like a deployment phase of this technology and just go nail that. And you can figure out commercialization after.

• 11:09Patrick O'Shaughnessy?

  I'm also so curious, you said marking up a Claude token, but what about marking up like a Kimmy token or like something that's much cheaper? What's it been like deciding what to use, what's good enough versus cost?

• 11:20Speaker 01

  This was something we started concentrating on at the beginning of the year. It was basically evals, task specific or agent specific evals. From a product perspective, we call it all the Vanta agent and it's one thing. Of course, behind the scene, it's like hundreds of agents that all have specific tasks and use tools and have computers and that whole setup that I think everyone's converging on. But in the beginning of the year, really invested in using our subject matter experts. So the folks who like RAM, security and compliance programs at other companies to write the eval frameworks and then eval their evals and using tooling for that. When we think about model swapping, it is mostly quality. It's not cost. I also think some of it to this is because we don't use as many tokens as coding.

• 12:02Speaker 01

  Coding is encoding agents, lots of token use, maybe legal and like document drafting next. And then when you get to more of the decision action world, which is where we are, relative to coding, we just don't use that many tokens. So that lets us optimize for quality versus being as concerned about cost as some of the other companies.

• 12:23Patrick O'Shaughnessy?

  When you talk to other founders, both of your era and of this new era, what are they doing here? Are they also eating the cost and discharging a software fee? What do you think the end state is going to be?

• 12:32Speaker 01

  I think everyone wants to get to outcome pricing. Everyone wants to get to that. In another life, I was a microeconomics professor, like I love this conceptually. You would get paid for outcomes and the alignment of incentives. Love it. The hard part is what are the outcomes? Support ticket closed makes a lot of sense. Actually to that, maybe differentiate outcome and output as I understand it. In support, the ticket closed doesn't output. The outcome is actually my Sonos now works, but even like the ticket closed, that is relatively unobjectionable. I think a lot of companies, Vanta included, are trying to figure out what's that like neat unit of work that we can all agree on?

• 13:12Speaker 01

  And you can say it's, oh, it's a document drafted. It's an alert closed. It's an account off boarded. And you can kind of do that, but then there's just so much cognitive overhead because you're like, I just named three things. I could name another 47. And then our user has to be like, oh, well, if I do this with the agent, I paid this, but if I do it, I'm like, you know, and you're just like, no one wants that. Everyone I talked to wants to get to outcome output pricing, but it's really not clear how you get there. Charging tokens themselves really puts you up against Claude. Then people try to obscure that by charging credits and having some like credit token exchange ratey thing. Which I think again, users are smart and they're like, I see what you're doing and I see you've obscured it. Fine.

• 13:54Patrick O'Shaughnessy?

  Are you similarly far along in, if you compared yourself, just as you did just now to companies and how you're building product and the business using these tools? What are you doing that's interesting there?

• 14:04Speaker 01

  In the vein of eight year old company and eight year old code base. It is so much easier to throw the coding agents at a small code base than a large one. And that's like a token input thing and they're getting better and better. But one thing we've spent a lot of time also investing in the last year, and I know Notion has spent a bunch of time in and they were like nine months ahead of us on. Is modularizing per to the code base so that the agent can just understand smaller parts of it and understand it fully and then be really effective. Whereas if you chuck it at, again, eight year code base, site unseen, it just doesn't have the context window to understand everything and will do silly things. Then you need a high context engineer to babysit it, which is helpful, but sort of invalidates some of the point.

• 14:48Speaker 01

  Companies have always had this problem. They've just talked about it as, oh, when we onboard a new engineer, it takes them a while to figure out the code base. Agents have made it's like, well, great. Now we want to onboard 9,000 new engineers tomorrow. So it's just like heighten that problem. I give ourselves a lower grade on that. We are like in the process of using agents and people to make the code base easier to understand too.

• 15:09Patrick O'Shaughnessy?

  If I had to grade yourself one through 10 about, wow, this changes everything, building this company from this point forward is going to be totally different. Is it 10?

• 15:16Speaker 01

  Oh, yeah, like nine. Yeah.

• 15:18Patrick O'Shaughnessy?

  You are like.

• 15:19Speaker 01

  Eight, nine. I mean, I think the like principles are still the same. Everything is hard. People matter. All the tropes are still the tropes, but the way you do stuff, it should be quite different.

• 15:28Patrick O'Shaughnessy?

  Do you feel like there's a separation happening? Again, if I took your cohort of the successful eight year ago era companies. Do you feel there is a bifurcation where some have gotten the memo and are doing really well and some are just going to end these?

• 15:41Speaker 01

  Kind of. I think there are just structural parts of some markets, and I think that makes it very good at identifying these where you can put any entrepreneur in the world in that structure. This is kind of like the, like, does market or founder win Andreessen Horowitz thing? And you're like, market wins. I think that is still true. And I think this AI technology shift has made what some markets that used to look really good, look really bad. The best person in the world can run in that and will still run into a brick wall. And I think there is a founder motivation piece where it's like, you gotta be in it and like push in this era. And if you don't want to do that, totally fine, but the rest of the company will not self organize to do so.

• 16:21Patrick O'Shaughnessy?

  Vanta automates compliance so your team can spend less time on security reviews and more time getting customers. Vanta cuts audit prep by 82% and gives you instant up to date proof of trust without all the manual work. So you can close deals faster and with less friction. Customers report a 526% return on investment and more than 16,000 companies use Vanta, including Ramp, Harvey and Snowflake. Get started with $1,000 off at vanta.com/invest. Ridge line is the first end to end system of record with embedded AI for investment management firms running portfolio accounting, reconciliation, reporting, trading and compliance on one unified platform.

• 17:01Patrick O'Shaughnessy?

  Firms are moving off legacy technology and onto Ridge line because of how far ahead Ridge line's AI features are compared to anything else in investment management software. I've been hearing from a lot of investment managers about AI and they fall roughly into two camps with some unsure where to even start. And others convinced that they can build their own order management system over a weekend. The reality is that running an investment firm will always require governance, controls and a single source of truth for your data. And no amount of AI enthusiasm changes that requirement. Ridge line is built on exactly that foundation, which is why I believe that the firms that come out ahead in the AI era will be the ones running on Ridge line's unified platform.

• 17:40Patrick O'Shaughnessy?

  If you're serious about your firm's AI strategy, Ridge line should be part of that conversation and you can request a demo at ridgeline.ai. So given that you've been at the edge, what's the adopting AI 101? If you're back to being a professor, what have been the most important things that have been hard to do, but have proven fruitful?

• 18:00Speaker 01

  Just getting people to use it, which sounds obvious, but definitely use it yourself. Build for your company personally, does not matter. Understand where the models are, where they're good, where they're bad, what harness means. Do that at least every two weeks because it just changes so quickly. You have to have this role understanding of what works and what doesn't. So that when somebody comes and they say, we're gonna fire all of our SDRs because I built one agent. And you can kind of be like, did you now? Where is that true and where that's false? So there's like a be in the muck. You want to get as many other people in that as possible. Broadly generalized, it's very black and white. Some people just go do that and some people don't. If you'd asked me a year ago, you'd have been like, oh, well, there's some intrinsic motivation and the people who aren't separate problems,

• 18:45Speaker 01

  go deal with them. I think I'm slightly more empathetic now in that we have seen very strong people not go dive in. And you have to nudge them more, but try to figure out what's blocking them. And something can be blocking them and you can get people into the muck, even if they don't dive in initially. So if you're a small company starting out on Vanta, great. We've got this set of controls for you. You adopt them, you maybe mess with them on the edges, but you're like off to the races. If you're a larger company, you clearly run a security and compliance program. And you come to Vanta because you want that visualized, you want the automation and you want the monitoring, you want the real time dashboards. You don't want the like Jira ticket thing. Fine. Well, the hard part is you've got to get all that existing stuff.

• 19:30Speaker 01

  The controls, the risks, the data, the policies, the precedents, all that stuff in the Vanta. Classically, the way you would do that SaaS company is you're like, oh, we're going to make an onboarding wizard. It has four steps on a progress bar and we will like give you confetti. You're going to do that whole thing. We were setting out to build better onboarding this year. And the first couple of product reviews, the team kept bringing onboarding wizards. I'm thinking like, stop with the onboard, like no, go use an LLM, stop. But they kept bringing onboarding wizards. And this was like a motivated team, talented people. They cared and kept bringing onboarding wizards. We finally got the experience now. They shipped and it's working. It's basically Claude, big canvas, drag all your messy files in, drag in all your screenshots. We will like make sense of it, ask you questions,

• 20:16Speaker 01

  and then you are set up and off to the races. And it works really well. Why were these smart, motivated people bringing onboarding wizards? So you go out like finally. And the thing was they were like, well, we don't know if we can get the like drag your files thing to work. It might not work. And we know the onboarding wizard will work because we've built those before. We basically don't think we're allowed to fail on this project. Oh, that's the thing? Great. We're just going to bet that the LLM flow is gonna work and we'll make it work. And we will help climb all we need to, but burn the boats and just make this thing work. And then they were like, oh, okay, great. Do you want a next product review tomorrow? But it was this like funny thing where you're like, I would not have guessed that was their blocker.

• 21:01Speaker 01

  And you saw that and they were like going.

• 21:03Patrick O'Shaughnessy?

  You mentioned the talent war thing before. There's this big trend, low margin, high growth thing, where from an investor's perspective, the funny example you gave of a lab or a tractor, everyone wants something that can be that thing. Tell me about how you're going to be a $100 billion business or a trillion dollar business. Somehow now every business needs to be that big. What's that like to face down? Where you may not be building a business that should be a $100 billion business. There's like 100 of those in the world. There's not that many.

• 21:29Speaker 01

  Yeah. And it's not to say Vanta won't be. It's funny for me, it's like, oh, should I adjust the pitch? And be like, well, inevitably the baseline here is Vanta's $50 billion. The real question you should be considering, if you join, can you take us on a journey to like 250 billion? Should I just start saying that? Probably not, but the answer is not definitely not. Totally. Because you're like, well, that is the pitch that people who work at Vanta are getting from other companies. The market now is saying that so much. You do seem unambitious.

• 22:00Patrick O'Shaughnessy?

  So what do you do?

• 22:02Speaker 01

  There's a Vanta principle, value, but principle of do what it says on the tin. Do what you say you're going to do. And look, you can put ambitious things on a tin. It's not that. Don't over promise and under deliver. What we do is give some of that, here's what we do as a company. Good, bad and different. Here's the context. Now let me talk to you about the business metrics. And we'll generally just show candidates, like show everybody everything. It's fine, they're good. We don't really want them to leak, but if they leak, it's not the worst. Walk them through that and what we're doing and how that grows over time. Try to root it in all of the facts and all of the data. And so in some ways, it's countered the vibes with data and trustworthy vibes versus YOLO vibes.

• 22:44Patrick O'Shaughnessy?

  So what is it like in those talent wars? If the most talented people are being told this thing's going to go to a trillion, basically every other company that's trying to hire them.

• 22:53Speaker 01

  Well, the better one is, well, we're $6 billion today, but Sequoia is going to do a $10 billion check in a month. And then somebody's going to write it up to 25 next year, but we can get you it at six today. That's a good one. That one's tough.

• 23:06Patrick O'Shaughnessy?

  So you're faced with that, like, what do you do? Do you not want those people? Maybe it's a filter.

• 23:11Speaker 01

  Sometimes I think if you go to the person and be like, what are you optimizing for? Why did you entertain that? But not in a pokey way, just what's annoying you at Vanta? One of these in specific, very strong leader, still at Vanta. It was basically this person felt like they couldn't make decisions that would put Vanta on a similar trajectory. And that would be their preference. But they're like, oh, but this new place is promising me full decision-making authority on this trajectory. Totally fair feedback. What do you need to feel like you can make these decisions? Like just go make these decisions, go. There's a money part and a FOMO part for sure. We've definitely gone up on comp and comp bands are kind of a joke now. The comp band is whatever data you have is wrong.

• 23:55Speaker 01

  It is what is being offered to these people.

• 23:57Patrick O'Shaughnessy?

  How much more do you pay the top person at Vanta than you did? Like as a multiple versus like?

• 24:02Speaker 01

  Oh, I think we should have way more comp dispersion than we do.

• 24:04Patrick O'Shaughnessy?

  So that's interesting. But if I go five years back and that person made X dollars, what multiple of X does the person make now?

• 24:12Speaker 01

  Total comp. It's probably like a factor of 10.

• 24:15Patrick O'Shaughnessy?

  Wow.

• 24:16Speaker 01

  I think it actually should be higher. My comp philosophy is you never pay the top people.

• 24:21Patrick O'Shaughnessy?

  Enough.

• 24:22Speaker 01

  Enough. You should always try and you will never hit it. And for the bunch of people you pay much more than their contribution.

• 24:28Patrick O'Shaughnessy?

  Say a bit more about what those top people are doing that's so valuable typically?

• 24:32Speaker 01

  High agency, get shit done. That sounds so milquetoast and that's worth millions of dollars. But like, yes, actually it is. A high context person who understands the company and the customers and the domain, making generally reasonable decisions and sometimes bad ones, and then iterating on their bad ones and just moving is so valuable.

• 24:54Patrick O'Shaughnessy?

  Do you think it'll be 10X again in five more years? Or is that starting to get too crazy? Is the rate at which the most valuable people are getting more valuable, staying the same, accelerating?

• 25:04Speaker 01

  Accelerating. The counterforce is at what point will investors get more concerned about dilution and stock-based comp? Which they weren't throughout the 2010s, late 2010s. We had more of a like stock-based comp conversation as an industry in like 2022, 23. Now we're definitely not talking about it. That's the counter side. Without that push on like dilution, I think people just get paid more and more. That's probably should.

• 25:30Patrick O'Shaughnessy?

  How much you care about your valuation and multiple and the engineering of those things?

• 25:40Speaker 01

  I've historically not cared and sometimes even done things to like demonstrate my not caring. I care about ARR and ARR growth. I pay a ton of attention to those and those in the metrics. I think I've now been through enough evaluation environments. Late 2010s, 2021, 2022, seeing the like multiple roller coaster. Where I just don't put a bunch of stock in that or I used to not. I think the thing I care a bunch about that then will get me to caring about these multiples is the sentiment of people who work at Vanta. And they feel like they're at a company that is growing and growing. And then both in general, growing and then growing relative to other, there are other opportunities in the market.

• 26:25Speaker 01

  There's a part of the market that is raising money every six months. That's five X the prior valuation. And that's a real talent competitor.

• 26:33Patrick O'Shaughnessy?

  And what about things like tenders? Have you done this historically?

• 26:36Speaker 01

  We have not done them historically, but the game on the field is you're doing a tender every time and you got to do them.

• 26:44Patrick O'Shaughnessy?

  Does this feel unhealthy?

• 26:45Speaker 01

  Totally. My opinions about it don't matter. I can have all the feelings I want in whatever direction about tenders. They are normalized and people expect them and they expect it as part of their comp. And if you are not giving it to them, you got to give them a bunch of other stuff to make it up.

• 27:00Patrick O'Shaughnessy?

  How does all of this affect your exit ambitions to go public or to be sold or realize some end game for Vanta? Not at all?

• 27:09Speaker 01

  Not really, which is again, a very founder privileged statement, but the end game is how long can we keep this going for? And 99% of the big independent software companies in the United States are public. Yes, IPO in that sense. I don't have it as a bucket list item myself. It's more of like means to an end. Lots of people during companies and want the bucket list items. So founder privileged caveat here again. But goal is big, independent standalone company.

• 27:37Patrick O'Shaughnessy?

  On all this stuff, tools for building, ways of building, kind of all these kinds of things I'm asking about, what do you think is overhyped and underhyped?

• 27:45Speaker 01

  Underhyped is knowing the company and the customers relative to knowing the skillset. It is still really hard to hire, train, onboard, make effective people who join a company. Company marines make this better and easier and like put information at fingertips. But there is still totally something to be said about someone who's been in a company, knows how to navigate the company, knows the customers, all of that. I am at a fuse right now where we value that skillset more than like the vertical skillset of you're good at sales, you're good at customer success. And would take a worse salesperson on sales skill who knows the Vanta pieces more. There's something in that.

• 28:26Speaker 01

  And I think especially as a lot of the labs and fast growing AI companies are like building out go-to-market teams, I think they're actually very much evaluating, you're a good salesperson. That's slightly off. And then I think as we think about building agents for all of this, the company context piece, the customer context piece is probably being relatively undervalued to like, you are a good salesperson. And the less valuable skill slightly today than it was four years ago.

• 28:52Patrick O'Shaughnessy?

  What about overhyped?

• 28:53Speaker 01

  Token-based pricing, low margins for the sake of having low margins. Custom training models for the marketing value.

• 29:01Patrick O'Shaughnessy?

  We able to say we post-trained a model on our stuff? Explain why.

• 29:04Speaker 01

  Go talk to the inference providers and sometimes give them, depending on the provider, give them true CRM. They will say like, look, the reason to post-train a model is cost. Some businesses have that need. But there is not a quality reason to do it. There is kind of a marketing reason to do it right now in this environment. And I think there's a lot of post-training for marketing reasons, for investors and for customers, mostly for investors, actually.

• 29:27Patrick O'Shaughnessy?

  If one of those people were pitching the other side of this, the value of post-training, what is the pitch to you? When these companies comes to you and it's like, we'll do XYZ for you. What are they saying and what do they say the benefits are?

• 29:36Speaker 01

  You are putting a stake in the ground of being a real AI company. Customers will notice. I think that's the primary one. I do think there's a secondary one in some use cases of like a form factor thing. And I think especially with large enterprises, you want to deploy this piece of software wall to wall that requires integrations and 17 people to sign off. Oof, that's a whole thing. Why don't you just give them a like model specific to them for this use case? I think that's semi-reasonable.

• 30:05Patrick O'Shaughnessy?

  So if I was one of these people and I came into Vanta, what does post-training literally mean? What would it mean in your context? What are you doing? What are the steps that you would go through?

• 30:14Speaker 01

  So we would need a bunch of data from that specific customer and then go write a bunch of eval, then change model weights based on that customer specific data.

• 30:24Patrick O'Shaughnessy?

  The process would be they're trying to achieve something. They've got some data. You tune a model to achieve the thing, increase the eval and then sell them that.

• 30:32Speaker 01

  Exactly.

• 30:33Patrick O'Shaughnessy?

  On an ongoing basis. And your point is that that's overrated because it doesn't actually improve their.

• 30:38Speaker 01

  It can. I think I'm skeptical in a couple of ways. I was like, does everyone really want to be handed a model or there's so much around that from user experience perspective, from a deployment perspective, form factor? It feels a little like, you know, in the social media or like our mobile apps, when we like, we hadn't figured out, pulled a refresh yet. There's something here. I don't think anyone actually wants to be handed a model. The same way it's like hitting a refresh button. I don't, that sounds silly, but that's what we did in 2011. There's some version of that here. We haven't figured out how this actually works. And handing models, I think is not the right reasonable iteration, but like not the right solution.

• 31:12Patrick O'Shaughnessy?

  Is there anything else like in the popular discourse that you think is crazy? FDEs?

• 31:15Speaker 01

  I kind of think FDEs are crazy. I think it's a great talent arbitrage, the same way like Chief of Staff is. What FDE often is, is professional services. But I think if you call it a professional services role, that's a very different talent profile than FDE in the current discourse. And I think you're not going to get the Harvard CS grad who's high agency and wants to go do things and learn how to build a business to go sign up to be like pro serve person number four or number 12 at a company. I think there's a real job there, but I think this FDE wrapping around it is probably not going to stay. The company that we all think does it as well is Palantir, which I think they probably do.

• 31:59Speaker 01

  They have eight-figure contracts. There are some companies that have eight-figure contracts. I think we're using FDEs in a place where there's like five and six-figure contracts. And those economics probably are upside down. We're in an era of 30% growth of margin better and said, that's what it works. That doesn't feel sustainable.

• 32:16Patrick O'Shaughnessy?

  When you're at like a dinner in San Francisco with other founders, what are you talking about? Are you talking about models and which ones to use? What are the actual topics of conversation between founders right now?

• 32:29Speaker 01

  There's definitely like talent war pieces. There was a time, this is more nine months ago, but it was the joy to go around the table and complain about cursor, their taking of everyone. There's definitely that piece. There is a bit of an, like FDEs of do you actually do this? Is it working? Where are you on this right now? Personal agents, which ones do you have? What are actually useful?

• 32:51Patrick O'Shaughnessy?

  When you think about the open source stuff, Chinese models, this, that and the other, what have you learned talking to people around the world that are grappling with these same questions?

• 33:02Speaker 01

  I was with our customers in France a couple of weeks ago, which is lovely. One of the things that I was very surprised to learn is a lot of the French software companies in Paris are using Chinese models predominantly. I initially thought it was nationalism, maybe anti-America, you know, just something there and stupidly suggested that. And someone very quickly corrected me and said, absolutely not. We basically all switched to Chinese models when Trump closed Fable off to not Americans. And we just kind of realized there's a huge business continuity risk. We can't trust that if we build a business on one of these American models, they'll always be available. So we stopped doing that.

• 33:39Patrick O'Shaughnessy?

  If you dream the most about where the business could go over the next several years, what's the version of Vanta that could look like that?

• 33:48Speaker 01

  We think of Vanta as a security company. Started with compliance. The best version of compliance is proving the security you have. You've got to have good security. We think we can and are moving into a bunch of security domains. It's sort of a platform pitch of like, look, we've already got the data. We've already got the intelligence via the agent. We can start stacking products on top of that and more security focused products. As we understand the security of all these companies, the pressure on them to go prove they're legitimate and industrial grade is just going to go up. That's one of the founding thesis of Vanta eight years ago, but it feels even more true

• 34:30Speaker 01

  now, whether they're working with enterprises, governments, regulators, lawmakers. You just have to prove your software is industrial grade in lots of ways. And that will happen more and more in more and more ways in the future. And Vanta is the thing that connects both sides of that marketplace.

• 34:51Patrick O'Shaughnessy?

  So what's the direction of security? This is of course, an incredibly interesting topic. Early internet, everything broke, everything got hacked. This will probably be that times 10 or times 100. Does security mean you compete with CrowdStrike and places like that? What does security mean and what's its trajectory in this crazy era?

• 35:09Speaker 01

  These models just are so much more persistent than people. They will just try nine quadrillion things, the way a person would give up after, I don't know, 9,000. And then in the course of that, they find things and chain things together. A lot of the discourse is around Zero Days and there's definitely some of that these models are finding that we didn't find before or didn't publicly find before. I think what's more so happening is these models are able to chain 17 benign-ish or benign on their own things together and then really find something. If you watch the OpenAI talk at RSA about hugging face, it's basically that persistence, putting together things that on their own, people would have been like, that's low severity.

• 35:53Speaker 01

  I'll fix it in 90 days. But that update, which I think is tough and we have to fight with machines because it takes what was, oh, that's important, but low severity and again, 90 days. I'm like, I'm going to fix this other stuff first. It just turns the prioritization on its head. And saying it makes everything critical isn't helpful because you're like, well, what do you do then? But I think what that ends up looking like is you've just got to fix stuff as fast as you find it. And some of the prioritization does need to go out the window. But if you're fixing things at machine speed, you don't have to prioritize. So that's where I think we're going to get to, but I think it'll be rocky as we get there.

• 36:31Patrick O'Shaughnessy?

  So as I visualize that, what that feels like to me is a constant penetration test?

• 36:36Speaker 01

  Yes.

• 36:37Patrick O'Shaughnessy?

  Where an agent is trying to break in like a white hack hacker agent all the time. And then every time they find something, it's like got a buddy agent that's a patch.

• 36:44Speaker 01

  Goes fix it. Yeah.

• 36:45Patrick O'Shaughnessy?

  Is that like the ultimate product vision then?

• 36:48Speaker 01

  For some parts of Vanta, yes. I think we can do that in very compelling ways for the bulk of our customers. I think CrowdStrike will do it better for an enterprise. This is where choosing where you play and what market segment is most important there.

• 37:03Patrick O'Shaughnessy?

  Is there a firm that's doing something now that you start to encroach on? Like of the traditional security.

• 37:08Speaker 01

  Different markets. I mean, take a ongoing penetration tester and remediator fixer. We think we can do that for the cloud providers, like an AWS, any other like misconfigurations there. Classically, Wiz does that. Wiz will do it for its customers. Wiz's customer base starts at a multi-thousand person company and their price point counts starts on a multi-thousand person company. We're more thinking about the platform as where are we already embedded with customers? Where are they unlikely to go pay $150,000 for Wiz, but very well could pay 40 or 50 for something suited to them? Thinking through where are we already strong and where are the competitors focused elsewhere, but probably on a more up market segment.

• 37:51Patrick O'Shaughnessy?

  How has your personal motivation changed? You set out to build this thing. I remember talking to you the first time about this very charming way you built the original product, building an Excel first and this sort of seems very old school. Looking back on it, there's always like the dog that caught the car thing. We're like, all right, you built like this huge software business. Amazing. How has your own motivation evolved or changed through all this? Why keep going?

• 38:13Speaker 01

  It's interesting and challenging and it changes all the time. I really like my job. Sometimes I feel like I'm good at it. Often I feel like I'm bad at it. That's fine. That's in some ways not the point, but it changes and it's different. And when I feel like I've gotten good at it, usually something happens. It just changes and then I feel bad at it again. And I really like that dynamic. In the beginning, I had a lot more of a feeling of people think I can't do this. I think I can and I'm going to show them. And I still have that. We even did the like, you don't think Vanta is going to be 250 billion? Like, let me show you. I still have it, but I think probably there's like less of a dark edge to it. It's still a little dark edge, but like there's less of it. It's, oh, cool. We got here.

• 38:56Speaker 01

  Now we're just going to see how far we can run in a way that feels a little bit more like fun and joyful. It's my day to day, it's not always joyful. I don't mean that, but it feels more, oh, cool. Let's see how far we can go with this. And I think we can go pretty damn far. Whereas I think in the beginning, I was more like, you don't think I can get off the starting line? Let me show you.

• 39:17Patrick O'Shaughnessy?

  Your finance team isn't losing money on big mistakes. It's leaking through a thousand tiny decisions. Nobody's watching. Ramp puts guardrails on spending before it happens. Real time limits, automatic rules, zero firefighting. Try it at ramp.com/invest. As your business grows, Vanta scales with you, automating compliance and giving you a single source of truth for security and risk. Learn more at vanta.com/invest. Ridge line offers one unified platform that automates away the complexity across portfolio accounting, reconciliation, reporting, trading, compliance, and more, all at scale. Schedule a demo at ridgeline.ai. Every investment firm is unique and generic AI chatbots don't understand your process.

• 40:01Patrick O'Shaughnessy?

  Rogo is built by finance professionals. It's connected to your data, learns your process and quickly produces client ready outputs. Check them out at rogo.com/invest. The best AI and software companies from OpenAI to Cursor to Perplexity, use WorkOS to become enterprise ready overnight, not in months. Visit workos.com to skip the unglamorous infrastructure work and focus on your product. How surprised would the eight year old version of you be at some specific skill that you've developed in the way you just described?

• 40:32Speaker 01

  Probably surprised.

• 40:32Patrick O'Shaughnessy?

  It's like the most surprising one that you're now good at that you old you would have said, no way.

• 40:39Speaker 01

  I like go to market more than I ever would have guessed. You get to talk to like personable, friendly people all the time. And I was like a terrible public speaker. I would get the most nervous in front of my own team because I cared the most about what they thought about. And I was like, oh, my God, I'm representing you. I want to do this so well. Exposure therapy was helpful on that one. You're just, you're like, you just do it and you do get better at it. But I think the like thought of being at kickoff or an all company get together in front of a thousand people on a stage. And I think I would have been like, shit, like I'm going to be bad at that. And I think the people around me would have been like, yeah, yeah, she'll be bad at that. How much coaching can she get? If like anything else, it's like, yeah, if you work hard at developing a skill, you tend to get better at it. You just put in the work.

• 41:24Patrick O'Shaughnessy?

  In that one, in particular, I'm very interested in that one. It just seems always high leverage. What matters? You've given however many hundreds of these things. What makes one good?

• 41:33Speaker 01

  The trope of like, no one remembers what you say, but they remember how you felt. It's so annoying, but it is so true. I do have to believe in the content. And if I just get up, I feel like it is contentless. I will also feel that way and it will be obvious to everyone. You kind of have to figure out your version of it, which for me, I try to put real content in and then also hold in my head, no one's going to remember any of these facts.

• 41:54Patrick O'Shaughnessy?

  So hard matters more than mine.

• 41:55Speaker 01

  So much more.

• 41:56Patrick O'Shaughnessy?

  Yeah. And the key to good heart is what?

• 41:59Speaker 01

  Believing in it yourself, authenticity, one on one, on a stage. People are pretty good at reading one another. When you feel like the person you're talking to is like going through the motions or doesn't really feel like it, or is misleading you, maybe they're also misleading themselves. People can tell. They can't entirely articulate what's happening. Something seems off versus someone who is authentically into it, even if they're into something kooky. That just comes off.

• 42:28Patrick O'Shaughnessy?

  What are the big trade offs that you struggle with right now? You can't do everything. You've got to make decisions. The stakes are higher than ever. It's easier to build than ever. It seems like a cool time to be doing what you're doing, but there must be big trade offs that you struggle with. What are those?

• 42:42Speaker 01

  Yeah. I mean, one conversation have had and have is we have tried over the last year to build in such an agent forward way.

• 42:51Patrick O'Shaughnessy?

  What does agent mean?

• 42:53Speaker 01

  I don't know. You get 3X revenue multiple if you say agent. It's like 3X if you say harness. I have to say harness more. Prompt file, like minus 3X.

• 43:06Speaker 01

  We've tried to build such a great harness.

• 43:12Speaker 01

  Such a great harness for our customers, but actually. And not build a bunch of SaaS UI. Oh, you want reporting? We will have our agent go make charts for you on demand based on all our data. We're not going to put Tableau inside of Vanta, which is probably what we would have done in 2022, 2021, if we had been building it then. And we believe in this in like a short term customer outcomes sense, but also in a medium to long term, like this is what software will look like. And no one is going to be putting Tableau inside their products.

• 43:41Patrick O'Shaughnessy?

  So there's an aspect of this diffusion thing is just scary because maybe the tractor company takes 10 years. And in the meantime, you were right, but early and therefore wrong.

• 43:51Speaker 01

  And if we're wrong, you're kind of betting on the time horizon there. The other version of this big enterprises, we're working with the US enterprise trying to close. And they basically were like, hey, maybe we want your AI features. Maybe we want, but can you turn them off for now? I'm like, ugh, why? The answer is because it's a way easier to get a non AI tool through procurement and we want your tools.

• 44:11Patrick O'Shaughnessy?

  Turn it on after we're in.

• 44:13Speaker 01

  Right? And like, we don't really have an off switch on, you know? You're like, oh, did we go build that? But you're like, gross. We don't want to build that. Hopefully we don't have to use it. We'd so much rather take that time and effort and build something actually useful. Anyway, we're not going to build this off switch, but it's just one of those trade offs.

• 44:30Patrick O'Shaughnessy?

  If you were an investor, which you used to be, where would you be focused right now?

• 44:35Speaker 01

  Ugh, do not envy the job at all right now.

• 44:39Patrick O'Shaughnessy?

  Why? Why don't you envy it?

• 44:41Speaker 01

  As much as I can critique and make fun of on the company side, the like, oh, I think people are miss thinking about some of these businesses in a like very short term way. I think the FOMO and what are your returns? I saw this tweet, if you haven't invested in a lab or an inference provider in the last four years, you should just shut down your firm because like, what are you doing? It feels like more acute on the investor side than the company side. However, hard I think my life is, my life is not hard to be clear. Whatever these trade offs are that we're facing, it feels like more echo chambery,

• 45:22Speaker 01

  more judged on incremental returns and paper returns on the VC side than the company side.

• 45:27Patrick O'Shaughnessy?

  So what would you do? Where would you hunt?

• 45:29Speaker 01

  The labs and the inference providers apparently know those feel a little, well, we can debate. They were played out, but like high entry places. It feels like the discourse and kind of the certainty around the open source model providers. And then like the tooling and the companies around them feels sort of disconnected. It's, oh, we've all decided the open source model will be very real. And then the ecosystem around them is so much less built out than the big labs. And that just feels off to me. You probably have a better.

• 45:55Patrick O'Shaughnessy?

  What do you mean by ecosystem around them?

• 45:57Speaker 01

  If you think that a lab or is it long light? Is that what it's called? Like these, we're basically just going to go deploy this technology and put AI in these businesses. Can you build one of those around the open source providers? Of course, yes. But can you really grab one of those models, the way OpenAI is grabbing its own stuff? And just replicate that playbook? Basically a bunch of the lab playbooks seems like they should apply to the open source models.

• 46:23Patrick O'Shaughnessy?

  And it's just like mature. And so there's more to do there.

• 46:25Speaker 01

  Exactly.

• 46:26Patrick O'Shaughnessy?

  Yeah.

• 46:26Speaker 01

  What am I missing on that?

• 46:28Patrick O'Shaughnessy?

  I think it's just like a pace thing. Anything where these things can go, it's kind of like ironically private equity or something. What private equity promised to do, which was to shape businesses up. Now they can much more easily. And so probably everything will get way more efficient if it can. And the return will come from higher margin, more efficient operations, whatever. That's like an efficiency thing, not a generative thing. I guess what I'm more curious about as you watch your peers and people around you is where are the green shoots on the generative side?

• 46:59Speaker 01

  A bunch of people starting security cyber companies, both because of the environment. And like I see proportionally more of those than other things. A bunch of people attacking rev tech, like go to market technology, which I think makes a ton of sense. Some of the old SaaS rev tech providers, they should be building all this stuff, but it doesn't seem like they are. And actually they're running more PE bent spoon sort of playbooks, which is again, a choice. Like a maybe a reasonable choice. Robotics is probably underplayed, somewhat hot and hypey. That's not a novel area, but it's still definitely underweighted compared to all the software stuff. The models are also getting real damn good there to state the obvious. So probably spend time there.

• 47:41Patrick O'Shaughnessy?

  What else do you feel like you know, because of your unique path, that others don't yet fully appreciate?

• 47:48Speaker 01

  Over the past couple of years, Vanta has spent more time with governments, federal, state, local levels, inside the US, outside the US. There is an appetite for modernization, big stated priority of the current US administration, but again, exists outside of the US too. The AI pieces created more FOMO in government officials where they may have always known they did not have modern processes or modern software, but it feels more of an imperative now than it used to. There's something there. Here's a broader answer. All of the conversation around AI and the technology has changed the priority and upped the priority of a lot of modernization.

• 48:33Speaker 01

  Sometimes it's within governments, sometimes it's within enterprises. You see this with actually a lot of the cyber stuff and the CISOs we talk to. Their jobs are changing because of AI and they're saying, oh, given AI and like the risks from the agents, I would like to overhaul my enterprise risk program and I would like budget for that. And I think if they'd said, I want budget for my enterprise risk program three years ago, people would be like, eh, we'll talk about NLP, maybe. And I think because of the attach to AI, they are much more likely to get that budget today. So there is more of a buying motion.

• 49:07Patrick O'Shaughnessy?

  What would be your big pitch to come work at Vanta right now?

• 49:10Speaker 01

  Oh, it's a fun stage. You get 16,000 customers using a product, using agents, and you ship things that are in use by real people, getting real feedback instantly. It has product market fit. You're just like going and experimenting with like fast iteration loops.

• 49:30Patrick O'Shaughnessy?

  But early enough that you could still.

• 49:32Speaker 01

  You can move. Yeah, yeah. We'll let you move. Yes.

• 49:36Patrick O'Shaughnessy?

  Because it's such an amazing Silicon Valley microcosm. Can you tell like the most detailed version of the billboard war story that you've ever told?

• 49:44Speaker 01

  I was always very much a billboard skeptic because it seemed like, who knows if they work? The tracking is terrible. Founder ego is why someone would do a billboard. It's like, because I feel cool because my company has a billboard. So I was always very anti billboard. Mid summer 2021 Saster conference, which felt like a big deal at the time, like, thank God we've almost been on that. Our marketing team decided to try it out of home. I was like super skeptical, but it was like, fine, whatever. Try it. And we were going to put something on the billboard. And Sarah, who was our PM at the time, came up with compliance that doesn't suck too much, pitched it to our head of marketing, who didn't like it because thought we were like negging our users and was basically like, no, don't think harder, much nicer, but like

• 50:29Speaker 01

  think harder. And Sarah kind of believed in it. And so she went to me, which she usually does not. She is not a like go around her boss person, but like who really believed in compliance that doesn't suck too much. And so took it to me and I read it and I like immediately left, actually immediately texted Andrew Reid, our investor as like, what do you think? You have good internet meme taste. She loved it. And so you're like, okay, let's try it. Let's run it. Yeah. So like, what's the worst that's going to happen? People will think we're obnoxious and then probably forget in six months. So we stand the billboard up somewhere like near Birmingham. It goes over so well. We tweeted, the tweet goes viral.

• 51:14Speaker 01

  The tweet then is still in the next couple of months, but like ends up on our slash and counting, ends up on all the, right? You're like, oh, this is a gem. And I think it really worked because like it's our brand at our best, our marketing at the best, which our attribute is with a wink. We take our work seriously, but we don't always take ourselves seriously. And so I think there was something to that that resonated. It was a little obscure, but it was sufficiently obscure where if you got it, you felt like you got a secret. Anyway, and so like compliance, it doesn't suck too much. 22, market crashes. Turns out there's a lot of billboard inventory available on 101. So we get this great spot where like 101 and 280 intersect and it's on the great spot for like not that much, especially in brought to our spect.

• 51:58Speaker 01

  And we joke and we're like, oh yeah, we've locked it up for years. We were known for this billboard in this spot. I think even on podcasts, I said the contract was locked up for years. It was not locked up for years, but that billboard got famous. And so people would contact us and Sarah all the time and be like, how do you do billboard? How do you do your billboard? And we're like, oh, we work with this agency. We work with this guy. And so we referred this guy, all of this business, who would just be like, it's him, it's him, it's him. Millions of dollars of business. Great. Turns out in the background, we did not have a multi-year contract, which I should have known. Certainly if I was going to say that on a podcast, not really do it as soon as I'm in. And the contract was basically, you've put the billboard up. That's it. This was like not a contract at all.

• 52:40Speaker 01

  Multiple years go by, Sarah's seeing one of her friends for dinner who works at a startup. And her friend was like, oh, it's so sad. You guys gave up that billboard spot. Why'd you do that? And Sarah was like, pardon? And they were like, oh yeah, we just signed for your spot. And Sarah was like, what? We go back or like contract, contract, contract written in grand. There is no contract, basically. It's a placement order. Called the guy and he's like, yeah, you know, it's a placement order. They paid more. So we like swapped it out underneath us. I go to founder of said company and be like, hello, how much can I pay you? And I am like an extremely inelastic buyer here. Like what can I pay you for this spot? And he's like, nothing. And I'm like, how about I double? I think he was paying like a million and a half.

• 53:25Speaker 01

  And you're like, how about I give you three? Just get the spot. And he's like, we're actually cash flow positive. So like literally I'm an elastic seller. And so we lost a spot.

• 53:34Patrick O'Shaughnessy?

  Good punchline.

• 53:35Speaker 01

  Things that made me think where I was like, oh no, Vanta's screwed. Honestly, losing that billboard, I was like, we did probably just lose a billion of market cap. Yeah, yeah, yeah. You're both bad omen. There is some vibes in market cap decrease that just happened here. Yes.

• 53:51Patrick O'Shaughnessy?

  Is there anything I've missed that has your curiosity, your attention that you think is really important right now?

• 53:58Speaker 01

  You see it in the data center conversations, to some extent in the personal agent stuff. It's like, we just don't trust software companies, tech companies, the way we used to, and that is getting worse year over year. And it's kind of hard to imagine that inflecting back up and getting to the useful optimism of 15 years ago in that companies showing that they are trustworthy and industrial grade and secure through lots of metrics and actual definitions is more important than ever and will just get more and more important. And again, to a host of customers, regulators, lawmakers, auditors, et cetera.

• 54:38Speaker 01

  Vanta at 250 billion is in the center of all of those transactions, helping companies meet those high bars or wherever those bars are set and then conveying that, helping them go convey that and accelerate their businesses.

• 54:52Patrick O'Shaughnessy?

  Is another way of saying that like AI has ushered in this extremely high excitement, but low trust.

• 54:58Speaker 01

  Yeah, that's good.

• 54:59Patrick O'Shaughnessy?

  Era.

• 55:00Speaker 01

  Yes.

• 55:01Patrick O'Shaughnessy?

  And Vanta's job is.

• 55:02Speaker 01

  We build some of that trust. And yeah, increase the trust legitimately. So not just on vibes.

• 55:07Patrick O'Shaughnessy?

  What will satisfy the market to trust again?

• 55:11Speaker 01

  In a B to B context, businesses, I do think there's the vibes piece, but there's a very real data piece. And I would like to see specific things or specific improvement curves or make promises with maybe contracts behind them. That one's quote unquote logical rational, the way like enterprise markets often are. I'm on the consumer side. It is vibes. That one seems very hard to turn. I do not.

• 55:37Patrick O'Shaughnessy?

  Do you trust them? Use instinct, et cetera?

• 55:39Speaker 01

  Big companies? No.

• 55:42Patrick O'Shaughnessy?

  Why not?

• 55:43Speaker 01

  It's not that there's anything particularly interesting in my email or chaps or whatever. Well, it's not that interesting, but I would rather just Google or just Apple or just insert company here have that information.

• 55:55Patrick O'Shaughnessy?

  What's security like five years from now? Like if you just wrap it up with like, okay, here's where we're going and we want to be the person at the center of the.

• 56:02Speaker 01

  Yeah.

• 56:03Patrick O'Shaughnessy?

  Describe that state for us.

• 56:04Speaker 01

  Security from five years from now is faster, even more intense, more offensive, hopefully in that yes, we'll have more attacks, but I think you need more white hat pushing back on all of that. And just to get a speed that we haven't had, and I think you've got to get humans to get to that speed. You've got to get some amount of the human decision making out, or humans are like architecting systems and writing rules, but not making every single decision. It's like falling from that. Writing evals, maybe that's all we're doing in the future. We're all writing evals all day long.

• 56:36Patrick O'Shaughnessy?

  If you had to define what the next five years of Vanta will be in one word, what word do you pick?

• 56:43Speaker 01

  Expansive. I think we have this incredible base of customers of data and now we get to go build things on top of that. Eight years to get here, we could go just build stuff on top of it for the next five or eight.

• 56:57Patrick O'Shaughnessy?

  It's so cool that we did this five years ago. Here we are again. Thanks so much for your advice. If you enjoyed this episode, visit colossus.com. You'll find every episode of this podcast complete with hand edited transcripts. You can also subscribe to Colossus, our quarterly print, digital and private audio publication featuring in-depth profiles of the founders, investors and companies that we admire most. Learn more at colossus.com/subscribe.

• 57:20Speaker 02

  Patrick O'Shaughnessy is the CEO of Positive Sum. All opinions expressed by Patrick and podcast guests are solely their own opinions and do not reflect the opinion of Positive Sum. This podcast is for informational purposes only and should not be relied upon as a basis for investment decisions. Clients of Positive Sum may maintain positions in the securities discussed in this podcast. To learn more, visit psum.vc.

• 58:06Patrick O'Shaughnessy?

  You know how small advantages compound over time? That's true in investing and just as true in how you run your company. Your spending system is your capital allocation strategy. Ramp makes it smarter by default, better data, better decisions, better economics over time. See how at ramp.com/invest. As your business grows, Vanta scales with you, automating compliance and giving you a single source of truth for security and risk. Learn more at vanta.com/invest. The best AI and software companies from OpenAI to Cursor to Perplexity, use WorkOS to become enterprise ready overnight, not in months. Visit workos.com to skip the unglamorous infrastructure work and focus on your product. RidgeLine is redefining asset management technology as a true partner, not just a software vendor. They've helped firms 5X and scale, enabling faster growth, smarter operations and a competitive

• 58:51Patrick O'Shaughnessy?

  edge. Visit ridgelineapps.com to see what they can unlock for your firm. Every investment firm is unique and generic AI doesn't understand your process. Rogo does. It's an AI platform built specifically for Wall Street, connected to your data, understanding your process and producing real outputs. Check them out at rogo.ai/invest.