Vanta Targets Global Controls Expansion as Revenue Surpasses 60% Growth

营收增速超60%，Vanta目标推进全球合规控制扩张 传统的潜在市场规模计算存在根本性缺陷，因为降低合规成本会大幅扩大实际客群，覆盖从早期初创公司到财富50强企业。 Christina Cacioppo分享了Vanta的发展历程：从最初因Dropbox Paper时期痛苦的工程瓶颈而诞生的合规解决方案，逐步成长为拥有超过15,000家客户的规模化信任管理平台。本次梳理概述了合规如何成为初创公司的关键采购触发点、下沉市场与大型企业合规模式之间显著的运营差异，以及如何通过整合AI实现安全问卷和证据收集的自动化。展望未来，Cacioppo详细介绍了Vanta利用其庞大的历史审计数据集，向Agent（智能体）用户界面、内部审计及财务合规框架等领域的产品拓展。 Christina Cacioppo于2018年创立Vanta以解决合规问题；对初创公司而言，合规是解决燃眉之急的“止痛药”，而非主动预防的“维生素”。 (0:17) 初创公司极少主动在安全上投入；真正的购买契机发生在大型企业客户提出SOC 2等合规标准要求时。 (0:17) Vanta近年来年增长率超过60%，服务客群已从小微初创企业扩展至财富50强企业。 (3:56) 合规体现为两种模式：针对下沉市场初创企业的向导式“TurboTax”体验，以及针对高端大型企业的实时“Datadog”控制面板。 (6:00) Vanta的“测试”（Test）功能类似于软件单元测试，通过从GitHub或GitLab提取代码元数据来持续验证合规控制项。 (7:30)

Christina Cacioppo argues that compliance functions as an urgent commercial painkiller rather than an optional security vitamin, enabling Vanta to unlock a market that conventional sizing models severely underestimated. By translating ambiguous regulatory mandates into automated engineering controls, the company aims to compress compliance overhead much like modern cloud infrastructure streamlined corporate IT. The Compliance Painkiller and Market Expansion (0:01) Vanta was founded in 2018 after Cacioppo observed at Dropbox Paper in 2015 that certifying a product against enterprise security commitments required 10 engineers working for a year and a half. Cacioppo notes that early-stage founders rarely invest in security as an elective safeguard; instead, compliance serves as an immediate commercial painkiller triggered when prospective enterprise clients demand SOC 2 reports or completed security questionnaires before signing contracts. This dynamic exposes the flaw in static Total Addressable Market (TAM) calculations. In 2018, the estimated global market for SOC 2 compliance was only $10 million, with almost no startups participating. Cacioppo contends that traditional TAM assessments fail when software drastically lowers the cost and time required to adopt a service, unlocking latent demand. Vanta has since scaled to over 15,000 customers spanning seed-stage startups to Fortune 50 firms, sustaining an annual revenue growth rate above 60%. Adapting Controls Across Startup and Enterprise Tiers (6:00) Compliance software diverges significantly based on organizational maturity. For early-stage ventures, Vanta provides a guided experience comparable to TurboTax, establishing baseline rules and verifying adherence through automated, unit-test-style checks on GitHub and GitLab pull requests. For upmarket enterprise buyers, the product functions more like Datadog, ingesting established controls from static spreadsheets and Jira tickets to deliver continuous visibility, deviation tracking, and automated remediation. Navigating overlapping international and public-sector frameworks presents continuous divergence rather than consolidation. While SOC 2 and Europe’s ISO 27001 share roughly 60% to 65% overlap—primarily diverging in documentation requirements—Cacioppo rejects creating proprietary standards, citing the industry tendency for unified frameworks to merely add to existing fragmentation. Furthermore, she notes a cultural divide: while American companies often treat compliance as a minimal box-checking exercise, European firms typically adhere to an internal bar of standards regardless of external enforcement. Defensibility via Proprietary Data and Questionnaire Automation (24:43) While large language models can readily map codified standards or ingest unstructured evidence like AWS configurations and policy documents, Cacioppo argues that generic AI models cannot guarantee audit success. Vanta anchors its primary defensibility in anonymized historical data from more than 20,000 to 30,000 completed audits. This dataset powers automated evidence evaluation, predicting whether specific submissions—such as screenshots lacking timestamps—will pass inspection with particular auditing firms before formal submission. AI automation has also accelerated third-party risk assessments, enabling organizations like GitHub to automate 92% of incoming security questionnaires through Vanta. However, Cacioppo cautions that this efficiency may trigger Jevons paradox: drastically reducing the cost of answering questionnaires may incentivize enterprise buyers to issue longer, more customized, and more frequent security inquiries, potentially neutralizing productivity gains. The Structural Contraction of Compliance and New Verticals (34:43) Cacioppo draws a parallel between modern compliance and the historical trajectory of corporate IT, where cloud infrastructure and standardized SaaS eliminated the need for dedicated IT staff at small companies. Automated monitoring tools now allow startups to delay hiring dedicated Governance, Risk, and Compliance (GRC) personnel well past the historical 50-to-100-employee mark, consolidating oversight under technical leads. Dedicated compliance practitioners are expected to shift from manual evidence collection to overarching risk strategy. Looking forward, Vanta plans to extend its underlying controls platform beyond technical security into internal and financial audits. Because code generation has become significantly cheaper, Cacioppo anticipates building integrations with enterprise resource planning (ERP) platforms and payment processors to capture, structure, and continuously validate financial data alongside security controls. Whether emerging frameworks such as ISO 42001 will transition from opt-in guidelines into binding global standards remains an open question, as does whether workflow automation can outpace the proliferation of fragmented compliance regimes and AI-generated vendor questionnaires.

Vanta 创始人 Christina Cacioppo 提出，初创企业的合规需求并非源于主动的安全意识，而是由企业级客户采购驱动的刚性“止痛药”；传统静态的潜在市场规模（TAM）分析忽视了通过降低门槛创造全新市场的潜力。随着公司从初创企业的合规向导演进为大型企业的持续控制监测平台，Vanta 正利用专有审计数据和 AI 重构合规流程，推动传统 GRC 职能向高度自动化与工程化方向整合。 需求原点与TAM：将合规转化为刚需 (0:01) Cacioppo 指出，安全防护常被创业公司视为可有可无的“维生素”，而合规认证（如 SOC 2）则是大企业客户强制要求的“止痛药”，构成初创企业的核心采购触发点。这一认知源于她在 Dropbox 开发 Dropbox Paper 的经历：由于既有企业合同承诺了安全与渗透测试，团队不得不耗费 10 名工程师历时一年半补齐合规流程才能正式发布。2018 年创立 Vanta 时，全球在 SOC 2 上的支出估计仅约 1000 万美元，按照传统 TAM 测算几乎不值得立项。 然而，Cacioppo 借鉴在 Union Square Ventures（USV）的投资经历指出，静态的 TAM 计算具有极大的误导性，并未考虑通过降本增效解锁新市场的可能。Vanta 借助自动化大幅降低了企业获得合规认证的时间和经济成本，进而撬动了未被满足的庞大需求，实现连续数年超过 60% 的年化增长，目前服务超过 1.5 万家客户，客户梯队从双人初创团队一路延伸至财富 50 强企业。 双层产品模式与控制机制的工程化 (6:00) 针对不同发展阶段的企业，合规工具承担着不同角色。面向早期初创公司，Vanta 的体验类似面向报税的“TurboTax”，提供高确定性的向导流程，协助创始人完成安全规则配置并确保持续处于可受审状态；面向大型成熟企业，它则更接近“合规控制领域的 Datadog”，用于替代散落在电子表格或 Jira 工单中的静态记录，提供实时仪表盘监控、异常偏差追踪与自动修复能力。 由于 SOC 2 等标准仅提供高层指导（例如要求“有效日志记录”）而非具体控制列表，早期团队常陷入规则迷雾。Vanta 将这些模糊要求转化为直观的工程化默认配置，并推出了类似于软件单元测试的“Test”功能，直接对接 GitHub 或 GitLab 等代码托管平台，通过抓取并核验每个 Pull Request 的操作者与审查者标识，自动验证代码审查与职责分离控制是否得到实质执行。 AI赋能与专有审计数据壁垒 (24:43) 尽管借助大语言模型进行随意编码（vibe coding）逐渐流行，但合规流程容错率极低，企业自主搭建合规架构并不能为核心业务带来额外增益。AI 在合规中最直接的价值体现在非结构化数据的摄取与自动映射：用户可批量导入 AWS 截图、API 接口调用、安全政策文档与 Jira 工单流，系统能将其结构化并关联至特定合规框架中。 更为深层的竞争壁垒在于 Vanta 积累的 2 万至 3 万次历史审计专有数据。类比于 Stripe Radar 基于海量交易数据识别欺诈，Vanta 依托脱敏审计数据建立“AI 证据评估”功能，能够根据具体审计机构的历史偏好，提前研判某项证据（如缺失时间戳的截图）能否通过审查。在下游应用方面，GitHub 已借助 Vanta 自动化处理了 92% 的入站安全调查问卷；尽管问卷解答门槛降低可能引发杰文斯悖论（导致买方发送更繁杂的问卷），但配合动态生成的定制化界面（On-Demand UI），重复性的文本比对工作正被自动化代理系统性承接。 制度分歧与GRC职能的结构性收缩 (17:14) 欧美两地在合规文化与政策推进上存在分化。Cacioppo 观察到，美国企业通常将合规视作应付外部要求的“勾选式流程”，而欧洲企业往往具备更高的内部自我约束标准；面对框架重叠，以 ISO 42001 为代表的新兴 AI 标准不断涌现。针对各界对统一标准的呼声，Cacioppo 明确表示 Vanta 不会自立新标准，否则只会陷入 XKCD 漫画中“试图统一 15 个标准却导致第 16 个标准诞生”的碎片化困局。此外，随着 AI 智能代理深度参与编码，审查仅核验账号标识的传统“双人审查”控制手段已逐渐形式化。 这种技术变迁正在重塑企业治理、风险与合规（GRC）团队的组织形态，其轨迹与企业 IT 部门的历史演变高度相似：从 2000 年代小企业必须配备全职人员维护机房与硬件，演变为如今依托云服务与 Google Workspace 完全抽象化基础支持。在自动化数据抓取与预警机制成熟后，合规领域的基础劳务将被剥离，企业可通过具备系统性思维的工程师（“Amelia Engineers”）统筹兼管安全与合规，推动 GRC 人员从应对日常问卷的小时工角色，转向高维度的风险组合战略管理。 边界拓展：进军内部与财务审计 (55:45) 基于在规则定义与执行校验上的底层能力，Vanta 正在将业务范畴延展至外部安全合规之外。Cacioppo 指出，Vanta 的本质是一套企业控制平台（Controls Platform），核心是解决“企业应该做什么”以及“如何证明已执行”。 因此，将面向外部第三方的证据打包能力直接复用到企业内部治理，使拓展内部审计（Internal Audit）成为自然的演进路径；同时，平台正计划接入 ERP 及支付结算等关键系统以解析财务数据，逐步向企业风险管理及财务审计（Financial Audit）场景渗透，致力于为中端及中小企业构建统一的控制基础设施。 Vanta 的发展展示了通过软件自动化降低合规门槛、进而激活庞大潜在市场的路径。然而，面对联邦 FedRAMP 现代化受阻、新兴 AI 监管标准缺乏统一定义，以及智能代理编程使传统代码审查流于形式等挑战，合规平台如何在标准碎片化加剧与实质性安全防御之间维持长期平衡，仍是行业面临的未决议题。

[1:00] Christina Cacioppo: Compliance is like the buying moment for startups. [7:30] Are we negging our users? [24:43] Christina Cacioppo: Spending much time on [compliance] does not make your beer taste better. Is this really the place? Even if you really want to vibe code a bunch of stuff, is this really what you want to vibe about? [47:22] market sizing is bullshit. [54:19] if you're asking whether you have it, you don't. [55:45] Christina Cacioppo: taking over the world, making desks along the way.

[0:01] Christina Cacioppo founded Vanta [0:03] in 2018 to solve a problem most founders didn’t even know they had. [0:06] Compliance. [0:07] Under her leadership, the company has defined [0:09] the trust management category, growing to over 15,000 customers. [0:13] Cheers. Cheers. [0:14] Good to see you. Good to see you. [0:18] Tell the Vanta story. [0:19] We help companies start or build out their security programs [0:23] and then get credit for all that work through an audit, through [0:26] a security questionnaire. [0:27] A trust center but it's basically do all the work to improve your security, [0:33] and then go get credit for that with your customers. [0:35] All the Vanta billboards I see use the word compliance rather than security. [0:39] What's going on there? [0:40] It is one of those where you're, well, "vitamin" and "painkiller." [0:45] I think compliance is… [0:46] SOC 2 is a word that no one knows what the heck it means until they deeply know, [0:50] and then they want it. [0:51] But they know that they have to do it this quarter. [0:52] Exactly. [0:54] One of the original founding hypotheses of the company is if you want to start [1:00] a security company for startups, you should actually start a compliance [1:03] company because your customers never ask you for security, but they [1:06] do ask you for compliance. [1:07] Compliance is like the buying moment for startups. [1:09] Exactly, and then when you're going through that, you have [1:12] to implement a bunch of… [1:13] Do a bunch of best practices, maybe buy some tooling. [1:16] But even if you want to, you don't do it before that moment because [1:20] you're doing the thing the customer wants. [1:22] I guess at a later stage, the buyer would be split, [1:25] where security would be the CISO versus compliance would be the CFO, [1:29] GC, something like that. [1:30] I actually think Stripe is a little, in what I see, which is [1:33] biased, but different. [1:35] In that usually, compliance is there's this unified GRC, [1:38] Governance Risk and Compliance function, and that lives in the CISO org. [1:42] That will centralize internal audit. [1:44] It'll centralize enterprise risk. [1:47] You put those teams together. [1:49] Third-party risk. [1:50] Those teams are all together in CISO org. You're mostly selling to CISOs? [1:54] Yes. [1:55] How did you... [1:57] You woke up one morning, and you decided you were passionate [1:59] about starting a compliance company. [2:00] When I was three years old, it was my first word. [2:02] Yes, we joked in the early days. [2:03] We'd never be able to pull that story off. [2:05] I don't know. I heard training businesses are good. [2:09] I've heard more absurd founding myths. [2:12] I think you could just go for it. [2:15] The real story is twofold. [2:16] One, prior to Vanta, I worked at Dropbox. [2:18] I worked on what at the time was a new product, Dropbox Paper. [2:22] We were trying to take it to market and didn't take it to market as well as [2:26] we could have for several reasons. [2:28] One of which was... [2:30] It turned out at the time, all the Dropbox contracts had written [2:32] into them, "We're secure, we're compliant, we're pen-tested, we're XYZ." Our [2:37] new thing had none of those. [2:40] In order to talk to someone with a Dropbox account, which was [2:45] 100 million people or whatever it was, we had to go through this process. [2:49] This was Dropbox 2015, so the height of its Silicon Valley power, [2:54] year and a half, 10 engineers, feature building, all that. [2:59] That all happened. [3:00] I was not smart enough to then be like, "Aha, startup idea." Instead, this... [3:05] Dropbox, what are you doing? This sounds bad. [3:08] It was about a year and a half later, just talking to startups and founders [3:13] about security, trying to figure out, is there a company to be built here? [3:18] How do you get more startups to care about security? [3:20] How do they do it? [3:22] Kind of came across companies that either did nothing for security but felt really [3:29] badly about it sometimes, but still did nothing. [3:31] Then companies that had a lot of stuff in place. [3:33] The lot of stuff in place was because they'd gotten a questionnaire, [3:36] they'd gotten SOC 2, because of an enterprise customer. [3:38] That was the, "Oh, that thing." I remember that being [3:42] crazy, and onerous, and terrible. [3:45] But also if you do it, that is like, Pass Go, Collect $200. [3:51] Huge benefit on the other side. [3:53] It was the combo of those two things. [3:56] What you're describing, I think, is just so commonly the experience in [4:02] founders who start companies. [4:03] I mean, it was our experience with Stripe as well, where we had just [4:05] run into the problem before. [4:06] But it's funny, I often run into people in university [4:10] who are excited about starting a startup. [4:12] That's generally… [4:14] Obviously, there's lots of sexy stories of people who dropped out [4:17] of college to start something. [4:18] That's generally a bad time because you talk to university students, often, their [4:22] ideas for companies are pretty half-baked. Find My Friends. [4:26] Yeah, it's Find My Friends. [4:27] It's like a college textbook exchange app. [4:30] It's like the five apps, whatever. [4:32] Whereas so frequently, what happens is people go out, [4:35] and they build successful products in the world, and they do Dropbox Paper, [4:39] or they get some experience. [4:41] It turns out there are huge markets available with problem spaces that most [4:47] normal people have not heard of with things like SOC 2. [4:50] But you have to spend a while seeing how the value flows in the real world work [4:53] to discover those big opportunities. [4:55] How do you feel when you go to YC now, and you have these founders who've dropped [4:58] out and been like, "My passion is sales enablement." [5:02] But they actually do know surprisingly much about it. [5:06] I mean, if you truly manage to learn enough about sales enablement to be [5:11] able to field a strong product there, then good on you. [5:13] I just think you're more likely to discover those areas [5:16] after five or 10 years. [5:18] What stage is the business at now? [5:20] We have 15,000 customers. [5:22] Our growth rate has actually quickened the last couple of years, [5:25] and quarters, and months. [5:27] It's been 60% annual plus for the last couple of years [5:31] since that milestone, so a ballpark number there. [5:32] That's pretty good. [5:34] Yeah, it's a proper business. Yeah. [5:36] You go to market, it's all sold? All sales. [5:40] Yeah, it's just one of the blessings and curses I've had. [5:43] With what company sizes? [5:45] We call them the 'two founders on the couch.' But it's the two founders [5:49] on the couch who are building their thing and someone ask them for SOC 2, [5:52] and they're working on it on Friday night because when else are you [5:55] going to do the thing? [5:57] All the way up to at least one member of the Fortune 50. [6:00] I would have thought that compliance is very different for founders [6:06] who have never even heard of it, versus companies who have a lot [6:09] of existing teams here with opinions and stuff built out. [6:13] How does that work? Yeah, it is true. [6:14] Down market, we're not quite TurboTax but I think that is [6:19] the experience a founder wants. [6:21] It's like, "This is high stakes, and I don't want to get it wrong, [6:24] and I don't really know, but just guide me through." [6:27] That's more of the product experience. [6:29] Then the output is like, "Here's a set of controls, [6:33] security rules you follow that are monitored on an ongoing basis." Because [6:37] of that, you're constantly audit-ready, you always have everything in place. [6:41] Great. [6:42] That's the experience a founder wants, but the output is still a security [6:47] program that's monitored all the time. [6:49] Upmarket, especially when I'm talking [6:51] to an engineer, it's more Datadog for your compliance controls. [6:54] You're like, "I have my program, I have my thing, but it lives in a spreadsheet. [6:59] It lives in Jira, custom Jira, it lives in something like that. [7:02] I want real-time dashboards and visibility, and deviations, [7:07] and auto-remediation, I want that world." [7:10] There's almost two layers to Vanta. [7:12] There is what your controls should be, and then how the controls are [7:15] monitored and implemented. [7:16] Early-stage companies want both. [7:18] Later-stage companies may want more of the latter. [7:20] Exactly. Then the tie to audit is great. [7:22] In some ways, its like a controlled direct monitor, you just pass [7:25] the logs to an auditor. [7:26] It's more complicated than that, but that's the base model. [7:30] Okay, you're getting to a question I had, which was, [7:34] compliance at some level is not a thing you can just buy, [7:37] it's a thing you have to do. [7:38] If you actually talk about all these rules, I don't know about SOC 2 [7:42] in particular, but for example, a lot of compliance regimes have this [7:45] notion of doer and approver being separate for something. [7:49] It's like the—Code review. [7:51] Yeah. [7:52] The nuclear submarine where you have to have the two keys turned simultaneously [7:56] to launch the PR, I guess, in this analogy. [8:00] Again, Vanta can't do that for you, you have to do this. [8:02] What you do is, one, for a startup, you actually just let them know [8:08] the complete list of things they actually need to do. [8:11] I presume there's some, maybe you can talk about, [8:13] there's some logic of only telling them the stuff that actually applies to them. [8:16] Yeah, exactly. [8:17] Then there's actually, how do you enforce, say, separate doers and approvers [8:21] in something like code review? Yeah, so for something like… [8:24] This was the first thing we built, and we call it Test. [8:26] It's like modeled after unit tests. [8:29] You're like, turn each of these controls into a unit test. [8:32] Pull from version GitHub, GitLab, whatever. [8:35] Look at every pull request and check these fields or this thing, [8:39] or run some logic over it. [8:41] That is our test for the control. [8:44] That was the first thing we built, were these tests. [8:48] But tests are just ways to prove control. [8:49] You're just a test suite. [8:51] You're the battery of unit tests for the compliance rules. [8:54] Exactly. Why don't you just say that? [8:56] Why doesn't your billboard just say that? [8:58] There was a niche audience in San Francisco that would be like, [9:01] "Oh, now I understand." [9:02] Yeah, but I think for the 101 billboards... [9:04] What's the controversy with your 101 billboard? [9:07] Oh, my goodness. How much do we want to do this? [9:10] We had a great 101— [9:12] Great billboard, I used to drive by it every day. [9:14] "Compliance that doesn't SOC 2 much." Arguably, hundreds of millions of dollars [9:18] in market cap attributed to that billboard. [9:21] It was funny. [9:22] That was just in the annuals of Vanta and startups. [9:25] The person who came up with that billboard, very pleased [9:28] with herself, as she should have been. As she should be. [9:31] As she should have been, 100% right. [9:32] Her manager at the time was very skeptical of that billboard. [9:36] Are we negging our users? That's a Cannes-level tagline. [9:38] Is this okay? [9:39] Are we too far over the line? [9:41] Anyway, you can guess which one of those people is still at Vanta today. [9:45] Not just because of that, but it was a good— [9:48] It's a cultural test. Exactly. [9:50] Anyway, so we had this billboard. It was great. [9:51] For many years. For many years. [9:53] I used to joke that we've had it locked up for years. [9:56] Turns out we didn't, and I'm an idiot. [9:58] Oh, you forgot to renew it? Not even. [10:00] You should have had a little Vanta check for that. [10:02] I know. [10:02] It was like your domain, and you're just the thing you're not supposed to do. [10:05] It was slightly better, but still bad. [10:08] The agency we worked with, one, we should have caught this, [10:12] our contract was just written in crayon. [10:16] We got a lot of people asking about our billboard. [10:18] We introduced them to lots of startups. [10:20] Some of those startups were also buying with that agency. [10:23] Wow. [10:24] A startup you introduced to them went and took your billboard— [10:27] They didn't even do it on purpose. [10:28] The agency went to them and was like, "We have this great inventory. [10:31] Would you like it?" Then we found out. [10:35] Okay, that's rough. [10:37] This is the drama of the compliance world. [10:40] People will learn about Vanta in other ways. [10:42] We do like to market. [10:45] Then going back to the other part of the question. [10:47] How does the layer work for… [10:49] The rule book might be a thousand pages long. [10:52] Compiling that rule book into the steps that are actually actionable for me, [10:55] because I am not a farm, and so all the farm parts [10:58] of the rule book don't apply to me. Yeah. [11:00] The initial… The initial version of it actually was… [11:04] This was back when we were founders on a couch, [11:07] was getting as many SOC 2s as we could. [11:11] It was Salesforce, Slack, AWS, whatever, and actually opening them all and just [11:15] comparing them and trying to extract what was common and doing it that way. [11:19] That was the first cut. [11:21] What we do now is, hopefully more advanced, but there's a bit of… [11:26] Now that we have probably 30,000 audits completed, [11:30] we can just go back and be like, "Okay, for a company that looks like you, [11:34] and for this auditor often, what sorts of controls are [11:38] there?" We have that input in. [11:41] Then we can also layer in both for a company in particular and in general. [11:45] You get questionnaires. [11:47] What are the themes and the questions you're being asked? [11:49] We just launched a new commitments product that ingests contracts and scans the [11:54] contracts for things that are contracted. [11:56] Then you can both pull them out and say, "Hey, this should be a control." And God [12:02] forbid, something happens, but you're like, "What are my obligations [12:05] to my customers?" You can just basically have all that structured data. [12:09] But one of the most important things is they just want to see progression over [12:12] time and increase maturity over time. [12:15] You've probably had this at Stripe where you wanted to use some cool new tool that [12:18] had no security posture and a contingent… Sorry, hack that, maybe. [12:23] But one part of it was like, "Can you just walk this up over time [12:27] and show me you're making progress?"Yes. [12:30] Is SOC 2 the main bible? [12:35] Basically, it's funny. [12:37] We don't break it out by framework anymore because they're all just [12:43] inputs into the system. Sure. [12:44] But ultimately, you need to comply with some specific thing. [12:47] Yes, most customers will come to us for that first. [12:51] Number two is ISO 27001, which is, "Europe SOC 2." [12:56] Who demands ISO 27001? European enterprises. [13:00] If you're a European company selling to Europeans, you will start with that. [13:03] If you're a European selling to Americans, you'll start with SOC 2. [13:06] How aligned are they? [13:07] I think our mapping is 60% or 65%. [13:13] The additional ISO stuff is often documentation, which is a great [13:16] place for software to help you out. Sounds like Europe. [13:17] Yeah, exactly. [13:19] There's less, please implement these six more rules. [13:22] Is it SOC 2 and its international equivalence, is basically that captures [13:26] most of what you're doing? It is probably plurality, not majority. [13:31] We see a lot of growth… [13:33] There's this whole host, "a thousand flowers bloom" of AI standards right now. [13:38] It's the whole thing there. [13:39] There are a bit of healthcare-specific things. [13:42] There's the PCI piece, which I know you're very familiar with. [13:44] There's like that. [13:45] On healthcare, is this… [13:47] Which—There's HIPAA, which is US law. [13:50] You can just declare yourself compliant with HIPAA. [13:53] You get to decide. Yeah, self-declared. [13:54] Yeah, exactly. [13:55] The downside of doing that is if you do that and are breached, [13:58] the fines are enormous. [14:00] That's the check, the semi-market check there. [14:03] Can you describe the policy goals that [14:08] something like SOC 2 seems to accomplish? [14:11] You might say, "It's simple, it's just security." But as we know, [14:15] there's many different facets to that. [14:18] It could be preventing information leaks, or it could be preventing fraud against [14:24] the customer, or it could be all these different things. [14:25] If you were to stack rank, what is SOC 2 actually trying [14:29] to accomplish at a policy level? [14:31] I would say it is trying to ensure customer data is protected. [14:37] I think that is what it is trying to do. [14:40] Just to round out the point to your Java/JavaScript comparison is that [14:44] Java was a very popular language before the emergence of web [14:49] browsers with JavaScript. [14:50] When they invented JavaScript, they wanted to ride off the Java halo as [14:55] a need-to-use programming language, despite the fact Java and JavaScript [14:58] share no exactly commonality at all. [15:01] It was just good branding. [15:03] What you're saying is that it's similar with SOC 2 here. [15:05] Okay, so you're saying the primary goal is to ensure that the data that you [15:09] are giving this company— [15:11] Your software provider, whatever. [15:13] ... [15:14] Is adequately protected. [15:17] Many companies have had humongous data breaches. [15:21] Equifax was a great… It's a great easy version. [15:23] Equifax, AT&T, I believe. [15:26] Kind of all of them. Exactly. [15:28] Assume every big company as a SOC 2. [15:30] Yeah, but there's a difference between some data was leaked in some context [15:35] versus in the Equifax case, "Sorry, we lost all of your data." [15:38] Exactly. "We didn't fix the database." [15:40] "Which data did you lose?" "All of it." It's very hard to find that moment [15:45] in the Equifax stock price chart. [15:47] What's going on there? [15:48] As in, we think society cares, society should care. [15:52] It's valuable to not lose this data, and yet it does not seem to impair what [15:57] investors deem to be the terminal value of the company. [16:00] Yes. What are investors betting on? [16:02] They're betting on, will anyone churn off of Equifax because this happens? [16:07] I think the cynical but correct take is no. [16:10] Sometimes, because you're like, "Equifax or Delta, [16:13] am I going to stop?" I'm not going to stop flying Delta, [16:17] especially 10 to 15 years into this where you're like, "Oh, another one. [16:21] I'll add an eighth credit monitoring service." I think there is [16:26] a cynicism there that is probably correct. Yeah. [16:29] The other thing that feels like it's changing in this ecosystem is that [16:35] the costs of having data breaches [16:41] are going up because Europe, [16:45] in particular, is getting very strict about notifications. [16:50] Sometimes, fines around these breaches. [16:53] How is that changing your world? [16:56] We also cover some of the data privacy standards. [17:01] Your GDPR, your CCPA, there's, again, alphabet soup of acronyms here. [17:07] Honestly, we see demand for that that goes in waves. [17:11] It tracks what you expect. It's higher in Europe. [17:14] I mean, Vanta, as a product, in general, does even better in Europe and better than [17:21] you would guess for a California company that doesn't have European roots. [17:25] I do think there's some cultural affinity and just seriousness there, [17:29] versus the easy critique of Americans in compliance is like, "I'm just checking. [17:35] You tell me where the bar is, and I'll meet your bar." [17:37] It's a box-checking exercise. Exactly. [17:39] Where it's just culturally something that is more important. [17:42] "You can tell me where the bar is, I'll meet it, but also I have my own [17:45] internal bar," which is more the European take. [17:47] But we see demand for, say, CCPA, which is [17:49] a California version of GDPR, go in waves. [17:54] Right now, it is definitely… [17:55] I mean, all the American regulation is at a total nadir, but it's down right now. [18:02] Well, it's down at a federal level. [18:04] Is it also down at a state level, the energy around the CCPA type of thing? [18:08] Yes, it is, even with… [18:09] It's not clear what California is going to do, and it could go multiple ways. [18:15] I still think the national politics cast a larger shadow, [18:20] even over a state like California. That's interesting. [18:23] Okay. Yeah. [18:24] On the national side, current administration is very [18:28] into streamlining regulation through automation and AI. [18:31] But that is the catchphrase that they deeply believe in and are driving. [18:36] I would have thought that this stuff is just too boring to be caught up in any [18:39] reform initiative, or will this be streamlined? [18:42] I think there's very hard-working folks [18:45] in DC, across the board, but in GSA [18:50] in the office trying to do this. [18:52] The primary lever they're using is FedRAMP. [18:54] Yeah. [18:57] Which broadly, I would think of as SOC 2 for the federal government. [19:00] But basically, a very onerous set of both controls and requirements [19:06] and documentation, in order to begin trying to think about selling [19:12] to federal, and often state, sometimes even local governments. [19:15] I hadn't realized state and local governments also use FedRAMP as their— [19:19] There's state RAMPs. Yeah. [19:20] There's literally Texas RAMP— [19:21] But they conform to FedRAMP. Exactly. [19:24] There is a part of GSA, and one team in particular led by a guy [19:30] called Pete Wasserman, who is trying to modernize FedRAMP. [19:34] They make a like 2020 version of FedRAMP where the current version [19:39] feels a bit more '90s. [19:42] It is unclear if he will get the traction to succeed, but he's fighting [19:47] the good fight and he gets it. [19:48] But even if they do that, I find it hard to imagine the Society [19:52] of Accountants just copying the new FedRAMP lock, stock, and barrel. [19:57] I don't think they will. [19:59] I think you're just going to have even more divergence between these things. [20:02] It's like less control over— [20:04] I feel like your life is the XKCD of we have 15 standards. [20:08] It is, and the answer is the 16th. Yes. [20:10] That is also my answer when people are like, "Isn't Vanta going [20:12] to make a standard? [20:13] Couldn't you make a better one?" We have that posted on the office wall. [20:17] Because it is your life. [20:20] Going back to the effects of the European strictness, it doesn't [20:24] show up in the form of... [20:26] Maybe American companies previously were looking to check the SOC 2 box versus now [20:32] they're like, "Okay, it's really important I don't cross this [20:35] quite strict European rule."Right. [20:37] Where they think now, and I think in the… [20:39] It's funny, when we were starting Vanta—Vanta as what it is now today—in [20:44] spring of 2018, which is when GDPR was going into effect. [20:48] I was running around and being like, "Will you talk to me about compliance?" [20:51] Everyone said, "Yes." I was having this great luck. [20:53] Then I'd show up, and I'd be like, "SOC 2." They'd be like, "GDPR is a priority. [20:57] Next, please." [20:59] That energy has mostly dissipated, especially in the United States. [21:02] I think because it's like… [21:05] The theory at the time was GDPR is written by lawyers at a very high level. [21:09] It's not a spec you can hand to an engineer, comically [21:12] bad as an engineering spec. But it's fine. [21:15] We will clarify that in court over the next 10 years. [21:18] Now we're, whatever, seven, eight years in. [21:20] It hasn't really happened. [21:23] It still is hand wavy for an engineer, at least, to go implement as it ever was. [21:29] How does this work with agentic coding where the honest answer to the number [21:34] of human reviewers to this code is zero? Yes. [21:39] How should it work? [21:40] Because right now it is like, well, somebody needs to be like, [21:42] "I did code..." I think right now it's like agent writes code, [21:46] human or agent puts up PR, maybe human or agent reviews it. [21:51] I think to a naive SOC 2 audit, you're like, "Those seem like two user IDs [21:56] had that conversation, and so we can go forward." [21:59] But it's more about having two throats to choke as opposed to we read the code [22:04] of this ATM software and guaranteed that you didn't introduce a money glitch. [22:11] Yes. [22:11] My interpretation from talking to folks is some of the impetus behind that or [22:15] the primary impetus was insider threat. [22:17] That's what you're preventing against, which maybe that's my macro answer is, [22:22] just go through the SOC 2 controls and be like, "What are we trying to do [22:26] here?" And be like, "Okay, great. [22:27] Let's design for that." That may or may not be how it's written today. [22:31] That's a good question because on all the insider threat stuff, [22:34] having two reviewers is one way to do it. [22:36] Does SOC 2 mandate a lot of other insider threat stuff? [22:39] Because presumably, you should be logging a lot of activity, [22:42] auditing a lot of activity. [22:43] There should be processes that you have in place. [22:46] No. [22:47] I think this is where actually you get to the technical standard [22:51] made by folks who often aren't as in their depth in engineering, let's say. [22:56] The controls for… [22:58] There are a bunch of logging and monitoring controls that are suggested. [23:02] One thing maybe we also mentioned, unlike PCI, SOC 2 doesn't have [23:05] a prescribed control list. [23:07] PCI is different, and it's like, "You must buy this tool, whether or not it's useful [23:12] to you." I'm sure you have your own story with that. [23:14] I'm familiar, yeah. [23:16] SOC 2 is like, "You must log useful events and have a system to look at them. [23:21] But it is up to you to decide what the heck that means," [23:24] which sometimes it's helpful. [23:25] I think for a startup that's never done this, it is unhelpful because it opens up [23:31] a maze in a way that's just not great. [23:33] That's where being prescriptive is part of, I think, Vanta's [23:38] initial product market fit. [23:39] I think it's actually largely due to that. [23:41] In a way, that wasn't the plan. [23:43] But I think it's like figuring out how to take that high-level guidance, [23:47] bring it down in some places in a way that actually makes sense. [23:53] Christina and her team at Vanta are helping their users automate compliance, [23:57] which for many companies is the thing standing between them and being [24:00] able to sell to enterprises. [24:02] We're very familiar with this category of products with Stripe, [24:04] where you have a complex web of rules that businesses need to be able to comply [24:07] with so they can move on to actually improving their products. [24:10] Just take tax compliance and our product, Stripe Tax. [24:13] As you start selling in more states and more countries, you discover there's [24:17] thousands of rules you need to follow. [24:19] For example, did you know Chicago actually has a lease tax, which applies to SaaS [24:22] companies, too, since you're leasing out software? [24:25] Stripe Tax is built to automate all of this. [24:28] With one integration, it knows what you're selling, [24:30] when and where you have to collect transactional taxes, and how [24:33] to register and file on your behalf. [24:35] If you want to sell globally without becoming an expert in tax rules, [24:38] check out Stripe Tax. [24:43] The joking reference that everyone makes is [24:48] they talk about competition from Claude Code for software [24:53] products is, "You're not just going to vibe code your X in a weekend." But [24:59] obviously, something like SOC 2 is actually the kind of thing that [25:04] a Lens or coding agents are good at working with because there's just so [25:08] much training data out there, and it's a codified set of rules. [25:13] How is AI helping with what you're doing, and what is your plan for… [25:18] You were describing some of the scale economies you have and having seen other [25:21] customers, and I'm curious what the defenses are against… [25:25] A customer could, in theory, say, "Hey, Claude, give me the plan for our SOC 2 [25:29] compliance, make no mistakes." That is a thing you can contemplate. [25:33] I think you can do the very defensive thing, but actually, [25:37] the very defensive thing is like, "Right." But this is a place where [25:40] you don't want to get stuff wrong. [25:42] Spending much time on it does not make your beer taste better. [25:45] Is this really the place? [25:46] Even if you really want to vibe code a bunch of stuff, is this really [25:49] what you want to vibe about? Fine, whatever. [25:50] There's all those rumors. Ignore them all. [25:52] I think where the LLMs are excellent and a little dangerous in a build versus [25:57] buy, but then we just need to build better experiences on top of this is like, "Hey, [26:03] Claude, I'm going to give you a mess of data. [26:07] You go make sense of it to me and get me ready. [26:10] I'm just going to give you a bunch of AWS screenshots or API calls. [26:15] I'm going to give you all my policy documentation. [26:18] I'm going to give you my existing Jira workflow. [26:21] Go turn it into a thing." You can go do that today. [26:24] We are building… [26:26] This is our onboarding flow or will be our onboarding flow, which is, "Oh, [26:30] you have an existing program that's already running. [26:32] Give you all the stuff. We will go map it into the Vanta world." [26:36] Then in a Claude or an LLM, it's like, "Okay, cool. [26:40] Now you get files in a folder structure that you then box share that over [26:45] to EY and call that your audit." Fine. [26:48] You can do that. [26:49] In a Vanta world, the outcome is, now, hopefully, we have your program mapped and [26:54] is observable and monitored and alerted. [26:56] You have continuous control monitoring. [26:58] You get your dashboard, you always know what is in place and what is not. [27:01] Yes, you can go send a share link to your auditor here, [27:05] too, and they can log in and see everything. [27:07] We think about it as they have lowered the [27:12] initial audit prep in a way inside, outside Vanta. [27:17] Or if they're not inside Vanta, what are we doing? [27:19] Building that. [27:21] But the continuous monitoring piece. [27:23] That you're not going to get out of at least LLM chat. [27:26] You've got to go vibe code that whole system. [27:28] Okay, so you're saying that everyone just wants… [27:31] No one enjoys spending time in SOC 2. [27:33] Everyone wants to have been SOC 2 compliant as of yesterday. [27:37] Yes. [27:38] You're saying part of the advantage here in this new landscape is you can just take [27:42] a whole bunch of unstructured stuff and just empty it into the Vanta [27:46] hopper and Vanta will make sense of it. [27:48] We'll get widgets that… [27:50] I presume part of the defensibility comes from the fact that preference amongst [27:55] practitioners, in this case, the auditors that are reviewing your SOC [28:00] 2 materials, is a very strong effect. [28:02] That is very true. [28:04] Both QuickBooks and Xero, to some extent, really grew off accountants becoming [28:10] familiar with those pieces of software. [28:13] Companies could have opinions about what they were using, but those opinions were [28:17] not that strong, and they were overridden by the opinions of the auditors. [28:22] We have a version of that. [28:24] I don't think it's as those effects yet, at least. [28:27] But even again, we've seen 20,000 audits and thousands for particular firms, [28:33] and so you're like, to control… [28:35] We now do AI evidence eval. [28:38] It's like, "Oh, you're going to provide this piece of evidence." We can just tell [28:40] you, is it going to work for this auditor? [28:42] Did you upload a cap picture? [28:44] Did you upload a screenshot without a timestamp on it? [28:47] You're going to get told to put the timestamp back on. [28:49] Just that feedback loop. [28:51] We already have, and we've thought about a lot about doing things [28:54] for auditors as well with that. [28:56] But yeah, it moves in the direction of an AI internal audit, at least. [29:01] It feels like the data you have of anonymized prior audits is [29:08] an incredibly powerful network effect that cannot be replicated because it [29:13] doesn't exist in the public interest. [29:15] The AIs don't have it available to them. [29:17] It's just private data. [29:18] Stripe is an advantage because we have all the fraud data. [29:22] We know what a normal buying pattern looks like versus not. [29:24] We can offer the best anti-fraud performance just because we're working [29:28] with a larger data set than other people. [29:29] Similarly, people are going through an audit, you can tell them [29:32] that this will work and this won't. This is our Radar. [29:35] Yeah, exactly. [29:36] In a way that just you cannot do even if you decided to buy it yourself. [29:43] That's a big deal. Yeah, that's kind of cool. [29:46] Where else have you seen that be useful? [29:48] In relationships between a software vendor and buyer. [29:56] Vanta core, we think of ourselves as broadly and what we're best known for is [30:00] serving software vendors, but people who make software [30:02] and want to sell it to the world. [30:04] Do you have security work? Is it secure? [30:07] Then we have this third-party risk product, but it's basically, [30:10] I think of you're an organization, maybe it's tech, maybe it's not tech. [30:15] You're buying software, and you're going to go put a bunch [30:18] of your customers' data in it. [30:20] You want that software to be secure, because if not, you have to turn around [30:23] and tell your customers, "I lost your data, but it's [30:26] actually our email provider. [30:27] But you don't care about our email provider. [30:28] You think it's me, and I've sent you the email anyway." [30:30] No one wants to send that email. [30:32] There's a whole world of third-party risk or vendor reviews, [30:36] and we built a product for those folks. [30:39] But is there a compliance versus security tension here as you're doing this stuff? [30:43] We haven't seen as much. [30:45] What we have seen is the person buying software, [30:48] they might work at a tech company and be quite savvy and up [30:51] to date on those threats. They might work… [30:53] One of our customer is literally a hotel chain. [30:56] They certainly don't get compliance themselves because they don't [30:59] build software, but they buy it. Fine. [31:03] What we generally see is some companies will come in with their set [31:07] of questions they want to ask. [31:08] Maybe I will read your SOC 2, maybe I will not, but I really want [31:11] to ask you questions one through 10. [31:14] Some companies don't have that. [31:16] Again, there's some part of the Vanta value proposition is, [31:19] "We'll prescriptively guide you." We have a product principle [31:23] just around reasonable defaults. [31:25] It's like, "Can we make the reasonable default questionnaire, in this case, [31:28] something that leads into security versus compliance?" Or versus, [31:31] "Do you have a policy to X? [31:32] Can you just ask them if they X, if you care?" [31:35] That's a place where we've tried to, on the margin, [31:38] nudge the buyer questions toward more security, knowing that will change [31:43] the economic incentive of the vendor. [31:46] One of the big debates people are having right now is how AI [31:50] productivity gains show up. [31:52] I feel like you could have an opinion on this because [31:56] we have filled out a lot of security questionnaires at Stripe, [31:59] and I think we'd be very happy if the machines could take over from here. [32:03] We really don't need to... We filled out enough. [32:05] We should talk about this, yes. Exactly. [32:07] One case you could make is the machines are getting quite good. [32:11] They can understand what Stripe is and isn't and can do and can't do. [32:14] Every time we get a security questionnaire, AI can fill it out. [32:19] The counterargument you could say is maybe Jevons paradox will show up and there'll [32:24] be even more exhaustive and elaborate and custom security questionnaires. [32:28] The total amount will increase. [32:30] How do you see AI productivity showing up here in the effect? [32:34] The questionnaire is actually the great example because [32:36] the questionnaires do that. [32:37] We tried to build this product in 2018, actually before SOC 2, [32:40] because it seems easier, actually, but the language models were not good enough. [32:44] Then we tried again in early '21, and then BERT came out, and you're like, [32:48] "Oh, is there more?" It was not good enough. [32:50] Now it is good enough. [32:51] To that, actually, GitHub gets 92% of all of the questionnaires [32:56] they receive answered through Vanta. [32:58] You're not at 100, but you're like, "It's GitHub. [33:01] They have AI tools. [33:02] They have Copilot. [33:04] It's a lot." We are absolutely seeing this. [33:06] The models are definitely good enough. [33:09] Sorry, people ask GitHub to fill out security questionnaires before— [33:12] Used to fill it, exactly. [33:13] Using GitHub, and now they can mostly turn around and return those security [33:17] questionnaires with 92% filled out. Filled out. [33:22] We have a human, but just it's review and approve. [33:25] Then the confidence scores on prioritizing even for the reviewer. [33:29] It's like, "You can look at the section if you want, but you kind of don't have to." [33:33] Whereas, "Will you really look at these 10." All of that work, [33:37] our product does that. [33:39] That's cool. [33:39] Okay, so where do you think it goes broadly? [33:41] I think that so much of the work of a compliance team [33:47] is, again, keeping things in sync, keeping different sorts of text in sync. [33:54] Adding on new compliance regimes, which is just adding controls. [33:58] But really, do you want to map the new ones to the old ones and figure [34:03] out what the duplicates are? [34:04] That's actually a huge part, classically, of the work of a compliance team. [34:09] I think there are so many opportunities for LLMs and agentic [34:13] workflows in Vanta's business. [34:16] We probably have a couple dozen of them. [34:19] If I think about our roadmap, knock on all the things, we'll have [34:23] hundreds by the end of the year. [34:26] What we've been doing is breaking down what folks do. [34:30] You're like, "Okay, there's the questionnaire piece." If you [34:33] send out a questionnaire, someone has to read it on the other side. [34:36] Then you have to think about it and figure out where does it work, where it doesn't? [34:40] "Oh, I have this new policy update. [34:42] I need to put this thing in a policy. [34:43] We're going to start doing ISO 42001, which is the new AI standard. [34:48] How do I map that in? [34:51] I need to rerun a risk assessment. [34:54] I'm going to change my risk score." [34:56] Anyway, all of these things, all of these tasks are all just workflows [35:00] that you could have an AI do, write an eval against with subject-matter [35:04] experts, and then hill climb until they're quite good. [35:07] It feels like you can't reason about the [35:13] number of people in a profession, [35:14] especially at a certain stage of company changing. [35:17] If you think back to ancient times, I don't know, the year 2000, [35:21] if you had a 10-person company with 10 Gateway 2000 beige workstations, [35:27] they probably would have had an IT person. [35:30] That IT person would have had— [35:31] Had the servers in the closet. Yeah, exactly. [35:33] They had servers in the closet, they had Microsoft Access database, [35:36] they had to do software updates for all the machines. [35:38] Occasionally, lint and stuff will get stuck in the mouse [35:41] ball, and you'd have to take it out and clean it. [35:42] Oh, yeah, you have to take it out. [35:43] I haven't thought of that in a long time. [35:46] IT was a real job. [35:48] Now, I don't think a 10-person company really [35:51] has an IT person because the hardware is super reliable. [35:53] You just buy a new version every now and then. [35:54] Everything's in the cloud, so there's no porting data over. [35:57] You just use Google Workspace for everything. [35:58] It works really nicely. [36:00] IT still exists as a profession. [36:02] There's lots of interesting things. [36:03] But Stripe has a bunch of IT people. [36:05] You don't need a bunch of IT people. [36:07] You've got to mail laptops to how many countries in the world? [36:09] It's actually kind of hard. [36:11] We have some IT challenges. [36:13] But again, we're 10,000 people. [36:14] Again, it naively feels like you will have a similar effect [36:20] with compliance as we had with IT, where the profession very much stays around. [36:24] It actually gets more skilled rather than… [36:26] I think the stuff we do in IT is harder than the basic IT, [36:29] the 10-person company would have done. [36:31] Is that basically where compliance is going? [36:33] I think it's basically true, yes. [36:34] One model we've thought about with Vanta, even pre-AI, is we will delay the point [36:39] at which you have to bring on a full-time security compliance person or a [36:44] consultant who's spending meaningful time. [36:47] But in the past, if you were an enterprise company, maybe you did that at 50, 100. [36:51] It's like, "Can we actually push that further out?" Because what we see is [36:55] then an engineering leader or someone in the engineering org can [37:00] manage more of this because they have the mental models, and they're [37:03] usually system thinkers, and they can— [37:04] They're responsible for it, so they can change the stuff. [37:07] Exactly. [37:07] You have this—we call them Amelia Engineers—but the Amelia Engineers [37:12] just going further here. [37:14] Then you can bring on a unified security and compliance person versus, [37:20] you have your security person, your IT person, your compliance person. [37:23] But it's a little bit of what we're seeing in the engineer-PM-designer collapse. [37:28] You have the security-compliant IT collapse into one role. [37:32] You can keep them unified for longer. Exactly. [37:34] If you can give them good tools, they can do that. [37:37] Okay, fine. [37:38] Then again, pre-AI, but then over time, that team starts to grow, [37:41] and then you have a GRC team, and you have CISO, and all this. [37:44] What we're talking about now, and we haven't seen yet, [37:46] but if I had to future cast and guess, is we're going to see [37:51] those GRC teams collapse a bit more into these single-threaded owners. [37:57] Because you think of a GRC team today, there's maybe [38:00] one person answering questionnaires, one person just reviewing [38:04] new software vendors. [38:06] You look at those, and you're like, "Okay, I think you can [38:09] agent the work and then have someone oversee it with 20% of your time." But [38:13] like, okay, great, you've collapsed two into 40%. [38:16] You have some person who's [38:21] responsible for bothering the engineers [38:25] to get evidence for them for the audit or to get the control in place because they [38:30] don't own the control, but they own the program, [38:32] so they have to go to the engineer and be like, "Hello, I noticed you have [38:34] a new database that is not encrypted. Will you please encrypt it?" [38:38] You're like, you can just have software go nag that person. [38:40] Anyway, it collapses. [38:42] I do think we will seek smaller GRC teams managing agents, [38:48] but actually in the future. [38:50] Then they are doing more. [38:52] I'm not doing the security reviews. [38:55] I'm thinking about the findings and overall managing this risk portfolio, [38:59] this vendor risk portfolio, versus being like, "Oh, [39:02] this vendor doesn't have this thing, and I need to go get it from them." [39:05] Yeah, I think what you're saying is there's a strategy component to how should [39:08] we be doing things, and then there's an hourly labor component [39:11] to compliance, which is like, "Oh, we did 10 times as many sales. [39:15] We need 10 times as many bodies on the security reviews." You're saying [39:19] that AI will eat up a lot of the hourly labor part of compliance and leave [39:23] people doing the strategy work. [39:24] Yes, I do think that. [39:27] What changes are coming down the pike in the world of compliance? [39:30] I think there's, to the XKCD, there's lots of folks both trying to make [39:35] new compliance standards, but there's a little bit of what's [39:38] the difference with the 22nd one? [39:40] From a Vanta perspective, we've taken out like, [39:42] we will support them all because we have built a machine where it is [39:45] easy to add a new one in. [39:47] But obviously, you only want to support ones that customers actually want [39:50] to comply with, so you're not— [39:51] Yeah, but what we do... [39:53] We used to spend a bunch of time debating which ones those would be, [39:56] and it was honestly so frustrating. Now it's too long to model. [39:57] Exactly. [39:58] Now you're just like, build the machine that just lobs them in. [40:01] The debate and the document you would write— [40:03] It's like us with payment methods. [40:03] Do you want to support this payment method? [40:04] Sure. [40:06] We did that with compliance standards and integrations because it was just [40:09] the prioritization debates were just too intense. [40:13] We can take all of that debate time. [40:15] Anyway, there's a bunch of those. [40:19] Would I bet on any of them? [40:20] If you really pressed me, I would say ISO 42001 just because it's the European one. [40:25] I don't know that ISO. You got a— [40:28] 42001? You got to catch me up on this new ISO. [40:29] It's a good one. I recommend it as bedtime reading. [40:31] ISO, you know this, is a European standards body, [40:34] and it is their version of what one should care about with AI. [40:41] It ends up being pretty data privacy-focused and pretty high level. [40:46] Those are the counters. [40:47] The pros are that European enterprises are the ones that care the most about AI, [40:50] and this is where they return. [40:52] It's the thing that has the most market traction so far. [40:55] But again none of these are— But none of these are breakout. [40:58] None of them have product-market fit. [40:59] None of them are regulatory. They're all— [41:01] Correct. You opt into— [41:03] It is like, this market has roughly agreed, you might need this thing. [41:08] There's that. I think the… [41:11] Okay, I'm kind of proud of this. [41:14] Are you familiar with the trust centers? Mm-mm. [41:17] They're the security status pages. Sure. [41:20] Yeah. Trust dot blah, blah, blah. [41:21] Trust. vanta. [41:22] com. [41:22] I didn't know they were called trust centers. [41:23] It's just a status page. [41:25] Yeah, but for your security posture. [41:28] You get the green bars or green traffic lights or yellow traffic lights, [41:32] but it's for your controls. I see. [41:35] They all say the same thing. [41:37] A status page is red, amber, green. [41:40] Hopefully, the trust center always says, "We're really compliant, boss." [41:43] Yeah, exactly. There's a version of that. [41:46] If nothing else, what they actually are, they're ticket deflection [41:49] for the GRC team. I see. [41:51] Because one, your sales team sends them out, and you're like, [41:53] doesn't it look good? [41:54] Then, if you have any questions, here you go. [41:58] It's the prefilled questionnaire. [41:59] Yes, exactly. [42:01] It's like, here's the binder of information. [42:02] Please read it. [42:04] If you have questions for me thereafter, I am here. [42:06] Does that work? It does, actually. [42:08] I think part of it is the just show of strength and the show of I'm on top of it. [42:12] Then there's the like, yeah, read things first. [42:15] Then, if you want to ask me, go for it. [42:17] Has outbound selling gotten harder now that everyone has [42:21] a million AI bots spamming everyone? [42:23] I think what I have heard is phone calls work in a way that I wouldn't expect. [42:29] For now, right? For now. [42:30] But now, emails... [42:33] A million AI bots. [42:35] I mean, how many ChatGPT written emails do you get in your inbox a day. [42:39] But outbound phone calls are currently working. [42:42] Got it. But again, it's only a matter of time. [42:44] It's only a matter of time. [42:45] I think then you're just back to, oh, events. [42:48] Especially small curated events. [42:51] A topic we talk about sometimes here is on-demand software. [42:57] Patrick is taking the thing that software should be like pizza, [42:59] delivered fresh, piping hot. [43:00] But why are you using software that someone coded [43:04] five years ago rather than just the computer deciding what [43:07] to render to you at that moment? Is that coming to Vanta? [43:12] It is. [43:12] It's something we're playing with internally, but really excited about [43:16] is having an agent that maybe is guiding you [43:20] through the process or doing something and then needs the user to render [43:24] an opinion or make a connection or do something. [43:28] You're like, can the agent just generate UI specific for that task, [43:31] so the user completes it and then move on? [43:34] You get this bespoke agent-generated, hand-generated UI just for that. [43:39] That does not exist. [43:40] Are you talking about because maybe people have a little bit of experience [43:44] with agentic UI, an AI chat interface is [43:48] people's first experience. It has some stuff in it. [43:49] Maybe there's three options you can choose, for example. [43:52] That's like agentic UI, but you're talking about a full UI. [43:55] Maybe you have that agentic chat bar on half of the page or a third [44:00] of the page, and the other two thirds would be a SaaS app. [44:03] You can imagine a data table with a view and columns rather than just customizing [44:07] it, you're like, "No, I just want you to do this thing, [44:09] and I will take over that right-side canvas of the page, generate the UI [44:14] for the thing, or generate the report. [44:15] I think reporting is another great use here. [44:18] What step of the process would this be? [44:20] Would this be like you have 14 things you need to fix to get to— [44:24] We thought about it in two ways. [44:25] You're setting it up and you're going through. [44:28] Actually, reporting is another, I think, great case. [44:31] It's like no one wants more knobs and whistles on their reporting tool. [44:35] Also, no one really wants to learn SQL. [44:39] I want to report for this, go, generate it. [44:43] Not quite right, take this out. That's cool. [44:45] When will we be seeing generated UI in Vanta? [44:49] This summer. Wow. [44:50] What has worked well from a go-to-market perspective for you guys? [44:53] In a way that we don't… [44:54] We have tried to… [44:56] But brand spend, honestly. [44:57] The billboards, we do all the stuff people do of zip code tracking and all of that. [45:04] Gong call mentions. [45:05] Recorded sales, like mentions of the word billboard on recorded sales calls, [45:10] and then you can track— To measure the billboard. [45:12] Exactly. [45:13] Then you track those deals through to closed one and like that. [45:16] You're ultimately doing a geo split. [45:17] You're looking at the locations where you had a billboard versus not. [45:22] Then just does the prospect say the word billboard in a call at some point. [45:28] Some of that. [45:29] Podcast advertising has been exceedingly effective for us. [45:36] It's funny because we started doing it in late 2020 with our first salesperson, [45:41] Eric, who's still at the company. [45:42] He really wanted to advertise, I think, on This Week in Startups. [45:45] I thought it was silly because my model is the only companies that advertise [45:50] on podcasts are founders who want to hear about themselves. [45:52] This is just nonsense. Or mattress companies. [45:54] Exactly. Or mattress companies. [45:56] But we are neither. [45:57] Doesn't everybody really need to talk to... [46:00] Anyway, he came to me and was like, I want to spend $60,000 on this ad. [46:06] My deal with him was "Fine, but you got to sell four more Vantas" [46:09] because a Vanta basically cost $15,000. [46:12] The next month, he sold 34 more Vantas because of the podcast ads. [46:16] That was when you were like, "Well, I know nothing. [46:17] You should just keep going." [46:19] I call this, by the way, I think there's a founder negative value add at times. [46:23] Yes, exactly. [46:24] Founders have these incredibly strong views that are wrong. [46:26] That are just deeply wrong. But it's really hard to remember. [46:28] It's good that you let them go and do it because sometimes I think some people [46:31] would have said, "No, we're not doing that, it's silly" and it [46:33] would have taken many more years to learn. [46:35] The deal is you have to sell four extras. [46:37] I feel like I've heard you on the Acquired podcast. [46:40] We do. We advertise on Acquired. [46:41] We do Invest Like the Best. [46:43] I think in the early days, so this was helpful and then deeply [46:47] unhelpful, but in the early days before we had competitors, we tried to basically [46:52] make this call response of someone says SOC 2, someone says Vanta. [46:56] There's really close association, which in the early… [46:59] Again, when we were just competing against consultant— [47:01] You wanted to own the term SOC 2, basically? [47:03] Yes, basically. [47:03] Which worked really well until we had competitors who were like, [47:07] "Well, we do a SOC 2. We're Vanta but cheaper. [47:09] Worse, but better." Then you're like, "Oh, God. [47:11] Now we're all pointing at a thing we don't [47:14] own, and that's bad." Then there was [47:19] a great reframe on that one, I'd say. [47:22] What did you learn working with Fred Wilson? [47:24] USV is a very special place in lots of ways, and I think USV is [47:29] fundamentally about ideas. [47:32] More so than other venture firms. Yes. [47:34] I think most venture firms are a herd of great-man, great-person firms. [47:37] They're about the person, and this person will do the thing. [47:40] I have no idea what this is, but I like the cut of his jib. [47:42] Exactly, yes. [47:43] I think USV is, it's just too black and white, [47:47] but it's basically the opposite. [47:50] Whatever person can walk in, but if it is an idea [47:54] that is interesting and compelling and intellectually engaging and networked, [47:59] that is classic USV. [48:01] It matches back some great people. [48:02] I don't mean that, but it's just first thing... [48:04] First, second, and third thing is the idea. [48:06] Really pressing on that. [48:09] It was that piece that I think was very important. [48:15] I think the second part is market sizing is bullshit. [48:20] You can be as academic or whatever, [48:25] strategy-ish as you want about it. [48:28] The market size today is only a predictor of the market size today. [48:34] I think I deeply learned that because if you looked at the SOC 2 market in 2018, [48:40] my best estimate was there was $10 million spent globally, and you would [48:44] never start a startup on that. [48:45] But the theory of Vanta was like, "Well, if we can make this thing easier to get [48:50] and take down the cost of dollars but really time, more people will get [48:53] them." That ended up being deeply true. [48:59] But that was not a market, especially for startups. [49:02] The market for startups getting SOC 2 in 2018 was zero dollars. [49:06] Yes. Truly zero. [49:07] Yes. [49:08] Vanta is an example of the company that being too TAM-brained— [49:13] Yeah, you would not come up with it. [49:15] Now it's like, "Oh, but of course everyone gets it." You're like, [49:17] "Right." But like, 2017. [49:20] Again, when did Stripe get a SOC 2? [49:23] Probably reasonably early on because it's so core. [49:28] It's not a small part of your stack, but definitely before 2017. [49:33] It's very interesting framing on USV where I feel like you can see this a little bit [49:37] in Fred's blog and stuff where it's clear. It's the ideas. [49:41] Yeah, exactly. [49:42] Attraction to ideas and a prepared mind for something like crypto. [49:46] It comes along. You're like, that thing. [49:48] You're ready to strike. [49:49] Is that across the firm or is that Fred in particular? [49:52] It's Fred and Brad, for sure. [49:54] Brad is the under-sung Fred partner. [49:58] I mean, they started the firm together. [49:59] You're talking about the Fred and Brad relationship. [50:01] Yeah. [50:02] Brad Burnham is a venture capitalist, mostly retired now, but also [50:07] excellent and incredible track record. [50:09] He and Fred started Union Square Ventures in, I think, 2002. [50:12] First fund was '04. [50:14] Took them two years to raise that fund. [50:16] If you go look up USV '04 Vintage, God, we all should have invested in that. [50:21] But it was the two of them. [50:23] Then Albert came on as the venture partner, I think in '06. [50:26] He was on the fund of the partner. [50:28] Going real deep here, sorry. [50:30] But it was like the two of them. There is just… [50:34] It's not Yin-Yang. It's not the right frame. [50:36] Complementarity. Yeah. [50:38] Many of the ideas of the firm went back and forth by them. [50:45] Then Fred was excellent at articulating those ideas in a way the rest of the world [50:52] could understand, check it on ABC. [50:52] Which he did on I think one of the under-appreciated [50:57] things is how much back and forth there was there in the creation there. [51:03] That pairing, I think, probably should be in the annals of [51:08] the Khosla-Doerr pairing, maybe like Leone-Moritz. [51:11] These venture pairings where you had two people who could play off one [51:15] another, and they were just like that. [51:17] I think Brad and Fred had that for a decade and a half. [51:20] What's the difference in person? [51:22] Because I'd say Doug and Mike Moritz at Sequoia are very different people. [51:26] Again, I think that's part of how it works. [51:28] Yeah. [51:28] I don't think Fred and Brad are as different as those two are. [51:30] But yeah, Brad is cerebral, philosophical, academic, [51:36] so interesting to talk to, and you have this wonderful conversation, [51:39] and you'll be like, "Are there any ties to the business [51:42] world in that?" But truly, these are… [51:44] Then one thing Fred could do was go back and forth with him and be like, [51:48] "Oh, freemium." Then run with freemium. [51:51] But it wasn't just I'm going to market this term. [51:54] It was the back and forth and then the communication out. [51:57] Wait, did Fred coin the term freemium? He did. [51:59] Yeah. [51:59] In a blog post in, I don't know, '08, '09, something like that. [52:03] Doesn't it feel like it was just always a term? [52:05] Yeah, exactly. That's just what it's called. [52:07] In 1952, didn't they talk about freemium? Yeah. [52:10] It's like when you learn those things like, did you know saying [52:13] the quiet part out loud? [52:14] That term comes from The Simpsons. [52:16] In what ways are you a different CEO coming from your [52:19] experience as an investor? I wouldn't have done it. [52:21] It's a real answer. That's a good start. [52:24] I'm really lucky in approximately nine million ways with them. [52:28] One of the ways was for two years, I just met 15 founders a week [52:33] for two years straight. [52:35] I think whatever model I had of what a founder is or does, [52:39] it was like, "Yeah, that exists." But look at all the ways one can do it. [52:44] There's some coming out, some more success, but just [52:47] there's a lot of ways to do this thing. [52:49] I think that exposure was super helpful for me because you got [52:55] to see people who I felt more affinity or similarity to in whatever [53:00] dimension also do it. [53:03] It was the role model thing, but not one person. [53:07] You meet a thousand of them, and you can pick out the pieces. [53:11] Having all that training data, what patterns do you think you see [53:14] in people who went on to be successful? [53:16] Or maybe conversely, what anti-patterns did you see in the people who— [53:19] I think there is a… [53:21] Someone said this better than me, but there is a totally a truth-seeking [53:25] piece of it, or just sometimes you can bend reality to your [53:29] will, but often reality is reality, and you got to embrace it and figure [53:33] out how to work around it. [53:34] Reality, sometimes it's an immovable object. [53:37] I think there was a— [53:38] It was a delusion to the unsuccessful founders. [53:40] Exactly. I haven't noticed that. [53:41] Yeah. [53:41] They're like, "Oh, no, but I can change this." You're like, [53:44] "That one, I don't…" Gravity is gravity, isn't it? [53:47] The version of this I talked about with Des Traynor [53:50] is, I feel like investor updates with a lot of words and no metrics. [53:55] Oh, yeah, those are bad. Those are bad. [53:57] Actually, no investor updates is fine. [54:00] No, either way. [54:01] No is either very good or very bad. [54:03] Metrics is fine, but a lot of words and no metrics is almost a sure sign of failure. [54:09] Bad, yes. [54:11] Because, again, I think it gets at that delusion, failure to truth-seek tendency. [54:16] What else? [54:19] They're famous, Etsy and Kickstarter. [54:21] There's a bunch of these companies of this era stories where [54:25] I think I developed—that's true—this huge appreciation for product-market fit. [54:31] That sounds so dumb, but now it's the like, "If you think [54:34] you have it, you don't" framing. [54:36] Or if you're asking whether you have it, you don't. [54:38] Etsy, great example. [54:42] Co-founder CEO spent 80% of his time for years making people desks because [54:48] they had this lovely cultural thing. [54:50] When you joined, you were getting homemade bespoke desk because they [54:53] sold homemade bespoke things. [54:54] This is the thing, Yancey would make people a desk? [54:57] I think it was Rob Kalin at Etsy. [54:59] He would make people a desk. [55:00] Sorry, I'm getting confused between Kickstarter and Etsy. [55:03] This is the Etsy version. [55:04] Now, if you're like, 80% of a CEO's time is making [55:08] desk and the business is on fire. [55:10] See, Amazon had it figured out where you had to make your own desk. [55:13] It's a much more scalable way. Rob made the desks. [55:15] But you're just like… [55:17] It's a funny story, but you're like, "The business was fine." [55:20] There are just these things that have [55:23] their own immovable objects, and you can [55:28] be making desks for people all day long. Doing a podcast. [55:31] It doesn't matter. [55:32] If you don't have that… It's not that we should all… [55:36] I mean, maybe we should all go make desks. I don't know. [55:38] Would you spend time making desks at this stage? [55:41] I think woodworking is very… [55:42] I don't do it, but I did it as a kid. It was satisfying. [55:45] Last question. [55:47] Does Vanta expand from here beyond security? [55:50] Do you start helping people apply with everything else? [55:53] Do you continue taking over the world until all the world runs on Vanta? [55:57] Yeah. What's the plan? [55:58] Definitely taking over the world, making desks along the way. [56:01] No. [56:02] I think right now we do think about, especially in this world where in theory, [56:09] code has become much cheaper, actually. Two things. [56:11] One, it's like, "Can we add different pillars or verticals?" There's a whole lot [56:16] in security, especially for a small business or a mid-market business. [56:20] I think enterprise, it's a different ball game there, but there's things there. [56:23] Then when we really think about parts of the CISO organization [56:29] versus, for the most part, other parts of an organization. [56:32] But we would think about enterprise risk or internal audit. [56:36] Financial audit is adjacent and interesting. [56:38] What can you do in an internal audit or financial audit? [56:41] Internal audit is easier for us, given what we've built in a way, [56:47] is we have all of this, and currently we're packaging material [56:51] and sending it to the auditor. [56:52] But you can imagine packaging it sending it to an internal auditor. [56:55] It's the same thing. It's a controls platform. [56:57] It's like, "Decide what it is that you should do [56:59] and then validate that you're doing it." Prove that you are doing it. [57:01] Exactly. Financial audit is the system is similar. [57:06] It's a different set of integrations on data. [57:08] It's thinking through, okay, at what is the right point to start [57:12] building out those ERP integrations, payments integrations, all of that to get [57:16] that data to parcel this in. [57:19] Exciting. [57:20] Christina, thank you. Thank you.