The Exchanges

Q Christina, we talked last time about the story of the tremendous round that Vanta raised in the end of April, even as the world was falling apart around you. But now that you've raised that round, how are you operating the company now in this environment that has changed quite a bit here in 2022? And what advice do you have for other founders who are in the same boat?

A Yeah, so I think at a high level, a lot of actually what's said on Twitter and the advice that's given out is really good. It's take the last round you've raised, presume it's your last, or at least you're not going to raise for maybe two to three years and operate the business accordingly. Also going to assume a bunch of your metrics are going to degrade. So whether it's you're going to spend more to acquire customers or the retention is going to dip, I think that's all really good. A few things we've done just super tactically, I tend to find tactical advice actually Helpful to take the platitudes down to what we're actually doing. So we have an operating plan for two and a half years that we are revisiting on a weekly basis, and then we'll make updates on a monthly basis, and it filters into hiring, it filters into marketing budget, and it's just designed so that we, again, have the runway we expect despite whatever changes might happen. We can just look at the plan, look at the actual results, diff them, be like, okay, Can we speed up hiring? Should we slow down hiring anywhere? What should we do based on what just happened and having those touch points? And also just a set of people responsible for looking at the data and making the decision every month. Super helpful. So another thing we do is we have napkin math for a bunch of different roles, and that's how we figure ou…

AI assessment note: “we have an operating plan for two and a half years that we are revisiting”

Q Well, to kick us off here in episode one, Vanta today provides the best solution in the market to get SOC II certified and, and stay that way. I know there's actually a fascinating history to SOC II and why it exists. Can you share that with listeners?

A For sure. So, uh, it started in, or there's a handful of, you know, different versions of SOC II before we know what it is now, different acronyms, but started probably 1015 years ago, um, with something called SOC I, actually, with the accountants, and that was just a financial auditing standard, uh, just trying to look at, do companies have the correct financial controls in place, so rules around how they, how they handle financial matters in their company? And then what gets audited annually? Um, accountants were doing that. I think it was a good business. Uh, around that same time, right, businesses just started to digitize, come online, um, more in our parlance. Software started eating more and more of the world. Uh, and so I think the accountants saw this, uh, you know, tremendous opportunity for, for sort of market expansion. Um, and so they, they started something called SockTo, uh, which sort of like Java, JavaScript, like, These things aren't really that related, but what it is at a high level is just assurance that the business takes care of customer data well, and we just have seen this be, you know, kind of more and more important as software has eaten the world, as we've seen more data breaches of big companies, and sort of everyone is more aware of how much data there is about all of us on the internet. And so over the last Five years, really the last two years, …

AI assessment note: “started probably 1015 years ago, um, with something called SOC I, actually”

Q security and compliance has really evolved in these few years that Vanta has been, uh, really pushing the market forward. And it's no longer just about like check the box, playing defense as a company, and especially as a startup. It's actually about playing offense. Given all that and the kind of central role that Vanta is now playing in this space, how do you see security and compliance evolving?

A Really excited about the future, so I think a handful of things we're seeing. This concept of, you know, security and compliance and basically proving the security you have to your buyers has just become table stakes to B to B companies. When raising the seed round for Vanta in 2018, walked around and told all the VCs that were going to sock to all their startups, and many of them very reasonably looked at me perplexed and said, but my startups don't get socked to, so what are you talking about? But now we serve a majority of the current YC batch, so people in YC right now, and again, like, YC is all about just getting revenue, but these reports just help you unlock that, and they do that by, like, opening up new markets, whether it's international or enterprise or healthcare or regulated industries, and I think particularly in the twenty-twenty-two funding environment, so much is about revenue growth from secure, trusted sources, and so I think We're going to see more companies move up market faster than we might have otherwise, and these big companies know that, you know, they're only as secure as their vendors are. If your vendor gets breached, looks like you did. It doesn't matter. It was them. And so there's just, I think we're going to see more and more scrutiny here over time, and that's going to filter down into higher expectations for startups. So having stable custome…

AI assessment note: “we're going to see more and more scrutiny here over time”

Q whole security and compliance process, SOC II, HIPAA, GDPR, and more. And today we've got CEO and co-founder Christina Cassioppo back with us to chat about Vanta. Um, ok so, Kristina, we've been talking about your product all season. What else is unique about Vanta the company? Do you personally have any strong beliefs about how to run a company, culture, how to, how to be successful in this ecosystem?

A One strong belief I've developed, uh, about the two parts of a company, go-to-market and, you know, end product and design, is that I think a lot of folks, right, somewhat naturally run the engineering side in particular, like, as if it were engineering, industrial engineering. I actually think that side is much more, like, art than science. You know, like, what is product development? Again, there's metrics you can put around it, but especially at the early stages, like, it's a lot of, you know, when you see it and you can go through Processes, but you can't really prescribe outcomes. I think in contrast, the go-to-market side, like marketing, sales, you know, customer success, especially for a SMB business or mid-market business, should be like run industrial engineering-wise, right? You just have processes, you have like inputs, you have transformations, you have, you know, conversions, you have outputs. The spreadsheet map there is actually really helpful, and that can be a lot more predictable. Whereas again, I think on the, especially new product development side, that if you try to, you know, go full industrial engineering on it, you will just not do anything interesting. So I think part of the magic at Vanta is we've been able to bring those two sides together and cross-pollinate across teams, and so give folks on the engineering team opportunities to, you know, see int…

AI assessment note: “One strong belief I've developed, uh, about the two parts of a company”

Q as you know from the TSWIFT episode, we are huge fans of Vanta and their approach to the whole compliance process. SOC II, HIPAA, GDPR, and more. And we've got CEO and co-founder Christina Cassioppo back with us today. Well, Christina, you've shared with us how SOC II came to be. What is the traditional way that people go about getting a SOC II certification, and how is Vanta different?

A Pre-Vanta, step one was, again, go read the SOC to a standard. See the, like, we solemnly swear we protect data in a good way. Figure out what that means for your company. Go and do that. Try to make sure that you've really done that. Call in an auditor who's going to come in and ask and say, hey, you said you solemnly swore this. Now prove it to me. And you might say, how do you prove this? And you're like, ah, well, you know, show me that you've Encrypted all your, you know, data at rest in AWS, that you use SSL on your websites, and it's up to date, you know, this, that, and the other. Show me that by logging into these systems and taking screenshots. Mail them to me. You know, you'll mail this person hundreds of screenshots. They will say, thank you so much, uh, you know, go back to their office or their home office, look at all the screenshots, and, you know, write this up into like a seventy-page report that roughly says, you know, We went to the company and saw that they have these practices and confirmed they're in place, and so you can trust them. That's really how it works, which is always surprising when you explain that to people in software. These are not things that, you know, founders enjoy doing or honestly can, can justify prioritizing. Um, I think this is just part of why startups didn't get SOC twos until a few years ago. So we looked at that as kind of engin…

AI assessment note: “Pre-Vanta, step one was, again, go read the SOC to a standard.”

Q long before Vanta, you were at Union Square Ventures from 20 10 to 20 12. You were really starting to be at the forefront and see how software was going to Make it so companies could get way more leverage on people and money and all the resources they have at their disposal to accomplish so much more so much faster. Was that an inspiration to what ultimately became Vanta?

A So definitely, especially in retrospect, like I think when I was at USV, I didn't know the word fast, and that's a reflection on me, not at USV at all. But what we called it, or how I thought about it, was like developer tools, right? And this was, uh, is it too niche? How many of these people are there? All their customers are startups. Clearly that's not sustainable. You know, how do you sell new age tools to old companies? These sort of Being on the inside of USV, like, saw the traction of, like, an early Twilio or Mongo, right? And so you sort of just be like, oh, no, people haven't caught up yet. Like, this is very much a real thing. And I think I just... Yeah, saw that a little bit earlier than, I mean, the market broadly. And so, coming into Vanta, just deeply believed, like, a go-to-market focused on startups can work, right? There are pros and cons of any, but you get, like, fast iteration cycles, and, like, that works. You don't have to worry about selling to, I don't know, IBM, you know, when you're a five-person startup.

AI assessment note: “So definitely, especially in retrospect”