Everything Christina Cacioppo said on any show that made the record, most notable first. Each card names its show and opens the statement there.
Cacioppo: Security companies targeting startups should sell compliance instead of security
“One of the original, like, founding hypotheses of the company is if you want to start a security company for startups, you should actually start a compliance company. Because your customers never ask you for Security, but they do ask you for compliance.”
Cacioppo: Current market size only predicts today's market, making TAM sizing misleading
“I think the second part is market sizing is bullshit. You know, you can, like, be as academic or whatever, strategery-ish as you want about it, and, like, the market size today is only a predictor of the market size today.”
Cacioppo: To Build a Successful Security Startup, Start a Compliance Company
“The joke that's not a joke about Vanta is I think if you want to start a security company, you should start a compliance company.”
Cacioppo: GDPR remains as vague for engineering implementation as ever
“The theory at the time was GDPR is written by lawyers at a very high level. You see, it's like not a spec you can handle an engineer, like comically kind of bad as an engineering spec, but like, it's fine. We will clarify that in court over the next 10 years, …”
Cacioppo: GRC teams will collapse into single-threaded owners managing AI
“What we're talking about now, and we haven't seen yet, but if I, like, had the future cast and guess, is we're going to see, actually, Those GRC teams collapse a bit more into these single threaded owners.”
Cacioppo: Outbound phone calls are currently working for sales
“Outbound phone calls are currently working.”
Cacioppo: Tying brand identity to a category standard backfires when competitors emerge
“In the early days, before we had competitors, we tried to basically make this call response of, like, someone says, talk to you, someone says Vanta. And this really close association, which in the early, again, when we were just competing against consultants. …”
Cacioppo: USV invests in markets and ideas over founder personalities
“USV, I think they're good at a lot of things. They are very, very, like, market and idea driven. And, you know, like all investment theses, sometimes it works, sometimes it doesn't, but I think their, like, fundamental world view to me was if you pick, or if a…”
Cacioppo: Build your startup's leadership team when you hit 20 employees
“If you are growing and you feel like your product market fit, start at 20, such that you don't You don't have to start later when everything is kind of even more chaotic.”
Cacioppo: Nothing good comes from the Forbes self-made women list
“Nothing good will come from that list.”
Cacioppo: Build what you want startup advice is a red herring
“I think the build something you want is a bit of a red herring. It works in some cases, but you're also very limited to your experience.”
Cacioppo: Imagine the future ideation fails in real-time
“I think there's a, the shut your eyes, imagine the future What's it look like? Build that. I think this makes sense in retrospect. I think in the moment, it's pretty hard to generate reasonable startup ideas during that.”
Cacioppo: Vanta's annual growth rate exceeds 60%
“Our growth rate's actually quickened the last couple of years and quarters and months, and so it bends up 60% annual plus for the last couple of years since that milestone.”
Cacioppo: Vanta's Highway 101 billboard drove hundreds of millions in market cap
“Arguably, you know, hundreds of millions of dollars in market cap attributed to that billboard.”
Cacioppo: SOC 2 and ISO 27001 overlap by roughly 60% to 65%
“I think our fish like mapping is like sixty-ish, 65%.”
Cacioppo: Companies can legally self-declare HIPAA compliance
“There's HIPAA, which is U.S. Law. You can just declare yourself compliant with HIPAA. Like, you get to decide.”
Cacioppo: Enterprise demand for CCPA and US privacy compliance is down
“We see, like, demand for, say, CCPA, which is a California private, like, California version of GDPR, quote unquote, go in waves, and right now it is definitely, I mean, all the American, you know, regulation is, is kind of at a, I don't know, total nadir, but…”
Cacioppo: Modernizing FedRAMP will increase divergence among compliance standards
“I don't think they will. I think you're just going to have even more divergence between these things. You're just like, less control overlap.”
Cacioppo: Vanta found PMF by prescribing SOC 2's ambiguous rules
“I think for a startup that's never done this, it is unhelpful, because it sort of opens up, you know, a maze in a way that's just not great, and that's why being prescriptive, like, is part of, I think, the, and Vanta's initial product market fit, I think it's…”
Cacioppo: GitHub answers 92% of security questionnaires through Vanta
“GitHub gets 92% of all of the questionnaires they receive answered through Vanta.”
Cacioppo: ISO 42001 leads AI compliance, but none have breakout product-market fit
“The pros are that European enterprises are the ones that care the most about AI, and this is where they would turn, and so it's the thing that has the most market traction so far. But like none of these are like breakout. None of them have product market fit.”
Cacioppo: Security trust centers function primarily as ticket deflection for GRC teams
“And so if nothing else, what they actually are, they're ticket deflection for the GRC team. Because when your sales team sends them out, and you're like, doesn't it look good? And then if you have any questions, you know, here you go.”
Cacioppo: Vanta Will Launch Agent-Generated UI in Summer 2026
“This summer.”
Cacioppo: Vanta sold 34 extra subscriptions from a $60K podcast ad
“He came to me and was like, I want to spend 60,000 dollars on this ad, and my deal with him was like, fine, but you got to sell four more Vantas, because the Vanta basically cost 15,000 dollars, and the next month he sold like 34 more Vantas because of the pod…”