Cacioppo: Vanta found PMF by prescribing SOC 2's ambiguous rules
Christina Cacioppo · Compliance at scale and why TAM is a distraction with Christina Cacioppo of Vanta · Mar 31, 2026 · at 23:26
Christina Cacioppo, founder and CEO of Vanta, explains the origin of Vanta's product-market fit to John Collison.
0:00 / 0:24exact quote · 24.7s
▶ Watch the full episode on YouTube → 720p mp4 · rendered on demand · StarZero watermark
“I think for a startup that's never done this, it is unhelpful, because it sort of opens up, you know, a maze in a way that's just not great, and that's why being prescriptive, like, is part of, I think, the, and Vanta's initial product market fit, I think it's actually largely due to that, in a way that that wasn't the plan, but I think it's like figuring out how to take that high-level guidance, bring it down in some places, In a way that actually makes sense.”
quote is from the automated transcript, cleaned for reading: filler sounds and stutters are removed, nothing is rephrased. names can be misheard (the analysis reads context, assessments check outside sources). how →
More from Christina Cacioppo
Cacioppo: Security companies targeting startups should sell compliance instead of security
“One of the original, like, founding hypotheses of the company is if you want to start a security company for startups, you should actually start a compliance company. Because your customers never ask you for Security, but they do ask you for compliance.”
Cacioppo: Current market size only predicts today's market, making TAM sizing misleading
“I think the second part is market sizing is bullshit. You know, you can, like, be as academic or whatever, strategery-ish as you want about it, and, like, the market size today is only a predictor of the market size today.”
Cacioppo: GDPR remains as vague for engineering implementation as ever
“The theory at the time was GDPR is written by lawyers at a very high level. You see, it's like not a spec you can handle an engineer, like comically kind of bad as an engineering spec, but like, it's fine. We will clarify that in court over the next 10 years, …”
Cacioppo: GRC teams will collapse into single-threaded owners managing AI
“What we're talking about now, and we haven't seen yet, but if I, like, had the future cast and guess, is we're going to see, actually, Those GRC teams collapse a bit more into these single threaded owners.”
Cacioppo: Outbound phone calls are currently working for sales
“Outbound phone calls are currently working.”
Cacioppo: Tying brand identity to a category standard backfires when competitors emerge
“In the early days, before we had competitors, we tried to basically make this call response of, like, someone says, talk to you, someone says Vanta. And this really close association, which in the early, again, when we were just competing against consultants. …”