The Ledger
Every statement that passed quotation and attribution checks. Mix any filter with any other: certainty 1/5, debate potential 5/5, or both at once.
why aren't all 22 resolved? a statement only gets an assessment when the public record can support or contradict it. opinions and what-ifs never can, and 1 checkable ones are still open, waiting for their date. predictions held up or didn't; assertions are supported or contradicted. on every card: ▮▮▮▮▮ certainty · ▮▮▮▮▮ debate potential. speakers are clickable
Cacioppo: Security companies targeting startups should sell compliance instead of security
“One of the original, like, founding hypotheses of the company is if you want to start a security company for startups, you should actually start a compliance company. Because your customers never ask you for Security, but they do ask you for compliance.”
Cacioppo: Current market size only predicts today's market, making TAM sizing misleading
“I think the second part is market sizing is bullshit. You know, you can, like, be as academic or whatever, strategery-ish as you want about it, and, like, the market size today is only a predictor of the market size today.”
Cacioppo: GDPR remains as vague for engineering implementation as ever
“The theory at the time was GDPR is written by lawyers at a very high level. You see, it's like not a spec you can handle an engineer, like comically kind of bad as an engineering spec, but like, it's fine. We will clarify that in court over the next 10 years, …”
Cacioppo: GRC teams will collapse into single-threaded owners managing AI
“What we're talking about now, and we haven't seen yet, but if I, like, had the future cast and guess, is we're going to see, actually, Those GRC teams collapse a bit more into these single threaded owners.”
Cacioppo: Outbound phone calls are currently working for sales
“Outbound phone calls are currently working.”
Cacioppo: Tying brand identity to a category standard backfires when competitors emerge
“In the early days, before we had competitors, we tried to basically make this call response of, like, someone says, talk to you, someone says Vanta. And this really close association, which in the early, again, when we were just competing against consultants. …”
Cacioppo: Vanta's annual growth rate exceeds 60%
“Our growth rate's actually quickened the last couple of years and quarters and months, and so it bends up 60% annual plus for the last couple of years since that milestone.”
Cacioppo: Vanta's Highway 101 billboard drove hundreds of millions in market cap
“Arguably, you know, hundreds of millions of dollars in market cap attributed to that billboard.”
Cacioppo: SOC 2 and ISO 27001 overlap by roughly 60% to 65%
“I think our fish like mapping is like sixty-ish, 65%.”
Cacioppo: Companies can legally self-declare HIPAA compliance
“There's HIPAA, which is U.S. Law. You can just declare yourself compliant with HIPAA. Like, you get to decide.”
Cacioppo: Enterprise demand for CCPA and US privacy compliance is down
“We see, like, demand for, say, CCPA, which is a California private, like, California version of GDPR, quote unquote, go in waves, and right now it is definitely, I mean, all the American, you know, regulation is, is kind of at a, I don't know, total nadir, but…”
Cacioppo: Modernizing FedRAMP will increase divergence among compliance standards
“I don't think they will. I think you're just going to have even more divergence between these things. You're just like, less control overlap.”
Cacioppo: Vanta found PMF by prescribing SOC 2's ambiguous rules
“I think for a startup that's never done this, it is unhelpful, because it sort of opens up, you know, a maze in a way that's just not great, and that's why being prescriptive, like, is part of, I think, the, and Vanta's initial product market fit, I think it's…”
Cacioppo: GitHub answers 92% of security questionnaires through Vanta
“GitHub gets 92% of all of the questionnaires they receive answered through Vanta.”
Cacioppo: ISO 42001 leads AI compliance, but none have breakout product-market fit
“The pros are that European enterprises are the ones that care the most about AI, and this is where they would turn, and so it's the thing that has the most market traction so far. But like none of these are like breakout. None of them have product market fit.”
Cacioppo: Security trust centers function primarily as ticket deflection for GRC teams
“And so if nothing else, what they actually are, they're ticket deflection for the GRC team. Because when your sales team sends them out, and you're like, doesn't it look good? And then if you have any questions, you know, here you go.”
Cacioppo: Vanta sold 34 extra subscriptions from a $60K podcast ad
“He came to me and was like, I want to spend 60,000 dollars on this ad, and my deal with him was like, fine, but you got to sell four more Vantas, because the Vanta basically cost 15,000 dollars, and the next month he sold like 34 more Vantas because of the pod…”