Invest Like the Best with Patrick O'Shaughnessy - Christina Cacioppo - Building the New Standard in Security – [Founder’s Field Guide, EP. 38]

Episode Date: June 17, 2021

My guest today is Christina Cacioppo, founder of Vanta, a security and compliance software business founded in 2017. In our conversation, Christina brings to life the idea of “finding a problem that exists and fixing it.” We dive into the experiences that led her to launch Vanta, the strategy she took to build, price, and distribute the product, and we touch on her lessons from running a growing organization. I always admire the drive that founders have when they set off to build something -- Christina fits that mold, and you will hear about how she embarked on a self-taught journey early in her career. I hope you enjoy my conversation with Christina.   For the full show notes, transcript, and links to mentioned content, check out the episode page here. -----   Founder's Field Guide is a property of Colossus, Inc. For more episodes of Founder's Field Guide, visit joincolossus.com/episodes.   Stay up to date on all our podcasts by signing up to Colossus Weekly, our quick dive every Sunday highlighting the top business and investing concepts from our podcasts and the best of what we read that week. Sign up here.   Follow us on Twitter: @patrick_oshag | @JoinColossus   Show Notes [00:02:44] - [First question] - How she first found her interest in business [00:04:09] - Early days exploring business for the first time [00:07:09] - Lessons learned from USV that have been applied to Vanta [00:07:42] - The next stage of her learning journey after USV [00:09:20] - Making a massive pivot in life and teaching herself to code [00:10:53] - The four-year road that lead to building Vanta [00:12:39] - First encounters with the software security problem space [00:15:21] - Origins of SOC 2, what it means, and what it does [00:17:11] - What software security means writ large [00:19:32] - Who demands a SOC 2 and why [00:20:57] - How Vanta improved a broken process and productized it [00:23:33] - What V1 of Vanta looked like [00:26:30] - Understanding the value of using spreadsheets first [00:27:48] - From static to streaming and finding product-market fit [00:29:22] - Monitoring whether or not a company is SOC 2 compliant in real-time [00:32:19] - Auditors that still exist in the compliance space today [00:33:39] - The pace of onboarding new clients onto the Vanta software  [00:34:53] - Figuring out a price point for the service Vanta offers [00:37:06] - Developing the business model and scaling it [00:39:18] - Lessons learned and innovations created about effective sales organization [00:41:52] - Hardest hills to climb in building Vanta [00:43:17] - Building competitive advantage into the framework of the business [00:46:07] - Overview of the frontier of software security [00:47:43] - General thoughts on competitive advantage as a whole [00:49:43] - Quality control of decision making in Vanta [00:50:40] - Downstream effects of structural and organizational business design [00:52:30] - Hard lessons learned going from being academic to pragmatic [00:53:36] - What the future could look like for Vanta based on its current trajectory [00:54:26] - What her information diet consists of lately  [00:55:27] - Areas she’s interested in currently but learning more than being proficient  [00:56:59] - Ways in which she’s become a better leader [00:57:46] - Unique factors about what makes Vanta tick [00:58:45] - Negative advice to would-be founders out there [01:00:22] - The kindest thing anyone has ever done for her [01:02:44] - Major insights learned from living in Rwanda, Thailand, and Uganda  

This episode of Founders Field Guide is sponsored by Clavio. Want to deliver marketing moments that last a lifetime, Clavio is the ultimate marketing platform for e-commerce. With targeted segmentation, email automation, SMS marketing, and more. Clavio helps you create your ideal customer experience. See why more than 50,000 brands, like Living Proof, Solo Stove, and Nomad, trust Clavio to grow their business. Keep your customers coming back.

Get a free trial at clavio.com slash founders. That's K-L-A-V-Y-O.com. slash Founders. This episode of Founders Field Guide is brought to you by 8Sleep. Eight Sleep's new Pod Pro cover is the easiest and fastest way to sleep at your perfect temperature. It pairs dynamic cooling and heating with biometric tracking to offer the most advanced solution on the market. Simply add the Pod Pro cover to your current mattress and start sleeping as cool as 55 degrees or as hot as 110 degrees. It also splits your bed in half so your partner can choose a totally different temperature. I was so impressed after using 8th Sleep.

that I became an investor. To embrace the future of sleep and get $150 off your new mattress, go to 8Sleep.com slash Patrick or use the code Patrick. Hello and welcome everyone. I'm Patrick O'Shaughnessy, and this is Founders Field Guide. Founders Field Guide is a series of conversations with founders, CEOs, and operators building great businesses. I believe we are all builders in our own way, and this series is dedicated to stories and lessons from builders of all types. Founders Field Guide is part of the Colossus family of podcasts, and you can access all of our podcasts, including edited transcripts, show notes, and resources to keep learning at join colossus.com. Patrick O'Shaughnessy is the CEO of O'Shaunacy Asset Management. All opinions expressed by Patrick

and podcast guests are solely their own opinions and do not reflect the opinion of O'Shaunacy Asset Management. This podcast is for informational purposes only and should not be relied upon as a basis for investment decisions. Clients of Oshonosi asset management may maintain positions and the securities discussed in this podcast. A guest today is Christina Kachopo, founder of Vanta, a security and compliance software business founded in 2017. In our conversation, Christina brings to life the idea of finding a problem that exists and fixing it. We dive into the experiences that led her to launch Vanta, the strategy she took to build, price, and distribute the product, and we touch on her lessons running a growing organization.

I always admire the drive that founders have when they set off to build something, Christina fits that mold. And you'll hear how she embarked on a self-taught journey early in her career. I hope you enjoy this great conversation with Christina Kachiovo. So, Christina, I think the most interesting place to begin our conversation is the background on your own interest in business writ large. How did you first decide that this was something you could be passionate about? and then I want to hear the formative experiences that led you to ultimately starting Banta. So it wasn't at all of foregone conclusion. Both of my parents were professors, academics,

who predominantly researchers love their research, have big labs, their social scientists. And so until I was probably 12 years old, I didn't really realize adults did different things with their lives. And then I kind of thought I would be a professor until I was about 21, 22. Well, a few things happened around then. One was during undergrad getting to travel a bit, and just seeing the impact of technology. Specifically, spent one early summer in Rwanda. It's so cliche now, but just seeing mobile phones and how they spread and the impact they had

and like the beginnings of mobile banking and realizing, oh, if I can walk through an ATM at Trusseter at Stanford, that's cool. But mobile banking when you're living in, you know, the second-tier city in Rwanda is just a totally different game changer. So some of it was that, and some of it was also just seeing the buildup on the internet and all of that.

And sort of realizing building on the internet is just our generation of railroads. And so if you want kind of the most like interesting, quickly changing, challenging thing you can find, go build on the internet. What was the first entree for you into this sphere professionally? What were you doing early on in your career? You did a lot of writing. It's really interesting when we first met me and my partner went back and read a lot of your early stuff just to get a sense for like your trajectory.

Talk us through the early days of exploring this field of business. Twofold. So one, actually, in undergrad, I spent one summer interning at Google. It was in what was then Cheryl Sandbergland, online sales and operations. It was basically doing support for Google news. And it was a really formative summer in lots of ways, mostly because I realized there were really interesting jobs at Google. And Google did really interesting things. And it was not at all the internship I had. And so that actually got me to go back to school and take a few more CS classes. Because again, I was just like I felt like I couldn't get the jobs I wanted, but actually seeing them up close. It was formative there. I think the other part, to my first job out of undergrad, was at Union Square Ventures in New York. And that was dumb luck. USB and classic USB fashion put up a blog post that said, hi, we had a great analyst, but he had to move cities. So we need someone else. If you're interested, send us links to your web presence. And I read that and thought it sounded crazy and who would actually get this job. But I I actually a deep secret not on LinkedIn.

I actually had a job. Then I was working as a management consultant. Did not like my job. Couldn't figure out if it was because I didn't like it or, you know, I was just being an angsty of new grad, whatever it was. But anyway, was sitting in a large, you know, corporate tower in New York City moving boxes on slides. And literally on the last day,

screw it. Like, this was not the life I thought I was promised. And sent USB four links. A nascent blog, Doppler, still my favorite web service. Twitter might have been it. I don't even think I sent them LinkedIn. And they emailed me and asked me to come in and chat with them.

And I was like totally gobs fact, but ended up in me spending two years at Union's Career Ventures. What do you take from that time most? That's an incredible group of investing partners there. I don't know what they were investing in at the time that you were there. But what were the lessons that somehow impacted how you've done things at Banta that you learned at USV? So I was there 2010 to 2012. this was the era of large networks of engaged users, as we called them.

I think I joined right before the four square investment, but that was an arc. And the other than this is New York, the company I still think of as 10 Gen, which is Mongo. So that arc of companies and a few things. So one is I really don't like top-down market sizing, which I think I got something from US fee. Because right, when you're like trying to top-down market size a check-in app to go find your friends in the East Village, you just can't do it. So you're thinking about that more from first principles from, is this a behavior that people will adopt? Who are these people? That sort of thing. So I think there's that piece from them. I also think, I haven't figured out how to work this on in Devanta yet, but sort of a

curiosity and openness to new business models. So I actually didn't know the word SaaS when I was there. And I think it's more a function of me than the firm certainly. Yeah, you can have a subscription, but like, is there a way to turn this into a marketplace? Is there a per transaction way to think about this? USV really, really liked non-standard business models because there's a lot of talk of like that's where a lot of the innovation can come from. And maybe it's technology that opens us up, but that's kind of one of the key parts of the innovation.

A deep appreciation for that from USV. What happened after USV? What was the next stage of your kind of learning journey? So I was somewhat confused about a year in because part of me really liked early stage venture. It was all the parts about being an academic that I thought I'd like. And kind of be a journalist, too. You could pay you to, like, run around and learn about new things and call people up and ask them questions.

And then they, like, come in and very politely answer all your questions. And it was, like, tremendous racket. So, part of it I really liked. The part I didn't like was I kind of felt like I was young and full of energy and just wanted to go do things and, right, go build on the railroads. Back to that analogy. Instead, I was learning a lot, but sort of sitting there learning a lot rather than doing. But, you know, U.S.T. Great firm, great people, great opportunity. But ultimately decided I just really wanted to be one of the people who came in and pitched rather than someone who is pitched to. I guess another part of it, I had just been really fortunate to basically spend two years straight meeting with different entrepreneurs, 10 of them a week every week for two years. I got to see all the different models of a founder. The similarities and differences aren't just how many different models there aren't, how dumb the sounds. But like how you don't have to look like or talk like Mark Zucker. or B Mark Zuckerberg to be very successful.

But I had one last hangup, which was I couldn't code. And I know lots of people start technology companies without being able to code, but I couldn't get over that. So for USC, I took my bonus from one year and just lived off it for stretched it over two years, taught myself to code, built a bunch of stuff, none of which you have heard of, anyone has heard of, but learned some amount of how to build products and just experimented with a bunch of different stuff. I love these kinds of periods in people's lives where it's completely at your own direction

and you're learning something probably pretty fast that the learning curve is probably pretty steep. What were you doing? What did you learn? How did you approach being self-taught in something like that? Give us the juicy details here. So I realized with myself, structure is helpful. And so I basically tricked myself into thinking I had a job. Chris Dixon actually was in New York at the time.

New York City entrepreneur well known and he was sort of really good at taking in young entrepreneurs. And so he had recently sold his company, hunched to eBay, had this huge office in in New York, eBay, New York, that's a flagship. And I emailed him and was like, hey, can I have a desk? And he's like, sure, come on over. Actually, eBay happened to be almost literally across the street with USV. So I, like, tried not to change things. I, like, woke up, but got dressed. I, like, walked to work. Just walked like across the street to eBay. I sat in one of the eBay, New York desks with the hunches, eBay's software engineering team. They did their work. I did mine. mine was like starting with how to make a blog tutorial that Steve Hussman of Reddit fame had online.

And I like made this blog. And then I was like, okay, now I actually want a book website. So then I started like changing rather than writing blog posts, putting books on shelves. There's probably like six, seven months where I just sat there and did that. And it was great. And the hunch engineers, hunchy bay engineers were like so kind and friendly. And they would tease me when I wouldn't come in one day. You know, where were you yesterday?

And you're like, I don't have a job. But it was just the rules kept going for pretty long. And that was just extraordinarily helpful. So then what's the next step from that experience? Now we can get to sort of the founding origins of Vanta. How did you go from? There were four years in between. Describe that four year, what happened in those four years,

but now we can start to really tie this to what you're doing now. So one of those punchy Bay engineers sort of knew from undergrad, we spent more time together. We both decided we kind of wanted to try to start a startup. We didn't know what we wanted to do the startup around, but we wanted to see if we liked working together. So we figured we would work on a side project. Our side project was a, can't say it's straight face, was an owl themed video messaging app, 2013. And like, why wouldn't you do that? This is going to be like a month-long project, see if we liked each other, like move on.

Nine months later, I think we both woke up and we're like, why are we making this? We actually do like working together, but what are we doing with our lives? That was an interesting arc, the owl era. This person actually now works at Fanta. It's our head of engineering, so full circle, but there were a lot of owls initially. There was the owl era that ended up joining Dropbox. And I was sort of frustrated with myself and was like left to go start something. And then I ended up on this owl detour, but I want to go do the real thing.

So I spent another year or so, a little less, working on different ways to make software engineering easier to learn. Made some stuff that I think is sort of interesting. Also, realized through that what I was working on was definitely not a business. So I ended up also joining Dropbox. It was actually the first time I had worked at a real company. And so learned a lot of just like what is a company and what does a marketing person do? And what does cross-functional alignment mean? And joking, but not.

It was really kind of my first real job in a lot of ways. Okay, now we can get to the first encounter with the problem that Vanta now solves for its customers. This is one of those businesses that when I first encountered it, I love these sorts of things. It's like this deep intractable problem that more and more companies have. Talk about not wanting to top-down size of market. How did you come across software security as something that was interesting, a problem space that you were willing to spend your life and career in? What was the first encounter? Yeah. So there are two meaningful encounters.

So first one at Dropbox. So I was working on Dropbox paper, sort of Dropbox's version of Google Doc, like a real-time collaborative editor. the product and tech came in through an acquisition, which means it was totally separate than the rest of Dropbox. We as like a six, seven person team, thought this was the best thing in the world because we weren't slowed down by the monoliths that was Dropbox in year 10 of its life.

It was all great until we started kind of trying to launch it. And it wasn't even like launch with fanfare and PR. We just wanted users. It basically pulled every string of getting someone's partner or a roommate or college friend or trying to use the product. But we really weren't having a ton of success with the initial users.

I guess how you can tell, I'd never worked at a company before. I went to the account management team and it was just like, hey, account managers, can you give this away to your customers? And the account managers were like, game on. Like, I call people up all day and ask them for more money.

I would love to send them something new. So we had this, like, great thing going over lunch, basically, until legal realized what I was doing. And they were like, hello, do you know what I contract? is. I was sort of like, no. A piece of paper? Like, what's going on? And they were very polite and very good at doing their jobs, to be clear. But basically, you know, came and we're like, look, the Dropbox contracts say Dropbox products are secure and compliant and pen tested and this, that, and the other. And you've got a nice prototype over there, like kind of a science experiment that is, in fact, none of these things. So you either need to meet the bar that we've established or you can't talk to anyone who pays for Dropbox. then you're like, oh, okay, well, what's this bar? What are these things? And you go and you learn about what to talk to is or HIPAA and you learn just what a pain is. And like we kind of cost it at

really high level and we're like, okay, we could pause product development for a year, a year and a half, go get these things and then come back and try to find product market fit, basically. Or we can just not do this stuff, go find our own users. And that's ultimately the path we took. But I think there's just this moment of, wait, wait, wait, we're Dropbox. And we're like, Dropbox at the height of Dropbox's power. How does this take us a year and a half? Like, how are we so blocked by this? So give us the background just because a lot of people won't be familiar. It will focus on SOC2 to start. What is that? What are the origins of SOC2? What does it mean? What does it do? What does it do? Why was it so hard to get? Let's do a deep dive here.

Yeah, yeah. It's actually now an initialism. It doesn't stand for anything. Really? Of course. Just to make it more confusing. You used to stand for stuff than we, I guess, decided not. Origins are with accountants. So it's a standard controlled by the American Institute of CPAs, and it started with the computerization of a lot of financial systems. Basically, your accountants will come in and check your books and if you've kind of done followed accounting rules. That's happened for a long time. That's grand. Then maybe 90s or so, they started coming in as, again, as there was like digitization and just software for some of this.

Are your accounting rules being followed and your financial controls being followed in the software you're using? and that was a SOC 1. And it was, again, all accounting rules implemented in software. There's been a few iterations, but kind of mid-2000s, I think. Honestly, I think it was Tam expansion by the accounts where they were like, look, we're checking for accounting rules and software. Why don't we check for other rules in software? And so then they started checking for security controls,

but are basically just commitments in software, and they started doing those audits. They called it SOC2, I think. Sort of like a Java and JavaScript thing. Like they're not actually that related. we're just Tam expanding and like using the recognizable name to go to the second one. It was a really successful Tam expansion, honestly, because the accountants would come in then and they're like, look, we're going to do the financial stuff, the SOC one thing, and then we'll, you know, tack on this SOC2 piece, this technical piece. And so it just became a bit of a de facto

standard for when you get the one thing that you get, you'll get the second one. And so it's sort of that I think started the snowball rolling of people knowing that this was the standard that they needed to guess. Let's rewind time and say I got a SOC2. What is it? Certification. Is that the right word? So some effectively like auditor came in, tested my software for some set of things. I want to know what those things are. And I passed or I didn't. And then that certification bought me something. So let's talk through each of those. Like first, what literally were they testing for? Like what does security in software mean? That's kind of a big question. Step one was historically was if you're a company and you wanted a SOC2. You would call up a consultant. The consultant would ask you questions about what sorts of

security things you did, like how you secured customer data, how you talked about employees who had access to what systems. If you had cloud infrastructure, an AWS account, how you set that up, they would ask you what you wanted to do. And then they would come back and basically give you a list of 100 controls and compliance fee or just security rules that you should follow. So every employee has two-factor on their email. All data is encrypted at rest. Stuff like that. You just have a hundred of these things. And yeah, step one was choose your own adventure, make your own list. And again, there's some light guidance on what those things should be, but it's very light. But then you have this list of rules. Okay, then the consultant says, hey, go make sure these are all in

place. And when you're good, call in your auditor. And your auditor is a CPA. Like, it is an accountant. So strange. Yes. There's CPAs that sort of specialize in there. And but fundamentally they are accountants. That's the bulk of their professional education. So you get the outcomes you might imagine from that. So anyway, so the company goes and scurries around and does all the things they said they would. And then the auditor comes in and they basically say,

okay, you say you have two-factor on everybody's email account. Prove it to me. You'll be like, oh, okay, let me pull up my admin dashboard of G-suite or Office 365 or whatever it is. Show them the employee list and you'll show them all the checkmarks next to MFA in the column. And they'll say, well, that looks good, but how do I know that's the full employee list? And you say, ah, one moment.

And then you like pull up your payroll system and you get your list of employees. And then the accountant is like, okay, this person, this person, this person. And then they're like, ah, but you got the intern Sally. You know, shoot, the intern Sally, you know. And I'm joking, but that, this is kind of the thing. And it takes two weeks of like someone sitting there and like comparing lists. Yeah, you just look at that as like someone even adjacent to software. And you just like, what are we doing?

And so literally that process. would and maybe in some, a lot of cases still does, can take a year for a new product with big enterprise clients. So now let's talk about the other side. So who demands a sock to? Like this is become, so it's become a standard. Why do you go through this? It sounds fun. But like, why do you? But you do it for a good reason. Like you want to sell to somebody. So talk us through that side of the marketplace, I guess I'll call it. Who demands this and why? And how did that come to be? Yeah. So again, so this isn't a legal standard at all. Like no laws. It's actually a really interesting example of like how.

this became a de facto standard just like in the industry. So who demands it tend to be, I mean, it used to be really big companies, but it was basically people who bought software. And some part of buying software and procurement is doing risk assessment or a security analysis. And so you're a company buying software. You're probably buying a lot of software. And so you have a team internally that's basically like, is this a good vendor? If we give them a bunch of data, will they leak it on the internet? Or like, can we trust them? Soc2 has become the shorthand. answer to that. Are they trustworthy? And I think it's like, well, do they have a SOC2? And I think it's a little bit of what SOC2 test for, but also, honestly, a lot of organizational maturity. They had the

organizational maturity to deal with the consultants and deal with the auditor and convince everybody they're reasonable. And so they're probably less likely to be do with this is. But yeah, it's all commercial pressure, all from the buyers. Incredible that it's almost like heuristic has become such a key step for being able to sell software and big contracts. So you face this situation at Dropbox and you made the decision to not hit pause for a year. So it materially kind of affected a product trajectory. So then when you started Vanta, how did you think about attacking this problem to take something? I think of Josh Wolf's What Sucks question? Like clearly this process sucked or sucks to do this manual static once per X period of time, deep audit. How did you think about product

something that would make that a lot better. What were the early first steps? Yeah, yeah, actually backing up one moment. There's a second key moment around why Vantor, where I started this company, which was to left Dropbox late 2016 and early 2017, and to take you back there, this was like 2016 election, everybody had emails everywhere.

Equifax had just happened. Uber had just left a bunch of data open on the internet, the NS3 bucket. And we're sort of looking around and going like, hey, everyone says, like, if you want to think about macro trends to go bet on, more security sounds like a great one, or internet security seems like a great one, but then you look around and see, like, we're not very good at internet security. And there's definitely difficult things, but these breaches seem to happen for, well, you left the front door open, you left the storage

bucket open, and like, yeah, somebody came and found it. What do you kind of expect? And so how do you reconcile that? Everyone says security on the internet's really important. There's more and more effort around it sort of, but also we get breached for these reasons that don't seem that hard what's going on. And so just started talking to people about it and sort of realized two things. One, I mean, a lot of this stuff is hard because, I'm trying to use the tortured analogy, but like you have thousands of front doors that you can leave open. And so closing all of them is actually the hard part, even though anyone looks sort of trivial. And the second part was just prioritization. A business, especially one that is growing or wants to grow will prioritize things that let it grow.

And stopping and being like, one moment, can I check door number 4,000 is just hard to prioritize and kind of doesn't get done until, to your point, you're trying to sell to someone bigger. You're trying to like move up market, expand your market, grow more. And someone says, hey, you need this sock two thing in order to do that. Then you're going to go back and do everything really quickly. The joke about Vanta, that's not really a joke, is it's a security company masquerading as a compliance company. But it was just because we saw compliance with such a powerful behavior motivator for businesses that wanted to grow. Okay. So now there's a potential to do one of my favorite things, which is take this manual person heavy pen and paper static process and turn it into a digital software-based streaming process.

how did you attack that problem? There's probably lots of ways that you consider doing that and starting this thing. So how did you deliberate how to start this thing? What did V1 look like? So big problems. I sort of mentioned this. The old Prevanta, the way you got one of these things was step one, talk to a consult, look deep inside your full, like figure out the hundred things you should do. And one, that's just a lot of overhead and a lot of learning, especially for a like hairy CTO who's trying to do 14 other things. And the second, if you're thinking about building software against it, building software against a moving list that's different for every company. It's not super easy. Truly, actually, the first thing we tried to do was standardized the list.

And it was like, honestly, some amount of naivete. When we talked to people who are in the industry, they're like, can't do that. And then we're pushed on it somewhat in naivete and somewhat out of just being product people and software engineers. And we're like, the way, again, Dropbox protects customer data be all that different than the way segment protects customer data. No, there's just best practices here. And everyone should just be. reasonable. So our very first version was a spreadsheet of, here's the SOC2 standard, really high level. Here's what we think you need to do. And here's how far away you are from doing it. We did this for a friend's company and really just trying to test. One, could we make the spreadsheet? Two, did they believe our spreadsheet. So we did this for one company. It's actually segment. We walked in, didn't charge them for it because we didn't really know what they're doing. And I think they let us do it because they knew us and we're like, well, you're smart people who will work hard. We're not quite sure why you're working on the shock two thing. But sure.

it might be useful. But anyway, so we made crazy color-coded spreadsheet, whatever, gave it to them. I actually seemed moderately pleased with it. Then we went to another friend's company. We went to front. And the trick there was like, okay, we're going to try to use our old spreadsheet, but just to get the segment pieces and put it in the front pieces and see if they actually match, right? Like, can we standardize? So we did that. It was much faster. It took three days, not 15, basically. Front seemed to like it reasonably much. And then at that point, actually, we got an email from someone at Dropbox, basically saying, we should probably get a drink.

Seems like you've become Stock 2 consultant's super weird life choice. Anyway, so worried about you. Also, can you do this for my startup? But like, seriously, maybe I should have an intervention after you do the work for me, which actually seemed like, oh, this is great. Or is that where you're like people think we're nuts, but you actually want the thing, like game on. Yeah.

I really think it's a proceeding according to plan. This is actually also a USB thing. Like when people think you're nuts, you're actually on. track. Exactly. You are on the right track. What is the check-in of SaaS apps, but compliant software? So actually, at that point, we're like, oh, we're not going to go give this person a spreadsheet

where we are going to go start writing code to try to turn our spreadsheet in the software. I guess first question would be what the most valuable things were about using spreadsheets first. We've talked about this a lot before, where the value of just understanding what you're doing in sort of a manual, using existing tools way, is a really smart way to build product. Just say a little bit more about why you think that's so valuable and others might want to do that same thing. Spreadsheets are really easy to change.

Encode, I mean, it's changeable, but it takes much longer to change. So that's like just you just have infinity flexibility relatively with spreadsheets. We didn't know what we should check for. And so you're just like add rows, delete rows, move them around, whatever. Whereas when you're doing that in code, you're like talking about data models, when you're talking about migrations and moving things around.

And again, it's all, you can change anything in software. It's not that it just takes so much longer. And so in the early stages, when you sort of don't know what you're doing and that's fine, I think you just want to index on like infinity flexibility. I think there's also a user expectations piece. So if you can, again, color code a spreadsheet and try to make it look pretty. But people's expectations are pretty low spreadsheet. Whereas if you start showing them things in a web browser, you start getting, oh, that's an ugly font.

Oh, the spacing is off. And like, yeah, the spacing is off and it's ugly. But you're like, no, no, no, don't pay attention. What do you actually think of the content? And it's just harder to pull those things apart for someone. Okay. I'm totally fascinated by how something then gets into software, especially in your case because it's something around security.

So like people are going to hold you to a very high standard, given that you're doing something for them, which is so sensitive. How do you sort of ham and egg it to make sure that you're getting customers, the product's good enough, and it's in software, and what does software mean? Maybe now we can talk about this static to streaming concept. Okay, so first version of Vanga was hired a simple, like, two-field form to put in your AWS credentials.

We will scan your, it's the word for it. You'll, like, look at the configuration in your AWS account and then generate a report. It was sort of like generating our spreadsheet, basically. And so we're like, oh, yeah, just put in the credentials. And, you know, the software's a little slow. So we'll send you the report tomorrow. Meanwhile, behind the scenes, there was not much software. So we would get the credentials.

We would go look at the AWS configuration, flat out all the information. And then I would go through and read the big data blob and, like, write the reports. That was the V1 of software. And then, you know, send it to people and be like, oh, sorry, yeah, yeah. You know, we're just a little slow, but here's your thing. And they mostly believe this lesson didn't, I think, think too hard. It's just like two people on a couch what's going on over there. But then the next year or so is actually, you know, taking the, here's this configuration information from AWS.

How do you actually filter it all the way through into like a report and the tests and all of that? But yeah, the first version is just totally manual. Talk through the static and streaming idea. So is it fair to think about that original spreadsheet? Let's just for argument's sake, say there's 100 items on that spreadsheet. The exercise then is basically trying to take the end thing that's in the spreadsheet cell and, map it back to the thing that determines its source programmatically. Like, are you just doing that sort of one by one?

And therefore, like, once you have those hooks built, you can sort of tell someone any day automatically if they're stuck to compliant versus like having some human go through and compare Sally's intern account to your database. The static piece, like, again, the way joking but not, when you have someone in there looking at Sally's intern account and all this, it's a very point in time. It's what's the state of the world when I walked into your office. And there is a continuous. sort of continuous, SOC2, that was type 2. But continuous means, hey, I'm going to just come in a few

times. I'm going to come in today. I'm going to come in next Tuesday. I'm going to come in next month. And if you like survive my spot checks, I'm going to say you're continuous, which again, when you look at the software perspective, you're like, that's still point in time. It's just three points in time. The core of Vanta, we call tests. And this actually becomes something of an industry standard. Tests are not a SOC2 concept. They're a Vanta concept. And the idea of a test is, okay, you have this statement, everybody is two-factor on their email. And then Vanta wrote a test that says, okay, here's my employees, here's all the two-factor information. Does everybody have two-factor? Yes, no. And that is just the core of our software and what we do. And again, it was kind of

applying the software engineering mindset to the compliance thing world where you're like, you are testing whether these statements are true. And again, because it's software, we just run our tests all the time, hundreds of times a day, which is not something a person has to, you know, go into the office and check or like even like pull up a dashboard and check, going to get tired. They're going to go on vacation. They're not going to do this every day. But our code just doesn't get tired. And so kind of your streaming point where we're just like constantly getting information about configuring and constantly checking it and surfacing what's kind of set up correctly and what's set up incorrectly all the time. The way to think about it might be, I love the idea,

that code doesn't get tired. A company is effectively giving you access to the system, the internal systems that they would give to a SOC2 auditor in order to check their compliance, and VANTA via software is able to do this constantly and programmatically. That's kind of the simple. We'll talk about, you know, the things that might happen in the future soon here, but in a simple sense, that's what you do for customers. Yep. It's kind of twofold.

And again, we didn't, like, now we can have articulate this a few years in. Step one was just standardizing the list of stuff, add and remove stuff on the edges, but 80-20. And then step two is like, yeah, how. is everything looking? And so to a customer, you're getting, engineering customer, particularly you're getting like monitoring and alerting, how are things, what's off, how should I fix it, etc. To an auditor, you're getting evidence. You're getting proof that such and such was in place over whatever time period you want. Who's left? Are you replacing

auditors? Are there still auditors? How much faster does this go as one versus the other pre-post Vanta? Like, what could I expect? If you were back at Dropbox in the story you told us and Vanta existed somehow externally, what would your experience have been? So much faster, and again, it's sort of a fewfold. One is just reducing the complexity of what do you need to do. Again, making that standardized and much easier to understand. It sort of gets at the Joel supposedly commoditize the complement stuff, but just like if you can make stuff simpler, you are just dropping time costs, the actual cost.

So there's that piece of it. There is from the monitoring piece. So a big part of compliance projects in a pre-Vanta world are just people running around and saying, is stuff in good shape today or the auditor's coming in next week. I need to do an audit myself before the auditor comes in so I make sure everything's okay. And so there's just so much work about work with it. Because when you think about one of these projects, there's talked about the engineering pieces, but there's HR pieces, there's legal pieces, there's IT stuff. It's actually pretty broad. So there's a huge cat hurting component. So you don't go in to the auditor doesn't come in and

finds unfortunate things. And then there's what used to be screenshots, right? The, oh, the auditor is screen time from this system, screen time from this system, manually like, diffing them in their heads, all of that time can go away too. What, for let's just say it's a greenfield customer, something I'm looking at for a couple businesses I'm involved with is getting stocked to compliance. So from a cold start, like if I came to Vanta, how quick does that process go? Assuming like some maturity of our systems and we're not just pure fledgling, like what does that feel like? We've had two person companies like proverbial, two founders on a couch, knock it out in basically a week. Bigger companies often, right,

because there are multiple owners. Someone owns this piece versus that piece. There's, again, the coordination. Probably a median customer, if they're motivated two months or so, like, it's quite fast. Is there a downside to that that you've experienced? Like, sometimes there's this, like, too good to be true. It used to take me a year and a half. Now it takes me a week, like, skepticism that it's real. Oh, we definitely get the skepticism. Yeah, yeah. And it's actually deeper from folks who've gone through one of these audits because they're like, no, no, no, I did the 18-month version. Like, what are you talking about? Very long dants of, but actually think it just speaks to like broader the trends we ride or just like dashboards are really powerful.

Information is really powerful. Just having a streaming up-to-date sense of where you are and then putting that in front of motivated employees, stuff gets done way faster. So actually, I think it's much more at in a lot of ways. So now we've gotten this really cool backstory and sort of the core idea of what the product does. Now I'd love to talk a little bit about how you've built a business around this concept. So the first thing I always like to tackle is, all right, you've got something that's a clearly much better solution than the incumbent solution. And it's like a painkiller, not vitamin. Like it's something people have to do if they want to sell to bigger companies. How did you first roll out what I'll call like sales and pricing? Like, how did you figure out what to charge people,

how to charge them, how to sell to them? Like, this is always trial and error. It seems like how did you learn here? Vanta still prices this way, so good and bad. Okay, so late 2017, so we had the Wizard of Oz website, basically, so generously, a lot scurrying in the background. So sent this to about 10 friends where had companies and had them use it, give them a little bit of like, oh, okay, here's how we'll get your information, here's your Vanta dashboard, right? Here's what you can do with it internally, externally, when you're selling, whatever. Let them, got to poke to them a little bit for a week or two, and then called everyone back up one by one and got them on the phone and, like, ran through this semi-structured survey, which was basically like, so what did I give you? What is Vanta?

You tell me, was it useful? Why? What is it? And then monetizing innovation book, which actually really like, what is it an expensive, a reasonable price, an expensive price, and a prohibitively expensive price to pay for this thing that I gave you? Ask 10 people this, and sat back. And it was actually pretty pretty. impressive where one, people actually explain Vanta to me the way I kind of thought they would. And this was actually something of a light bulb moment. I distinctly remember that feeling to the earlier conversations, spent years building things no one wanted, literally years. And so to like give something to someone and had them have been like, oh, it's all the words you want me to

say back. Wait, had that happen, you know? And then basically centered on this price of, these are all baby startups, but like kind of $10,000 was like roughly what people told me. Definitely it dropped the phone moment in there. You're like, wait, wait, this is like the jankiest website. What do you mean? It's worth five figures. But that was the basis of our pricing for kind of up until today. Once you establish that and you obviously it starts to work, people start paying you five figures or whatever to do this check for them. How did you think through, and this is an ongoing question, I'm sure, the business model. So there's, I'm sure auditors got paid like they came in and did. the check, they got paid, maybe they came in again next year. How do you approach business model

innovation thinking back to your USV days again here in terms of one-time costs, recurring revenue, SaaS, usage? How do you think about all this stuff? One question we often get is like, hey, it's in this one-time thing and have you just glued a SaaS model on top of it? Because that's what the cool kids do in the early 2020s, late 2010s. And I usually don't think that is. And I don't think that is because, to your point, the historic way to do this with auditors, and they charge you annually. And it's not subscription revenue, but they like have you signed kind of three-year contracts. And so we came in with a subscription, but again, it wasn't totally unnatural with it. And that sort of pillars are one, yes, you want to get ready for your SOC2 initially or whatever compliance audit.

And then two, just the continuous monitoring. And there is just value to having something going and checking. Have you kept all your doors and windows locked at all times? So that is still where we are today, and our pricing is tremendously unsavvy. Somewhat of a point of pride, but also just kind of an embarrassment at this point. It's been interesting to watch the industry standardized around some of our pricing, and it's just one of those good reminders. It is easier to create the world you want than it ever seems. It's just a universal law that pricing should look like this. And you're like, no, I called five friends in 2017 and like, here everyone is. There's just so much like the butterfly flapped its wings and all of this. But anyway, I think that's like a helpful reminder.

I try to remind people advantage of that of just like we can change all these things for good and bad. But in terms of the future business model innovation, there's some stuff we're playing with. I'm actually really excited about this. I think there's sort of the obvious SaaS stuff of, well, why don't we have pricing scale somehow with company size in a sort of autopilot way? Per user, some sort of metered billings. I think that broadly is probably where SaaS pricing is going. And so there's definitely stuff there. But I also think, There's some other kind of more interesting things we can do, too. So we talked a bit about pricing.

I want to come back to the roadmap and the future. But first, I'd love to hear what you've learned about effective sales organization. So you're selling this thing. You're marketing it too, but you are selling it. What practices have you adopted successfully or unsuccessfully? And what innovations do you think you've created, given that what you're doing is fairly unique? One model I have generally is actually the go-to-market side of a company is much more

like engineering. Now in software engineering, I mean like industrial engineering. You have a system, it has inputs, there's transformations, there's conversions, you have outputs, and you can measure and optimize all of that. That is my model for the go-to-market side of a company. I think the actual engineering side, like the end of product design side, that is much more like art. If you try to turn that into a system with inputs and outputs, it doesn't work. So what I think about sales, I do think about it as sort of a system of, again, you have like leads come in, right? There's conversions of different stages, and then you have customers that go out. And so then you're just, how can you track and measure and understand differences at each stage and do that?

That's my broad framework for sales. I think more specifically, so I sold the first few hundred thousand dollars worth of Vantas have been far outstripped by many, many salespeople at Vanta at this point. For good and bad, I sell like a product manager. Hey, I made this thing. What do you think of it? Is it a need? Can I ask you all these questions about how you think about the world?

So I end up actually being like really strong what people call qualification, what I would call need finding. But it comes out of like a product manager's desire to understand them. I can sometimes get way too far in the weeds of that. You know, I look at the other part and be like, oh, I have another shiny thing to show you. And someone's like, no, I just want a contract. Right, right. Sorry. Yeah, that's where we're talking. So that's kind of funny. But I think there was a part of that, especially in the very early days, because we sold and sell to CTOs.

And so there was just a part of credibly being able to talk about things. answering the really minute questions. And one early customer sort of described us as this babblefish between engineering and compliance, which I actually really liked, because it's, when we think about our users, they're engineers who smart, motivated, capable, can learn all the things, but also we're just doing 97 other things at once. Do they want to go learn all the nuances of compliance? Absolutely not. They just want to get the thing done. And so to the extent in Banta can be that translation layer between them. It's actually a really powerful and really helpful place to be. We can speak compliance to one audience and we speak engineering to another.

A really interesting business model idea that like helping two parts of other companies communicate better is an incredible unlock. I won't forget that one. If you think back on the history so far, what was the biggest nightmare to build? Not necessarily build, but just like accomplished. Like what was the hardest hill to take? Yeah, I think, I mean, we're still. working through this. But a SOC2 covers so much, again, from who's hired at a company, what role do they have, what access to systems should they have, how is our AWS account set up, what does employee laptops look like? Like, there's just so much stuff. There's a part of this that was very compelling to me initially, because I'm a bit of a shiny objects person. I love learning

about new things. And one of the things, one of the USD partners, Brad, actually told me as I was leaving. Let's see it's like, look, go off and do what you're going to do and you're going to be great and all these good words. But also, you, Christina, are going to struggle with just choosing one thing because you like so many things, which is actually deeply true. Anyway, I'll say say, SOC2 and compliance has a bunch of different things to go think about, which is fun.

But there is just so much stuff. There's so much stuff to build. There's so much stuff to maintain. We have so much product surface area. And it's because the kind of lasso around it all is compliance. It's not actual tool category. We are several tools bungled into one. And so there's just a lot of stuff and a lot of complexity there.

It's interesting, though, that if anything, that's probably a good thing from a competitive standpoint. So I'd love to hear now how you think about building competitive advantage into the business as you grow and make the product better at the same time. There's other Saktu software companies. Now you're a pioneer, but there's other people that I can go to and bid this work out to or something. And so if you're going to be a super successful business long term, you want some growing compounding advantage.

How do you think about that and how do you deliberately build one? Twofold that I'll share out. And it's like a constant conversation internally of Santa, as you might imagine. One is actually the commoditization piece. So just like can we drop the costs of getting a sock to generally? Do you think we have? Maybe slightly less a dollar costs, but very much the time and effort costs, a mental overhead piece. And so this is standardizing, standardizing what a sock two is, how you prove it, what these pieces are.

This helps us also, I think, makes it easier for some competitors to build on. But I think actually the important part, it is a Vanta standard way. And other people can totally use that. Who is defining what the industry means, that's Fanta, because that's what we've always done. Back to the early days, here's a very rigid list of things to do. And so there's some amount of, like the Wizards of the Coast example always gets used here. but right, they like standardized some of the game design pieces, and there was like a lot more game design.

What's that at Wizards of the Coast thing? Okay, Wizards of the Coast is the company behind Magic the Gathering. They have a game with like eight-sided die, where they like sort of like open source the game design here. And so there's like lots of people made games with eight-sided die, but theirs was actually always the most popular. And so it was rising tide lists all boats, more people know how to play their game.

And so it probably actually disproportionately helped them, even though it also created, lowered the barriers to entry in a way. But they were like, it's a really interesting answer. Do you think there's a fair analogy here to something like a ratings agency? I'm trying to think of other standard bearers or like an index provider in investing, like S&P or Russell or something like this. Do you think there's some analogy there to pull on?

Yeah, very much so. And people talk about these are all little colored, people talk with like the Better Business Bureau and those ratings or like credit ratings for consumers, FICO scores, Moody's bond ratings. And in some ways, I think this is broadly similar to what the purpose of SOC2 serves. Do we think Moody's is the most rigorous thing in the entire world? No. Is it tremendously useful?

And do lots of people rely on it? Yes. It's a rough heuristic. I think what we're trying to do is just a more nuanced version of that. Of are you baseline reasonably secure? Baseline have the organizational muscle to go through one of these intense audit processes that you can get from a SOC2. But what is the company's security actually like? Is it in place continuously?

It's much more something we're trying to move towards. What would surprise people about software security, generally speaking? So you've talked about the difference between compliance and actual security. Ultimately, you're not the one liable for a company's security. They are. You're a really key piece of the messaging to the marketplace, just like Moody's now responsible for a default. What should we know about software security?

Like, what's the cutting edge here? What does the frontier look like? A lot of what makes it into headlines are like, you know, a nation state is attacking somebody. Most companies, their problem is not, you know, a nation state wants to attack them. Most companies, their problem is they can't sell their product. So this was like from a security perspective, why you kind of actually you go in through a wedge of compliance. Again, the problem's not China wants you. Problems no one wants you. So if you can help this. The other part two is for most companies, they're not doing the basics. And again, so it's twofold.

One, there's like lots of basics. And two, there's just lots of stuff going on at a company. So actually also in the very early days of Vanta, one of the very first tests we wrote, like checks we started doing, was does everybody in the company have two factor on their email? And there were about 10 companies we did this for initially. Nine out of them told us they had two factor on everybody's email account. Two out of ten actually did. And when you go look at the lists, seven in the middle, oh, it's everyone but the founders. It's everyone but the office manager. They're almost there, but this stuff is just hard. And so much is going on. And so, It's so easy to have things slip through the cracks. And so a lot of security broadly, right, you're only as strong as your weakest link. And so there is just, even if some of this stuff just sounds dead simple and like kind of trivial, I actually do think there's a ton of value in helping people shore it up. What do you think just generally about competitive advantage? You started your career at an investing company.

So I'm sure you thought about this endlessly. I see a wall of books behind us that people won't be able to see. What are your thoughts on building competitive advantage just for real? large. The obvious statement of like you have to, be a less obvious statement of you have to keep trying things. And it is not always what you think will be the competitive advantage that ends up being the competitive advantage. Maybe to try to say it differently, I think it's actually kind of hard often to predict up front what some of this will be. And so you just have to try a few things. And you might be surprised by what works. But I think that actually just puts pressure on like

iteration speed more than whiteboard sessions in some way. trying to be overly academic about this is not. I think that what at USVIA passed to success here again, it's a little too reductive, but it's like attackathons. It's just trying things. What are real people actually going to use, which is always hard? Trying to reason about the network effects, which is really hard. I think even 10, well, I guess 15, 20 years into like large networks of engage users

and a networked internet, we're still not very good at that. And so it is just hard to wipeboard out. Why are we not good at that, do you think? I think probably because on an internet scale, it is just so different than real life. And so we don't actually have a lot of practice thinking about it. Some people talk about it's also hard to sort of actually reason about what exponential growth is because you don't often see that. But I think similarly, actually, the patterns and like the differences of interactions between different users on a service in different ways or like buyers and sellers is just so much going on there. there's so much complexity. It's really hard to reason about. And yet, there's just not real-world

analogies at the same scale. Because the internet is just like the giant Monte Carlo simulation. And it's just running so much that like everything along the perspective actually happens. Whereas in real life, the low probability things don't happen very much. As Vantas now become a fairly large company, a lot of revenue, a lot of customers, what do you do to make sure the decision, the average quality of decisions being made inside the business, stay high. You don't get to make most of them anymore. How do you quality control decision making? Culture. And one of our values, and actually recently did something about poll internally, our most popular value is our

most controversial one, which is framework thinking, which is basically like have a framework for your decisions and articulate it. And we're actually not prescriptive about which framework you use, but we are prescriptive and that you have one and it's articulated. And I think that mostly just has the effect of making the decision maker stop. And even if they're like, look, I know the answer is, you have a llama on the homepage, it still makes them stop and write down why that is the right answer and that forces them to think through it.

And so that I think is actually one of our better tools for that. I'm forgetting the name of the law, but there's that interesting law for software where the product will sort of map to how information flows through the organization. But like you ship your org chart? Yeah, you ship your art chart. Do you think about that? How do you structure the business and what's worked there? I do think about it because we've done it.

And it's always very well-intentioned. I think actually it speaks to like the power of incentives and the power of structure and actually how much organizational design and incentives can have these totally seemingly disparate downstream effects. So one thing we've done is I think actually the trade-off on that is you can just change your organizational design more frequently. And so we've basically every three to six. six months for the company's history changed how product is structured, what problems are tackling.

There's definitely cost to this. You definitely have a bit of thrash, a bit of adjustment, but the flip side is you actually are kind of like forcing people to like pivot and think about problems in different ways. And so they don't get kind of too calcified in what they're doing. And so yeah, on that like everyone is kind of stable going, but going in these very well-defined ways that end up being exposed to users unexpectedly versus kind of more thrash. We've kind of gone a little bit more on the changing website. I think the other place that shows up in organizations is handoffs, particularly sales to CS for success is one.

Some of that is inevitable, but we also have tried to really buddy up sales and CSM, so they really like understand each other as people. And so it's less of like, I sign the customer, fling them over. I guess they'll get onboarded. who knows what happens next? And more, I like, no, when you, if you're a salesperson, but you spend a much time with someone and can customer success and understand how they talk to customers, you're probably subconsciously going to change some of the things you say for the better of the customer.

Are there any other things about being a leader inside of a business that's growing fast that have surprised you, like hard lessons that you've learned or counterintuitive things that have worked? Like, what else has been surprising going from academic to pragmatic? Joking but not. I someday look forward to the feeling of mastery, but I kind of can't remember what that feels like. Just feeling like you're good at something, truly good at it, is not something of experience for the last few years. I think that was more than I expected. And again, I'm someone who to a fault kind of likes to run up steep hills metaphorically and actually. But who, yeah. And I think it's because in a role like this, your job really is to like figure out something well enough such that you can get. at someone who's infinitely better than you to do it. As soon as I start feeling like, not mastery. Sometimes like, you know, sometimes like reasonably confident at something, then you're like, oh, I have to give this away now. Now we're going to go back to square

one with something else. But just, yeah, I think for me, actually, there is like a just recognizing that calling that out and being like, okay, great. Some days will change, but mastery is not the game I'm playing right now. If you were to put your dreamer hat on a little bit and think about what this could become, it's one of these businesses where you want to think about if things go right, what could it mean? Dream for us in terms of Vantas future. Like what might this thing become based on its current trajectory? Yeah, so we think about Vanta being part of every software transaction, one business is buying software from another business, and it's part of that evaluation. Are you reasonable? I'm going to give you a bunch of data.

Are you going to leak it on the internet or are you going to do the right thing with it? And that's sort of Vantza's MO is what you help. We talk about those vendors first, but vendors actually do the right thing, know what they're doing, get secure, and then prove that security or demonstrate it to their buyers. And over time, helping those buyers reason about the security of their software vendors. So we really do see Vanta as part of every transaction. Connective tissue for lots of things. Very cool. I see that bookshelf again on the back. I used to be such a nut about books. And I've sort of stopped just because I find conversations like this to have a lot more information content. What do you do to keep learning? Like, is it still books? What have you found? Has it changed for you?

what is your information diet? I still read a lot of them. Actually go in waves. So I kind of won't read a book for a month or two. And then I will, over the course of a month, read 10, 12 books. And it's this sort of strange wave pattern where it kind of averages out

a little book a week, but it's much lumpier than that. A big part of reading for me consciously is fiction books. Again, some of it's to, I've always liked this. This is actually where I just feel, somebody feels very comfortable.

That's what I just did as a kid. In terms of other things, I mean, podcasts, just the last few years. I'm listening to a podcast for a decade and a half, but really the last few years and the explosion there has been really neat to see newsletters, conversations, really more conversations skewed than ever, I think also. Yeah. I love this idea of never getting to do mastery as the leader and sort of having to fire yourself right as you're approaching it. Where are you the novice right now? Like, what are

things that you're interested in that you don't yet know a lot about, but you think are important? Okay, so two, I mean, a lot of things top of mind, but two things top of mind. One, structuring relationships with like other folks in our ecosystem, so whether it's audit partners or kind of adjacent vendors. I think, you know, coming from D.C., people think you're probably great at this stuff, but it was only two years. I was like mostly talking to people, right? I wasn't giving out term sheets.

So that piece of just like learning how to structure some of those relationships. So both sides are quite happy with them. sort of gets at like the discovery and what's actually important to you. And I think the first answer is always revenue, but then you keep going. And there's five more interesting answers that you can really build around there. I think honestly, like brand marketing and just profile raising up, we've been really quiet about Fanta for the last few years. And a lot of it was because we actually thought we had a great business. And we didn't. We wanted people to still think we were like often, you know, some bizarre corner. And we needed like interventions and drinks about what we were doing with our lives.

we do the business is quite good. But the times have changed. And so just like how can we raise the profile of the company and what we're doing where honestly a lot of this stuff doesn't come supernaturally to me. I am much more of a like, I'll just go sit in the corner and work and emerge when you're done. That's not quite the game on the field. I think you do have to play the game on the field. In what way have you gotten most better as a leader of the business? there's probably a clarity of thought and communication piece of just figuring out how to harness what I have in my head, articulate it in a way that both makes sense to people who are not me, and communicate it clearly. I think I've gone between probably like the classic founder, like being way too prescriptive and then spent some time definitely not quite too hands off, but just being like, oh, well, you're a smart motivated person and like I wouldn't want someone telling me what to do. So you just go, but needing, then realizing, like, no, some direction is actually really helpful, especially if you want quick decisions, good decisions, et cetera.

And so just kind of like trying to find an equilibrium on that continuum. Is there anything unique about what makes Vanta tick that we haven't talked about yet? I think there's a part. So we still do this. So in the early days, we talked about customers on a first name basis. We talked about Dan. Here's how Vanta made Dan. happy and sad. Everyone knew Dan was, is a real person. Everyone knew what Dan did was happy and sad.

And we talked about it in that way, which is, you know, in some ways really juvenile, but it was actually just like emotional and kind of purposely so. Because it was like, look, we're building software for millions of internet businesses, you know, ideally, but also there's real people behind it and our decisions affect them. And I think while we're past the stage of everyone knows who any given Dan is, there's very much like that ethos, like that is. Like that is a version of customer centricity where we are building software that affects real people and again, makes them happy and sad. We're going to like do the best or take back in responsibility seriously. If you think about those out there where you were in 2015 or something like this,

sort of in the early stages of figuring out what they might want to do, but going down the entrepreneurial path, everyone always asks and I do it too, like, what should they do? I'll ask it differently, which is like, what shouldn't they do? Like, what negative advice would you give to would-be founders out there. Listen to the people you want to listen to. Don't listen to the people who seem like they know what they're saying. So a few parts. One, I had a bunch of people tell me I shouldn't leave USV. And in retrospect, you're like the pinnacle of my career. Anyone's career was when they were 24. Like, come on. But literally people just, and then I'm well intention. But they're just like, this is a great job. It's a great springboard. Think about your email address.

The left side, Christina. There's a right side, usv.com. The right side's clearly. stronger than the left, why would you leave it? So well-intentioned and so infuriating. And I think now, especially with pressure, you can look back and be like, that was horrendous advice. For a few reasons, but I think one, there was like a bet on myself that it was very willing to take there. And I think that helped, even though I got a little confused with everyone saying that, that was really helpful. And I think on the flip side, I also had people around me who are like, you can go be in it. Like, why wouldn't you be an engineer? You can go do that. Also, you're like, you know, I felt like I was very old at 24-2. It was like a mid-career switch. And they were like, well, you know,

one, that's not true. And two, like, oh, well, you can go learn that. It'll only take two years. It'll be fine. So then just go do it. Why wouldn't you do that? And I think that optimistic take was just really helpful. Kind of having, these are the people who like believe in you more than you believe in yourself. I love that. I asked the same closing question of everybody. What is the kindest thing that anyone's ever done for you? You're so good at this question. and I had time to prepare. So it was also like parent things, but I actually think one thing

this person probably doesn't even know they did was so when I was in undergrad freshman year, I ended up meeting a senior at the time of school who I'm not quite sure why she did this. Her name was Alice. She basically sat me down and was like, hey, there's a lot of money at Stanford to like have them send you places for the summer.

You just have to know how to apply for it and what to say and how to do that. And she sat me through and like, ran me down how to apply for student grants, basically, and the different ones. And I spent every summer minus the Google summer, somewhere in the world, I had this grant, right? We were like break even for the summer. And I think the experience, the like, I'm going to send myself to Rwanda at 19 and just live alone. It'll be cool. And it was fine, right? But just so much came out of that. And I'm just eternally grateful for her for doing that. And I kind of do it to this day, right?

Like, don't know why she did that. Can I ask one follow-up, which is, so you mentioned Rwanda, what were the other couple? And so much came out of it. You mentioned like the sort of technology field. What other major things came out of those trips? There was Thailand and Uganda. And Uganda summary of the journalist ostensibly. And that was just like getting comfortable being able to call people up and ask them questions.

And you know to say, hi, I'm Christina. And I'm like, kind of random person. But can I come over and ask you a bunch of questions? And then being like, totally, go for it. And so some amount of just being able to do that. at Rwanda summer, it was with a Rwandan NGO that didn't do any work in Rwanda because of the political climate stuff in neighboring countries. But because as a young Western academic, also a 19-year-old, I could go ask questions about Rwandan stuff. And so that summer, actually, the government decided to

let a bunch of the prisoners who had been in jail for a decade from the genocide, walk home to go for these local courts. And it was like the big thing that summer, right? But no Rwandan could really ask those questions. And I could walk in and be like, hi, I'm doing. going on like school project. Can I ask some stuff? And they would basically feed me questions to go ask. My colleagues would. There's a lot going on there. There's a lot that's like deeply unfair and deeply messed up in that. But I think for me that was actually realizing this is like, again, really messed up and really unfair. And I should not be able to do this for lots of reasons. But how can I sort of harness all of this for the benefit of my colleagues who clearly should actually be the ones doing this. And so I think just a lot of stuff around figuring out how to maneuver around the from your end. I love the story you've told us today because so much of it is a willingness to put yourself in new situations and learn very quickly and keep going. I've loved getting to know you and the company.

This has been really fun today. Thank you so much for the time. Thank you. If you enjoy this episode, check out join colossus.com. There you'll find every episode of this podcast complete with transcripts, show notes, and resources to keep learning. You can also sign up for our newsletter, Colossus Weekly, where we condense episodes to the big ideas, quotations, and more, as well as share the best content we find on the internet every week.