Christina Cacioppo Unfiltered on Fake Compliance, AI Security & Building a $4B Company

**Eric Newcomer** (0:00)
To start, SOC 2 is the security audit every software company has to pass before big clients will touch them.
Riveting stuff, I know. But stay with me, because you might be surprised with how much drama hides behind Silicon Valley's favorite audit.

**Christina Cacioppo** (0:13)
Go and like try to figure out, it's like, what did we miss? Shoot, we've been doing it for years. What do they know we don't owe?
They're not doing it. It's like, just don't do the work and give someone a compliance report.

**Eric Newcomer** (0:23)
My guest today is Christina Cacioppo, co-founder and CEO of Vanta, the company that turned that dreaded checklist into a $4 billion business. She got the idea after suffering through SOC 2, I hand a Dropbox, then spent a year and a half quietly building Vanta for a market that at the time barely existed. I'm Eric Newcomer, author of the Newcomer Substack. Let's get into it.
If I say SOC 2 compliance too early, people may be like, what am I in for here?

**Christina Cacioppo** (0:55)
Stop listening to this one.

**Eric Newcomer** (0:56)
There's a lot of drama, actually, we have, I will ask you about. But before we get to that, just like, on the scale of just like craziness, where are we with the AI hype cycle? Like how wild is the behavior of your fellow startup founders today?

**Christina Cacioppo** (1:11)
Pretty nuts. Also the behavior of the investor. They don't mean to put this on founders. It's I think, ecosystem enforcement.
You're going to give me the money. Yes. Yeah. I think if you're going to give me this, why don't I take it? Yeah.

**Eric Newcomer** (1:21)
So you think, like, what's the behavior? Yeah. What are you seeing?

**Christina Cacioppo** (1:26)
I think the best comparison I heard about it was, it's like crypto in 2021, where there is a hype, kind of. It's like a hype, hype, hype.
But like this is a good strategy because you can like, it's also kind of, you get the capital, you get the people, you get the capital, you get the people, and hopefully those people are also building a real product over time, which maybe they are, maybe they aren't, but that's a place where it could diverge from crypto. But the like hype, hype, hype, round, pump the stock price, I think that playbook is like happening now amongst some number of the AI founders.

**Eric Newcomer** (2:03)
Round upon round before products.

**Christina Cacioppo** (2:06)
Yeah.
But like the products could exist, and if they do, they could be very compelling. And the round is a great way to attract people who will make those products. And so again, it's like, it's not clear it won't work.

**Eric Newcomer** (2:17)
Do you make angel investments?

**Christina Cacioppo** (2:19)
Sometimes, rarely.

**Eric Newcomer** (2:19)
And are you doing them right now?

**Christina Cacioppo** (2:23)
I've just learned that it's either my best investment, I mean, this is a thing everybody learns, so it just took me too long, but like it's the people I've known for a really long time, or it's the problem domains I actually know. And when it is not one of those, I generally, I think I'm a smart person, and I actually just have poor judgment.

**Eric Newcomer** (2:42)
Are there people you've known for a long time and you're like, but that gives me the confidence not to invest in this company? Or just like...

**Christina Cacioppo** (2:50)
That has happened.

**Eric Newcomer** (2:53)
But generally, yeah, I think a sort of a friend where you're like, they're very capable, but this idea, I don't get it still.

**Christina Cacioppo** (2:59)
I'll do those. I'll do those. I mean, in some ways, like that was the Vanta story. So in some ways that's like, and we got nos for that of like, you seem smart, but like, what the heck are you doing in this problem space?

**Eric Newcomer** (3:09)
Let's briefly give the context, not spend far. I mean, you came out of what? You were a PM at Dropbox, right? And so how do you get the idea for?

**Christina Cacioppo** (3:18)
So the real story is two part. It's like, I was working on Dropbox paper, which I now describe as Notion, but better, but worse.
No one uses it now. Notion deeply won, as they should have. But that product wasn't compliant, pen tested, secure, quote unquote, in any enterprise procurement sense. It was secure in an actual product security sense. Anyway, and I was the PM who, on the eve of launch, learned that and learned what we would have to do to go fix all those things. And we decided not to do them, because it was just too onerous. We didn't have product market fit. Seemed like a bad use of time, resources, et cetera. So that was not, I don't know, that was not like the sort of company.