Vanta’s Christina Cacioppo: The Underdog Turning ‘Nonsense’ Compliance Into A $4.2B Security Standout

**Alex Konrad** (0:00)
If you found a money-printing machine, you probably wouldn't tell everyone about it right away. Vanta figured out how to talk about security and compliance before anyone else was taking it seriously. Today, it's valued at $4.2 billion.
Our guest today is the CEO of Vanta, Christina Cacioppo. Vanta and Christina help brands like Lovable, Snowflake and Icelandair with their security and compliance. When Christina and her co-founder started out, investors told them, this isn't a business.

**Christina Cacioppo** (0:27)
The polite version, which everyone was polite, to be clear, but was like, this is not a product category today. This is like a fragmented service category. But again, not in like the cool 2026 way, like in the like, that's not a business 2018 way. They're going to acquihire themselves to somebody in a couple of months and like, they're not actually going to work on this. Who wants to work on compliance?
And no one totally said that out right, but that was like very much the vibe.

**Alex Konrad** (0:52)
This episode is brought to you by Rippling AI, work AI tools that are more than just talk. Today on the podcast, we're going to talk about why distribution can sometimes matter more than product, how Vanta cleverly reverse engineered access to top VCs and how the rise of AI agents has changed everyone's security needs and how Vanta builds internally. Also, this has nothing to do with the show, but go Knicks.
I'm Alex Konrad, founder and editor of Upstarts Media, and this is The Upstarts Podcast, our weekly show about startup founders who punch above their weight and take on the status of the world. Christina, welcome to the podcast.

**Christina Cacioppo** (1:27)
Thanks so much for having me.

**Alex Konrad** (1:28)
Vanta is a company that's been around since 2018 You started out with this sort of wonky security thing called SOC2, right? How do you explain what Vanta is to a normal human?

**Christina Cacioppo** (1:39)
Yeah, we help companies understand their security posture. So it's like layman speak of what security practices they have, and they don't have, and perhaps should have. So understand the lay of the land and then implement those security practices, and that's a bunch of hard work.
And then we help them get credit for all that hard work with their customers who audit security questionnaires, but it's basically we help companies earn trust by doing good security and then prove that trust to their customers.

**Alex Konrad** (2:06)
And so you went through Y Combinator, you started working with other startups. But today, I know you also work with non-startup companies too, like Icelandair, a bunch of healthcare companies.

**Christina Cacioppo** (2:15)
Yes.

**Alex Konrad** (2:15)
When we look at those maybe 16,000 plus customers who use Vanta, what is the sort of ideal customer or typical customer today?

**Christina Cacioppo** (2:21)
It's funny, we actually thought we would start with 50-person companies, because that was where the market for SOC 2 started back in 2018
And then I think because Vanta's guidance made it so much easier to get, because it was just here's a set of things, here's the security practices you should have as a small company. We started serving other YC companies, and so we still call that the two founders on the couch. So that's where we started. And then right now, we have expanded into small enterprise, I would say. We have so much larger companies, but in general, kind of like anywhere from two founders to like a couple thousand people. And at that, it's a whole team that's running audit, certainly, but like risk, compliance, security operations, like much broader scope and sense.

**Alex Konrad** (3:07)
How did you get startups to see the need for this solution, to care about this? Because when you're building really fast, focused on day-to-day survival, you may not think, oh, how am I going to be audited?

**Christina Cacioppo** (3:19)
Yeah, so we also thought that would be quite hard. And running around, and I did some of this in the early days, running around and being like, hey, startup, don't you want to be more secure in general?
Wasn't the best pitch? Generally, folks would say like, well, yes, I do want that. But when I go into the office and think about what I work on next, it's whatever the customer asks me for, not what I desire. And so what we did was we leveraged SOC2, which is this existing thing that at the time was like this procurement gate or blocker, where it would be like startup trying to sell to a big company. Big company would say, hey, cool technology startup, but you're going to take a bunch of our data. How can we be confident you're going to do reasonable things with it? And the answer was either like, get on the phone with them, be like, I went to Stanford and I am a good engineer and I worked at shiny companies and like you can trust me and this whole song and dance. Or the answer is basically get a SOC2 audit done, which like shorthand for that is like, do a bunch of work, have a trusted third party come in, verify you did the work, have them write it up and then send that PDF to everybody else. And so like we were just like, hey, founders, we'll help you implement a bunch of security things and then that PDF will come, you'll get that report and you can go use it. And so think of Vanta being the way you get SOC2.