Interview Transcript: Christina Cacioppo, Vanta & Andrew Reed, Sequoia – ‘Zero to One: From Idea to Product’ | Slush 2021

This is an edited transcript of an onstage chat at Slush 2021 (1-2 Dec '21) between Christina Cacioppo, founder & CEO of Vanta, and Andrew Reed from Sequoia, who led the Series A into Vanta. Covers a bunch of useful themes around product-market fit (PMF) and early phase of launching, including how they worked with design partners and didn’t start coding till they saw strong resonance with the MVP (which was an excel sheet essentially) and inbound leads. I found Christina’s view on market sizing (she admits she doesn’t believe in TAM for category-creating products) very interesting, coming from her VC stint at USV. Another important one is around customer feedback, is that in general because people are nice / don’t want to be rude, they won’t give you unvarnished feedback, so founders, please look for strong feedback, like I want it now, and see anything short of that as a no.

Andrew Reed: Hello, Christina and hello everybody. I’ll give a quick background on myself. I’m one of the partners at Sequoia. We’re a global venture capital firm known for past investments in Apple, Google, Cisco, Zoom, Stripe, PayPal, etc. And we are lucky today to have Christina Cacioppo, the founder and CEO of one of our most exciting and certainly one of our fastest-growing companies coming out of US. And rather than giving a long-winded intro of you myself, why don’t you share with the audience a little bit about your personal background?

Christina Cacioppo: Great. Well, excited to be here today, co-founder and CEO of Vanta. We automate security and compliance for high-growth companies and a lot of startups. Excited to chat with you all today. Prior to starting Vanta about five years ago, I was a product manager at Dropbox. I started my career actually in VC, so have some sense of what Andrew did, but nowhere near as successful as he has been. And then I grew up in Columbus, Ohio in the US.

Andrew Reed: And also a little bit about Christina, she’s unfailingly humble. So, I will share a little bit about my first interaction with her, I was introduced to Christina by Dylan Field, the founder of Figma, which is one of the companies I work with. And Dylan gave Christina a raving reference. And I actually was already familiar with Vanta by the time I met Christina because one of my other investments, which is a business called Loom is a Vanta customer, and had put out a blog post when they got their SOC2 certification that was basically a love letter to Vanta. And I think when I met Christina, I had all that context. It was one of the fastest-growing companies we’d ever seen. They got to over a thousand customers before raising their Series A at tens of millions of revenue. And hence the Series A was $50 million. So, I think for many of the founders in the audience in particular, having that sort of raw and unfiltered product market fit is something most can only dream of. So, why don’t you take us back to when you left Dropbox and decided what you wanted to do?

Getting to product-market fit

Christina Cacioppo: Yeah, so we used to joke about it to anyone, believe that compliance was our first word as a three-year-old. Not the kind of classic founder story…that’s not what happened. But left Dropbox and actually was interested in a handful of things. So, I just spent a few years working on Dropbox Paper, which is a team collaboration tool and so somewhat interested in that and then very interested in security. And to take you all back there, this was late 2016 or early 2017. So, the US election had just happened, the Equifax data breach, Uber data breach & Capital One there were all these really big security breaches in the headlines. And we sort of looked at those and were like, okay, hang on what’s going on here? We all keep saying security and cybersecurity are so important and we all agree, but also everyone seems to be getting breached sort of left and right in these ways that in retrospect seem obvious or predictable.

Don’t we understand it or is there something we don’t get? And so basically just started asking questions and literally started with friends and coworkers. So, the first of these conversations was with someone who I’d worked with on the security team at Dropbox, and just having these conversations. And it was this few month’s process of learning that people very much did care about security. They very much tried to prioritise it at their companies, but it was often hard to trade off security versus what felt like growth or sales or what you needed to get your startup or your company off the ground. And then we came across compliance, which was this world of acronyms. And the more we dug into that, we realised that in its kind of best form, compliance is how you talk about security. It’s how you talk to your customers or talk to your prospects about the security you have, about the practises you have in place. And we kind of realised, hey, if we can make compliance rooted in security and something that more startups have, we can actually get them to be more secure and go forward and try to secure the internet that way.

Andrew Reed: Once you landed on that problem space, I think one of the questions that founders often wrestle with is how to involve early design partners or customers versus doing things like first principles from yourself. So, maybe talk about your philosophy on that and any examples from Vanta.

Christina Cacioppo: Yeah, so prior to Vanta, I had tried to make or made a bunch of stuff on the internet. None of which you’ve ever heard of didn’t go anywhere. And so I was pretty humbled by this point and I was like, well, I like to think I have good ideas, but actually they generally don’t survive contact with the market or customers. So, for Vanta, the early stages were really customer-informed. I used the word customer loosely, user-informed, cause we weren’t charging anyone. But actually initially we went to Figma cause we knew Dylan and we knew folks there and we’re like, hey, can we interview you about this? And then we’ll kind of play back the interview and see if that’s useful. And so just picked a few early customers or users really based on personal relationships. And the personal relationship part was important because it was someone who would let us come into their company and spend time with their employees and they trusted us enough that we weren’t totally wasting anyone’s time, but did that for a few months.?And even though we could code actually very purposely did not write any code so that it forced us to try to make sure we understood the problem, understood what we were trying to build before we got to go do the fun part of writing all the JavaScript.

Andrew Reed: And then maybe a little more detail on any good stories from that era. And there’s one in particular that I’m thinking of.

Christina Cacioppo: So, there are a few. So, I mentioned we worked with a few companies, so we did a little bit with Figma, Segment & Front for a bit. And then we were like, we’ve done the same sort of consulting engagement again, we weren’t getting paid, but three times or three companies and by the third one you’re like, this is replicable, great, we should stop doing this in spreadsheets and start writing code. And that weekend we got an email from a former colleague at Dropbox and the email saying Hey, not sure how you guys are doing here you’ve become SOC2 consultants, compliance consultants, super weird life choice. We should probably get a drink and figure out if it’s a midlife crisis or quarter-life crisis, but also can you come to my startup and help out and then we’ll get that drink. And literally, after this email we’re like, okay, no, we’re not going to do that consulting, yes, we’re going to go write code and then try to sell this person what we make. But the quarter-life crisis intervention email was a good sign.

How Vanta works with its customers

Andrew Reed: Yes, certainly. Talk about how Vanta works today, both in terms of how that evolved from discussion to product and then talk about the value that customers see from Vanta when they use it.

Christina Cacioppo: Totally. So today, customers will come to us because they need some sort of compliance certification. So, this is very alphabet soup, but you may have heard of things like ISO27001 or SOC2 or GDPR or PCI, letters like that, which are all ways for a company to prove their security against some set of requirements. So, a startup will hear they need one of those come to Vanta, and then our product will basically help them prepare for that. So, get them in good shape, have them give them a list of the things they need to do, and then we work with auditors and certifiers to actually get them that certification so that they can go back to their customers and say you can trust us. We’ve been certified by this body, we have these letters, this badge, we’re safe to do business with ultimately.

Andrew Reed: Got it. And then first off, that is something that very much resonates with me as a board member for software companies where you have the same story every time where you have a product roadmap, you have a pipeline, one deal in the pipeline requires ISO or SOC2, and all of a sudden that gets wedged in front of the rest of your product roadmap. And the companies I work with, that use Vanta, for what it’s worth, just shrink that period from many months to a couple of weeks and help you get revenue faster. And I think that tends to be a pretty useful value prop to startups.

Christina Cacioppo: I mean some of it we realised is again the somewhat idealised, but I think that the version of compliance we want is where compliance is the way you have the security feature for your customers. And so ultimately it’s customer centric, it’s the feature the customers want. And again, it helps unlock business, helps you ultimately grow your business.

Andrew Reed: And with your company, you know have obviously lots of customers, thousands of customers. You have integration partners, you have the <incomprehensible> side. You have multiple certifications, those acronyms that you mentioned. And you’re a former product manager, so prioritisation is something that you do. How do you think about different prioritizations of all those different areas?

Christina Cacioppo: So, on the edges, it’s something that changes based on feedback. At a macro level though, it’s like customer first and so has been from the early days is still, I don’t see that changing. And even when we think about partner auditors, it is through the lens of customers. And so an example is auditors are a very important stakeholder for us, but the customer is ultimately the stakeholder. And again, we think about it through the prism of customers, an unhappy auditor will make for an unhappy customer. So, there’s some balance, but the customer first always.

Learnings from her USV (Union Square Ventures) stint

Andrew Reed: Got it. And one question, this is kind of a non-sequitur, but you did work in venture capital and you have seen lots of companies through that lens. You were at USV during the early crypto years of 2011-2012, any lessons learned during that experience shape how you navigated the path from the idea to product?

Christina Cacioppo: Totally. So,?I don’t believe in market sizing. Some of this was 2011-2012 USV where it was generally consumer internet, news and new emerging services like Twitter, Tumblr Foursquare, where you just couldn’t do a market analysis of what is Foursquare’s market size or we didn’t try, the analysis we would do is, do people stand on street corners and tell their friends where they are to get their friends to meet up with them. So, I just became really sceptical of market sizes. And so Andrew, you can probably attest to this in the Series A pitch, there wasn’t a market size slide. You probably asked about it and I was probably like, oh no, you don’t want to ask that question, you want to ask this other question do you believe there will be more startups that want this? Do you believe there will be more security requirements? Let’s talk about the market that way.

Andrew Reed: What you’re saying is market size still matters but think about it as a dynamic analysis, not a static analysis.

Christina Cacioppo: Right. Yeah, you can bet on these..

Andrew Reed: Being more creative about market size. And you work with many of our companies who come to Vanta when they’re just a couple of employees and you end up meeting the CEOs and CTOs. I guess through that lens, whether it’s market size related or not, what advice do you tend to give those sorts of folks?

Determining PMF

Christina Cacioppo:Yeah, I mean obviously it varies but a few generalities of, I say this as a person like myself,?especially for founders that come from the technical or product or design side, it can be really fun and temporarily or short-term rewarding to go off and imagine from first principles your fantastic product and spend a bunch of time perfecting that. And then only when it feels ready, put it in front of customers. We did this less with Vanta, because I made that mistake infinite times in the past and so, it’s usually a push to especially those founders, have you talked to early users? Have you talked to customers? Whether or not you’re trying to charge them or you think of it as sales, have people who don’t work for you seen what you’re building and truly given feedback on it.

And the other part which we also saw this in our early days when we were a bit confused about where we were going, was?when you do ask folks for feedback on an early product, they want to help and they want to be nice. And so they will tend to say things like, oh, this is a good idea, not for me, but maybe for this sort of person. And it, they’re actually saying, you don’t have product market fit at all. Right? But no one says it that way. Because they’re trying to be kind and nice and supportive. But I think also just taking a very critical eye to the feedback you get in the early days and anything less than, yes, I want this now is no, even if it’s not couched that way.

Andrew Reed: And was there a moment when you decided we have product market fit or was it more of a spectrum?

Christina Cacioppo:?I think more of a spectrum. I mean there were definitely post-product, market-fit moments. There was a period of early Vanta where I think literally more than half of our customers asked to invest. And that’s where you’re like, this seems promising. They will both give me their company money and then they’re asking for personal money. I mean the life intervention email felt pretty good too, even though it was a little like, oh, didn’t think I’d get one.

Andrew Reed: Well underhanded.

Christina Cacioppo: Exactly.

How they hire at Vanta

Andrew Reed: And when you think back to those early days, one of the things I really admire about Vanta is the culture you have built, building a really strong team. What did you look for in your first 10 hires that have shaped some of that?

Christina Cacioppo: So, a handful of things, some of which are very standard for startups you look for impact user-centric or business-centric and it’s very useful, but table stakes. The two things we looked for that were a little more unique to Vanta, the first was growth mindset. So, these were just folks who maybe hadn’t done what we were asking them to do but believed they were a person who would go figure it out and you’re like, tell me to look up some or do something and I’ll google it and I’ll call two friends and I’ll muddle my way through it and we’ll figure it out. But that outlook is overall really important for a handful of reasons, at an early startup, first 10 people, even if you think you know what you’re doing or you don’t quite know what you’re doing and so some amount of tolerance for that.

The other one and the most Vanta-specific one we call frameworks thinking, which basically just means like, Hey, can you make a decision in a structured way and walk other people through it? So, do you have a framework for your decision or how you’re thinking about something and can you explain it? And any framework you want is fine we are not prescriptive about that. But we are prescriptive about the act of walking people through your decisions. And that’s something that’s specific to us, not a normative thing, but we realised in the early folks that the ones who were more successful were doing that and the ones that we didn’t work as well with weren’t doing that. And that was an us thing, not a them thing, but it became something we started to look for thereafter.

Scaling Vanta

Andrew Reed: And then how about the next phase of the company? So, you have, you’re something of a unique company in that you have a very high functioning and talented product engineering team and at the same time a very high functioning and productive and excellent go-to-market team, whether it’s sales or customer support, etc. How have you thought about scaling those two independently or connectedly or whatever else?

Christina Cacioppo: It’s hard. I think we’ve done more scaling independently and now looking forward to this connectedly. In the past with a lot of the things startups do, you get lucky honestly with a few early hires they know other folks and then there’s some connective tissue. But in teams, across teams that way the thing we’re thinking about now, or actually now that we’re a bit bigger, and for context, Vanta has about 135 people today, more formal feedback loops. So, there are 20 sales reps, they are constantly getting feedback from the market and the conversations that they’re having how do you get that to the product in a structured way? Because we used to just slack it over, dump it all on a Slack channel and someone looks at it and we’re just past the size of any of that working. And so now it’s a design game there’s all this information, how do you get it to a place where other folks can understand it? I think one really tactical thing is we became a Gong company like a record sales calls company just before the pandemic probably January – February 2020. And it’s great. Totally a cultural norm to record everything. People go watch calls and people will watch your calls and running Vanta without Gong would be significantly harder or something.

Andrew Reed: Excellent. Yeah, so Gong is also a Sequoia investment, but that was not a paid partnership. Terrific. And one of the things that <incomprehensible> wonders is when you have conferences like this that have a lot of very early stage founders who are in that walk through the woods period. And you look at a stage like this and people who are scaling companies of real size, there is this emotional gap there. How do we do it? So, I’m curious, if you were to refer to those people in particular, how did you get through the more emotional side of the wander through the woods of Vanta?

How founders should approach the early phase

Christina Cacioppo: Totally. So, the wander through the woods phase when you’re figuring out your idea, and at least for us, when we went and talked to more established founders and they’d basically be like, oh, that phase was so fun, the world is your oyster, you could do anything you wanted. And at the time we were like, oh, it’s so fun. I don’t know what to tell my mom I do with my life so much fun. And then at some point, we’d have those conversations and you start being like, Hey, established founder who seems super successful out of reach, did you actually enjoy that phase? And they were like, no, definitely not. That was, in some ways fun and in some ways existential and I had to explain to my mom that the problem wasn’t great. And so, just holding that in your head in some ways it actually is really fun.

And even if it doesn’t seem like it, the world is your oyster and you can go out and work on whatever problem you want truly. And I do believe that even if don’t feel you have the background for it. My background was not security and compliance, it now is, but it wasn’t before Vanta. And so, I believe that very strongly. So, that the world is your oyster is the fun part. And then equally remembering that no one knows how to explain to their moms again what they’re doing in this or most people don’t, and that it feels existential, but you’ll get through it and it will be fine. And the folks who now seem they were always established and it was this clear route through the woods to product market fit. That’s just cause that’s a story you tell afterwards that is not actually the lived reality for anyone.

Getting to PMF, trade-offs made along the way, and why they finally raised

Andrew Reed: So, at this point, at least from what we see in the US, Vanta has become more or less a defacto product to be bought by early-stage software companies. It’s kind of one of the first things people buy.?<they talk a bit about Vanta’s plans for Europe, in the context of the conference Slush being in Europe etc., but this is not relevant from the perspective of PMF>??With our last 3 1/2 minutes talk, we should talk a little bit about, you’re on stage with your primary investor in Sequoia. Talk a little bit about the decision making you made in terms of finding product market fit, getting to tens of billions of revenue and then raising a Series A where I think status quo for most founders is raise money, then figure stuff out later. And so talk about the various trade-offs that you made there, pros and cons and how that decision making went.

Christina Cacioppo: So, a lot of how we’ve fundraised for Vanta came from the early VC job that we talked about. And particularly being fortunate enough to see a bunch of companies, the majority of which were tremendously successful, but not all of which were. And being able to viscerally see how more money often does not make it any easier to find product market fit. And also how kind of binary that is, it can be a scale, but there are moments when you know don’t have it. And there are moments when you know do have it. And the money, the expectations, the other cooks in the kitchen, all of that, just even very well-intentioned, wonderful cooks still does not make for a better meal always. And so with Vanta, we raised a very small amount of money, tens of thousands of dollars in the early days.

And then it was like, well if we can’t get to something off of this, we shouldn’t go raise millions more that actually doesn’t make sense to us. So, that was the original plan. We pushed it much further. We did think we’d raise Series A at a million in revenue, which you’re supposed to as a startup quote-unquote. The thing we found was just we didn’t need it particularly, we were making money, we were hiring as fast as we could, we still were making money. And so then it felt a little silly to go out and run this process and go figure that out. Take a bunch of time doing that to have more money in the bank and try to hire faster but we were doing that as fast as we could as we just pushed it for longer than I think even I expected we would.

So, we did raise it, because people were actually thinking Vanta is quite small. How do we convince them we are the de facto standard? We are much larger. On the downside, there was that we seemed smaller than we were. I didn’t particularly want to put a target on our backs. At some point, more scrutiny came and then you just embrace it. Also, it made recruiting harder, because we’d come to people and they’d be like, you’re a seed company that’s raised nothing and we’d be like, oh no but also we’re 50 people, we’re so big, we have a thousand customers you shouldn’t think about us as a seed company. And people would be like, Crunchbase says you’re a seed company. And that back and forth, folks wouldn’t even really talk to us because we didn’t on paper fit with what they were looking for. There was a little bit of worry about adverse selection, like, oh well you haven’t been funded cause you’re not a good company. So, that was very real in the market too, we just have to start some recruiting conversations by objection handling, all of that, just not the best way to start one of those conversations.

<brief chat about how to find Vanta’s booth in the conference>

Andrew Reed: Thank you, everybody. Thank you Christina.

Christina Cacioppo: Thank you.