Christina Cacioppo Unfiltered on Fake Compliance, AI Security & Building a $4B Company

[00:00:00] To start, SOC 2 is the security audit every software company has to pass before big clients will touch them. Riveting stuff, I know. But stay with me, because you might be surprised with how much drama hides behind Silicon Valley's favorite audit. Go and try to figure out, what did we miss? Shoot, we've been doing this for years. What do they know we don't? Oh, they're not doing it. It's like, just don't do the work and give someone a compliance report.

[00:00:23] My guest today is Christina Cacioppo, co-founder and CEO of Vanta, the company that turned that dreaded checklist into a $4 billion business. She got the idea after suffering through SOC 2 by hand at Dropbox, then spent a year and a half quietly building Vanta for a market that, at the time, barely existed. I'm Eric Newcomer, author of the Newcomer Substack. Let's get into it.

[00:00:50] If I say SOC 2 compliance too early, people might be like, what am I in for here? Like... Stop listening to this one! But there's a lot of drama, actually, we have to ask you about. But before we get to that, just like, on the scale of just like craziness, where are we with the AI hype cycle? Like, how wild is the behavior of your fellow startup founders today? Pretty nuts. Also the behavior of the investor. I don't mean to put this on founders. It's, I think, a... The founders is like, if you're going to give me the money.

[00:01:17] Yes. Yeah. I think there's a... Like, if you're going to give me this, why don't I take it? Yeah. So you think, like... Pretty nuts. What's the behavior? Yeah, what are you seeing? I think the best comparison I heard about it was it's like crypto in like 2021, where there is a hype, hype... That bad? Kind of. It's like a hype, hype, hype. And I'm... But like, this is a good strategy because you can like... It's also kind of a... You get the capital, you get the people, you get the capital, you get the people.

[00:01:44] And hopefully those people are also building a real product over time. Which maybe they are, maybe they aren't, but that's a place where it could diverge from crypto. But the like hype, hype, hype, round... Pump the stock price. I think that playbook is like happening now amongst some number of the AI founders. Round upon round before products. Yeah. But like the products could exist. And if they do, they could be very compelling. And the round is a great way to attract people who will make those products.

[00:02:14] And so again, it's like, it's not clear it won't work. Do you make angel investments? Sometimes. And are you doing them right now? I've just learned that it's either my best investments... I mean, this is a thing everybody learns, so it just took me too long. But like, it's the people I've known for a really long time. Or it's the problem domains I actually know. And when it is not one of those, I generally, you know, I think I'm a smart person and I actually just have poor judgment.

[00:02:42] Are there people you've known for a long time and you're like, but that gives me the confidence not to invest in this company? Or just like... Sometimes. That has happened. But generally, yeah, I think sort of a friend where you're like, they're very capable, but this idea, I don't get it, still... I'll do those. I'll do those. I mean, in some ways, like that was the Vant of story. So in some ways, that's like... And we got no's for that of like, you seem smart, but like, what the heck are you doing in this problem space? Let's briefly give the context, not spend forever.

[00:03:12] I mean, you came out of what? You were a PM at Dropbox, right? And so how do you get the idea for... So the real story is two part. It's like, I was working on Dropbox paper, which I now describe as Notion, but better, but worse. No one uses it now. Notion deeply won, as they should have. But that product wasn't compliant, pen-tested, secure, quote-unquote, in any enterprise procurement sense. It was secure in an actual product security sense.

[00:03:36] Anyway, and I was the PM who, on the eve of launch, learned that and learned what we would have to do to go fix all those things. And we decided not to do them because it was just too onerous. We didn't have product market fit. It seemed like a bad use of time, resources, etc. So that was not... I don't know. That was not like... And Dropbox was public at that point? Not public, but it was 2016 Dropbox. So it was like height of, you know, sushi in the cafeteria, Chrome Panda, like Silicon Valley Dropbox.

[00:04:04] It was only later, two years, when I basically... I wanted to start a security company. So I was like literally walking around Soma talking to founders about security. And sort of realized lots of people wanted to work on security at their startup, but that wasn't what customers were asking for. So they didn't. And that's why there were no security tools for startups. Until their customer asked them and they'd ask for a SOC 2. And I think it was really like a prepared mind thing where I knew about this problem. And SOC 2 is basically customers saying, all right, I want to make sure if you're my vendor, like... Exactly. Like this works.

[00:04:34] You have things together. Give me some certification. Exactly. Yeah. And it's basically, it's like, give me something. A third party comes in and checks everything really rigorously. So I don't have to do that work myself. I'll trust it. And like that makes sense. I think it was like the way you would prepare things, work with that auditor made no sense to me as like PM engineer. And so that's what we tried to fix. This is a sort of poor one out for Dropbox moment. I know. Drew Houston is stepped away as CEO, right? He just did.

[00:05:04] Or yeah, I think co-CEO CEO, but like exec chairman. Yeah, he's sort of... Co-CEO to exec chairman. It feels like the idea that, you know, Dropbox would take its great insight on cloud. Yeah. And like find a sort of next thing. Never happened. And paper was obviously at one moment. One moment. An effort of we're going to build, like you said, sort of a notion ahead of its time. Yeah. Well, yeah. Do you think it could have gone another way or what? What's your...

[00:05:33] How do you think SOC 2? Well, I think... I mean, in a... Like in an academic sense, or could you have whiteboarded logical things that made sense that were adjacent things that could be built and worked? A million percent. And there was a lot of that. I think company culture and execution wise, none of those things got off the ground. But it had great people. Like Dropbox had all these cool... It was like one of these great networks. So it's like, oh, all those people went on to be really influential. Yeah. Town. I don't know if you thought Town. The AI agent startup just raised a big round of money. One of the injuries.

[00:06:03] Yesterday. But like Jean-Denis and Tony were at Dropbox. Like all of these folks were at Dropbox at the time. So you have the right people, but then you're like, oh, the culture couldn't have done it. Like how do you square that? I think Dropbox had the blessing and curse of... So Drew is probably about like he'd built lots of things before kind of file Stink-A-Chair and Hacker News. But like that thing, he posted on the internet and kind of a million people used it. All the time. And it was sort of...

[00:06:31] It was this blessing and then that became a like, you know, whatever, billion and a half revenue business and curse. Because it was like, oh, well, we just think of smart things and launch them and then a million people use them. And that's the way the world works. And that was like so baked in. Whereas when that didn't happen, which also that like kind of never happened, there wasn't like a, I think, a product development muscle to push through that and get to something with product market fit. And so it was just constantly like, new idea. It didn't quite work.

[00:07:01] We must not have been smart enough. But not like talking to customers. It's not like they sort of like had a machine. Like there are businesses... That have like new product development machines. Right. And I think, again, it was like in part because it was, hey, you see this. I think the companies that develop those have first products that are good. Clearly they got to that stage. But they're not these like, I kind of don't have to do anything and I have a billion dollars of revenue products. I think when you have one of those, it's way harder to build the muscle.

[00:07:29] What was that first thing for Vanta that helped you acquire customers? It was like, we will get you a sock too. We'll get you through that. And we will not pay $100,000 and take a year and a half. Because it used to be the domain of sort of more consultants. It was 100% consultants. Yeah. Like a spreadsheet. Exactly. Right. And so that was like, I mean, $100,000 sucked and we brought it down to like 10 to 20. But I think the real thing was it'll take you three months, not 18.

[00:07:58] And you can put your high performant, whatever, engineer on it, not your like co-founder CTO. And it was that. That's actually what made the market work. You're in a space that aspires to be boring in some ways. It's like no drama. It's like, yes, you're good. Yes. And safe. But it has some of the highest drama in Silicon Valley with this YC startup Delve, which YC sort of disowned, I guess. You know, there was basically this.

[00:08:27] It was interesting because it wasn't like reporting in the traditional sense. There was sort of like an anonymous sort of dossier. Yeah. Do you know who it is? I have a theory, but I do not know. I'm quite confident they don't work at Fanta. Okay. You're not involved. Yes.

[00:08:44] Or the, um, that basically says, you know, they're like pre-filling out a bunch of forms for their customers to make, to which allowed customers or suggested to customers that they should just sort of submit made up stuff basically. Right. And then the reviewers who are supposed to be third party were like, you know, pretty random and not doing a great job. I think they weren't reviewing the fulsome side of things. So what, and I don't think you've, have you talked about this? I have not. All right. So what? Outside of Anta, yeah.

[00:09:13] And I mean, it is, it was, it is still a meaningful competitor to you, right? Or did you feel their business impact? Uh, which, when they were. Like, was Delft competing with you for customers? Oh, a million percent. Okay. Yeah, yeah. Yes. Yes. Especially among startup founders. And so what is your view on it? In this early stage automated compliance market, the dominant strategy is, you have to build a bunch of stuff to actually automate and produce the evidence these auditors need.

[00:09:43] Dominant strategy takes a lot of money. Dominant strategy takes a while to do. Is you, you can also do it manually yourself. So the dominant strategy is you're like, hey, we're Vanta, but we're better and nicer. And we hold your hand because they're too big and we're cheaper. And that is actually an excellent pitch. And you can do it. And then people, it's a good pitch. So people will come to you. You will handhold them through. Hopefully you're also building things. You can get to $10 million in revenue on this pitch. Then when you hit around, and then you can raise this big round and you can feel great.

[00:10:10] And then you kind of hit a wall because now at $10 million revenue, you've got a couple hundred customers. You've got a good pitch. So people are still coming in. And you've got these hundreds of customers you promised this thing to that you are trying to do in a way that doesn't scale. And you've got all this new business and sales. Because it takes time to deliver, you basically sell it before you've built the capability to deliver it. And so you can kind of get, and then you kind of hit this wall because then you're like, okay, maybe you're a year in and people are like, hey, you said you'd help me a year ago.

[00:10:39] You said, you know, you're getting better than Vanta, but like I'm nowhere. And it's your fault, not mine. And you have, and then you're like, oh, shoot, I should build things. I should hire things, but also the new business anyway. And you just kind of hit this wall for like a year. And you're building out that. And YC and the culture are saying automate everything. Like make it. But it's also just like not enough hours in the day to like hire people and build the product and do the sale. And I mean a high class problem in startups, but like it's a real problem. I'm so confident in saying this because Vanta did a version of this.

[00:11:07] All of our like 2020, 2021 competitors did a version. Like I've just seen this movie seven times. So we watched this with Delve and we're like, oh, it's fine that they're going to, they're playing this playbook, but they're going to hit a wall. They didn't hit a wall. Kept going. And then we would go talk to founders who use their product and rave reviews. It was like, I don't have to do anything, but it worked. Wait, what did they figure out? We'd like go and I'd like try to figure out. It's like, what did they, what did we miss? Shoot, we've been doing this for years. Like, what do they know we don't?

[00:11:34] And then sometime last year we're like, oh, they're not doing it. It's fake it till you make it, but not in the sense we did where it was like fake it until you're building it and do things manually along the way and do your best. It's like just don't do the work and give someone a compliance report. And so what we found was they were a ferocious competitor because fake compliance are the way better product experience for a founder than real compliance. It's way easier to do fake compliance than real compliance. And so if it's like, it's way less, it's actually no work and slightly cheaper.

[00:12:04] A great pitch. What? Great pitch. So when you're selling to like, who care or like, who is the person that cares about the SOC 2 brand? Right. Or it's like, it's like I'm a startup selling to Amazon. Amazon's looking at just that I have Sock 2. I'm looking at who did it. I'm looking at it's Vant's Sock 2 or like what is Amazon doing when they're analyzing?

[00:12:32] Where does the actual, who's reputation, who has to care about reputation here to make this decision? So like 10-ish years ago in Amazon, I don't literally them, but it was a like, oh, you've done Sock 2. That feels pretty good. And it was because it was like, it was in part the things you had to do, but it was in part just you had the organizational acumen to like do the whole thing. Like it was just kind of a harder thing to do. And so it was almost just a general proof of work. Vanta and others have made this very easy.

[00:12:58] And so Sock 2 is I think now it is less a, oh, you must be a pretty competent organization. It's like you did the thing. Great. Now, so often for these big companies now, it went from being most of the security review process to just the first step amongst many. And what often the enterprise procurement teams have done is being like, look, you have to have Sock 2 to talk to us. And we know you can get one. Don't give us any stuff about it being too hard.

[00:13:26] Now we're going to go ask you for seven more things because it doesn't hold quite the weight. So is that an argument just for Delve then? It's like, whatever. If I just have to check the box, like they don't care. They're still reviewing. So we had those debates of like, is this just so you know, you like think like an economist and you like draw out those forces. And so we had those debates. And what we just and you're like, you know, should you should we do this? You know, we decided not to.

[00:13:52] And part because I think while that is an excellent experience for a founder, you certainly lose credibility with enterprise procurement. You also lose credibility with like mid-market and enterprise security teams. And if you aspire to serve both markets, you cannot do this. If you aspire to just serve founders, we are actually like, maybe this works. We don't want to play that game.

[00:14:14] Um, and then the thing that changed was someone in March or so published a 70,000 word anonymous, deeply researched, very online investigation into all the practices. And that just like caught fire on Twitter. Right. For a week. And how much of your business is SOC2 right now? And how much are you trying to make Fanta an overall stamp of this is like a safe partner?

[00:14:41] So we actually don't break it down by standard anymore. But I would say SOC2 alone, actually very little now. Obviously, or like not, maybe not obviously, but often it is the entry point for an American startup. Yes, that is the first thing. But if that startup stays alive, they're adding on different frameworks or adding on different product areas. And one switch we made over the last four years is talking much more about the product in general and its feature set versus just a SOC2. Kind of for the reasons you imagine, right?

[00:15:12] Now there's lots of ways to get a SOC2. We can quibble about quality. But to your earlier question, the dominant brand is SOC2. It's not Audit Firm SOC 2 or even Vanta SOC 2. While I would like it, SOC2 has a ton of brand stickiness itself. And for SOC2, do you also use outside auditors? Like is Vanta giving? Why doesn't Vanta just give the stamp instead of outside office? Well, per SOC2, you basically can't audit your own work. Oh, and because you're helping them do the work. We are helping them do the work. Right. Yes.

[00:15:42] So we have always worked with outside auditors. Again, early in the company's life, we had all these debates and had that, you know, it's like, why can't we just be the auditor? Maybe we, you know, get some friends to start an audit firm. That sounds good. And we're basically like, it sounds good in the short term. And that looks terrible in the long run. And it kind of doesn't pass the front page test. And so don't do it. We've had competitors who've done all of our, like have the friends started, have the former employees started, whatever.

[00:16:08] But we've just been like, that's, that, that doesn't, if you're playing the long game, that will not work. And so just to be clear, do you think Delve behaved unethically? Yes. I think they told their customers, we are implementing security practices for you. And they were not. And I think they, or rather, I don't know, the sub stack suggests they knew the auditors they were working with were not rigorous in looking at all of the things they should.

[00:16:36] And in response to knowing that sent them more business. And now I've said, okay, we're going to try and clean up our auditors maybe a little bit. Have they gotten away with it? I, I think no. And just like, I mean, I know what percentage of their, you know, call it February customer base Vanta has, which is. You had a lot of customers say, oh no, redo it for us. Yeah. Or we're in the process. We maybe thought we did it. We did.

[00:17:05] But just like those days, I mean, like so much new business. It was just like immediate exodus. And so I don't, you know, I, this seems like not the brand to try to rehabilitate in the space to try to do it again. I think those founders could go build something else very successful in another space. A very different company. One that likes to do everything. Rippling is now running its sock too. What? I don't know. Have you seen them in the marketplace?

[00:17:35] We actually, I mean, we certainly saw the announcement and I think they are, I mean, this is not, I think everyone thinks they are aggressive and ferocious and not to be underestimated. We haven't seen them much yet, but we are, we understand they are aggressive and ferocious. I want to like zoom out and like just talk security for a minute because, I mean, AI seems like it could be sort of a total nightmare for security.

[00:18:01] It empowers, you know, every rogue actor in the world with, you know, intelligence to fire up and create, create voices to, you know, so many new vectors of attack. Like what do you see and what are you recommending like that the startup world does with this sort of like new AI vector of attack? Yeah, I think it's, I think, I mean, maybe to state the obvious, it's going to be really interesting and fun on some level.

[00:18:26] But security overall is just this, one of the things that drew me to it is this kind of cat and mouse game where like both sides are quite smart and sort of an ongoing, you know, competition. And I think these models, well, we can talk about whether they will, you know, send us all into like UBI land and make us all potatoes or something. They seem, you know, quite good at finding vulnerabilities in code, at least like as a discrete statement. And that is something we will like all have to grapple with.

[00:18:52] And so I kind of do subscribe to the, I think even if you are like an AI maximalist, security companies, cyber companies, more important in the future, not less. AI is like this huge tailwind for them. And I think actually during this founder point, I think founders will have to care about this earlier in part so they don't, nothing happens and, you know, they don't become a bad Twitter headline.

[00:19:15] In part because I think enterprise procurement teams are going to push on them because the enterprise procurement teams or enterprises get the how worrisome this is. They will push it on procurement. Procurement will push it on the founder. So I think that's the other vector, whether or not the founder kind of intrinsically thinks about this. The AI of it all. How much do you find like leverage for your own business? So much. Okay. So much. So much. I think twofold.

[00:19:41] As someone to be clear who started this conversation being like, oh, the AI hype is out of control. People are. Yeah. I just say that to contextualize for the listeners. AI skeptical that this is coming from someone who sees some of the over exuberance. Yeah. I would say like in the market. I mean, also in tech, but like in the market. But yes, some of that of over exuberance is a nice word for it. Also, I think parts of the tech are real. And I think it's getting in the purchase that aren't. Some of them are getting better very quickly.

[00:20:10] So betting against the tech getting better is rather silly. It's like betting against San Francisco a couple years ago, like rather silly bet. But yes, I think a couple of things. So one, we see a tailwind and we've seen a bunch of acceleration in the business because there's more startups being created. Some of it's just customers. Exactly. Customer creation.

[00:20:31] You know, like everyone cites, but the best we have like this publicly, the Stripe Atlas stat of twice as many companies founded in January 2026 as January 2025. I'm like, well, they all survive. No, but like 2x on your baseline is pretty good. So you see that a lot of the compliance workflows are pretty manual and workflow based. And so there's just things we can automate now. We couldn't have two, three, five years ago. And that is very cool.

[00:21:00] There's product experiences we wanted to build. We couldn't. We can now build. Great. And then the other part of it is, while exciting AI, it's also very scary, especially to enterprises. And like, what are the models doing? What are the agents doing with what data? What the heck's going on? And that just like that scrutiny is like right in those questions are like right in Vanta's wheelhouse. Are you having engineers come to you and say, you know, like potential customers and say, I'm just going to ask Claude, like make me SOC 2 compliant. Yeah, we've done that too. Yeah, yeah, yeah.

[00:21:31] So, yeah. And we actually every, what are we doing? Probably once a month we'll like try to rebuild Vanta with Claude from scratch. Just not that we're probably going to use it. Just so once it's possible, you know. Exactly. Exactly. You don't want someone else figuring it out first. And there's a bit of rebuilding software is still hard. I think the places where at least internally we've seen, we are much more likely to rebuild software and do it well is when the process is fully internal. It is just, it doesn't touch a customer. It doesn't touch a partner. It doesn't touch an auditor.

[00:22:01] It doesn't touch a regulator. It's super internal. Those are the places where you're like, we've experimented. We have some stuff. We've done some stuff. I think talking to folks, those are the places. I think when it touches regulation or audit or a place where like you want to be correct all the time. That's when like, yeah, maybe you can build some version. But like, do you want to maintain that? And I'm sure that probably not. When you're talking about regulators and compliance, it doesn't matter just what the output is.

[00:22:30] It matters how it got there. Exactly. Whereas when it's just internalized. I don't know. An IT ticket that your team has filed to get access to Figma, whatever. Pick your favorite cloud, whatever. Pick your tool. Pick your tool. Like, pick your tool. What are sort of the next standards? What is the next SOC 2? Or what are the other compliance standards? There's a host of... So the other big... So, okay. SOC 2 is done by the American Institute of CPAs. Started in the US. We've exported it.

[00:22:58] Like, we've exported lots of American culture. There's a Swiss standard body called ISO, International Standards Organization. They do a set of standards. I think a lot of these standards bodies are professional associations or nonprofits. They're basically communist standard setting bodies. We've got to get everybody on the same page. And then it's just hard to respond to technology quickly with that. So some of them are flawed. Are you... You're not embracing them? No. I mean, we are. Or like...

[00:23:26] But I think it's just like they have deliberative bodies that purposely... They're like the US legislature. You're like, there's a reason this is large and like has lots of constituents and takes a long time. And that is like a good thing baked into our founding principles. But when you talk about like you want an agent standard... Right. Is that happening? Or are you going to do a proprietary one? I think that like... To the audit your own work, would it... If it's just a Vanta standard, would it work? Like interesting product debate. Again, you're a team customer. That continues to be the posture rather.

[00:23:55] But one of our PMs has made a like agent runtime monitoring standard that we actually gave to the Cloud Security Alliance, but like consortium of cloud tech, cloud security tech companies and truly gave it to them. But of like, here's an agent runtime standard. You all are in a much better position to push this than we are. That's called ARM, A-A-R-M. And so there's like things like that that I think we will continue to do. But we will not... I think... I'm not sure.

[00:24:24] I understand why Vanta the business wants the Vanta standard. I'm not sure that solves problems for everybody else. I don't know if this is too far afield from what you do, but I'm very interested in this problem that we don't have yet really right now. But you know, agentic commerce. Yeah. This idea that I have an agent. You know, one of my Cerebral Valley co-hosts, Max, I think had a Claude bot like bidding on a wine auction site on his behalf and lucked out that it didn't way, way overbid. Only like slightly overbid.

[00:24:53] But you know, we're empowering these agents or will be soon and can now to spend money on our behalf. Like that could unlock like a ton of spend because they're like, you know, it's like, oh, it's sort of a buy first question. Later, you... Yeah, it's very obvious how you open up a new spending avenue when you have an agent spending on your behalf. Like who do you think governs that? Or do you have any sort of view? Like do you play any role? This is far from what you do or... Yeah, kind of.

[00:25:22] I mean, I think to that, like one of the tough parts of all of that is these things are non-deterministic, which we all know, but it's not like you can like stick a bunch of lines with capital letters and exclamation points in your agents MD or your Claude MD and then it like won't bid up all the way. Like, I don't know. You can suggest it doesn't bid up all the way, right? And so one of the things we've experimented with internally is like, how do you... How can you insert deterministic guardrails in some of this? And it's actually probably not the prompt files because again, those are at the end of the day, best efforts.

[00:25:51] And so we've played with this around consent, like agents that ask for consent and agents that collect sensitive information or like credit card numbers or these places where you're like there are existing obligations to keep this stuff secure. You can tell your agent not to accept a social security number, a credit card number, but it might. Right. And how do you think about determinism there? And so I'm like more optimistic about that given, again, given how all the prompt files are like best effort. Feels like we're going to have to, we'll change norms too.

[00:26:21] Yes. Or it'll be easier. I think that's true. There'll be sites like if Amazon accepts agents, they'll let me unwind. Right. Because Amazon would obviously benefit from the sort of like willingness to just like... You want a white t-shirt? I got you 17. Great. Great. I'm ready. Yeah. They're probably okay with that to take the increased spend. So then we just evolve new norm. Does that world feel close? Yeah, some of it actually. Or do you think I'm too AI-pilled here? No, I think it does feel close.

[00:26:51] I think we're starting to see it in some of like the AI assistant sort of things. Yeah, where you want to send them off. And I think the, we related to the wine thing, but the one thing I built for myself, it's very silly, is like there's a couple like specific products where you're like, okay, if stuff like this shows up on eBay, like tell me immediately. And I don't want to check eBay every day and eBay alerts aren't, you know, and I want 17 eBay alerts. Anyway, whatever. You want to tell us what category this is or? Oh, it's close. It's like maybe not surprising. I thought it was gonna be Pokemon cards, you know what I mean?

[00:27:21] No. It's like very specific, like vintage clothing, which cool. But like there's definitely price thresholds where I feel like just buy the thing. Like don't let anybody else buy it if you find it. Yeah, totally. What, you know, you worked as an investor briefly, right? Yeah, two years. It was early stage. Yeah, it was Union Square Venture. So it was like CDMA. Yeah. The best of the best early stage. The best of the best, yeah. What, I mean. Prestige brand.

[00:27:47] The investors, I guess, are culpable for some of the media that we're seeing right now. Yeah, I mean, let's, you know, usually I ask VCs to talk endlessly about founders, to have a founder, you know, talk about the VCs a little bit. Like what, there's so many trends happening. One, I mean, there's this rise of like the mega funds. Yeah. From the founder perspective, like how does that change your life? It's funny. I actually think it, sorry, I was an investor 15 years ago. So I got the one old.

[00:28:17] But like dude, so long ago. And I think over the last 15 years to the mega funds, it's like now almost everyone is playing an AUM game, an asset center management game, right? It's a mega funds. And you're like, well, first you've got to raise them and then you've got to deploy them. And the faster you deploy them, the more you can get another. And then like fees off of that. And while most, I think, firms aren't so craven to like just think about it as fee maximizing, that's like definitely a powerful economic incentive. Like the faster you deploy, the faster you can raise another one.

[00:28:47] And so there's just like the amount of capital in Silicon Valley philosophically, not just like the geography. That's how I use it. Yeah. The geographic version of it, or sorry, not that, the philosophical version of that is like so much greater than 15 years ago. And so there's like one, there's capital everywhere. You know, again, when I was at, I mean, it's like so cute to think about the rounds when I was at USV, which right before I got there, it was like 1 million on 4 or 5 million

[00:29:16] dollars, you know, seed rounds. And then when I got there, it was like three on 10, you know, and you're like, what even are these numbers now? But because there's so much money choosing so many things, you can get funded. I think everyone's incentive is for you to like raise larger and larger rounds again because of the assets under management. I think you've seen a lot of these, what used to be a like artisanal game is now like a financialized profession where they are bigger firms.

[00:29:45] They operate more like a Goldman Sachs than a Allen & Company, to use the investment banking thing, right? It like used to be a bunch of Allen & Company equivalents or these like boutique-y. But people say you still, you know, pick based on the partner, not the firm. I think you still should. I don't think very many people do, but I think you totally should. But they behave like Goldman. It's like one comes in, one comes out. It's like the firm backs you.

[00:30:11] I mean, for you, it's, I guess all that capital is great because they're creating new customers. Yes. Bad, these are creating new competitors. I assume. I mean, some of the companies you talked about. I also think just, I mean, I'm probably too, I think I'm too like Pollyanna-ish about this because making money has always been a core part of Silicon Valley. And, you know, all the critiques I'm about to say, you could apply to 1999 too. But I do feel like there's something of a social contract that's just broken or different.

[00:30:40] The old Silicon Valley social contract was you join this company, you get equity, we will all be rich together. And that was different than the East Coast semiconductor firms in like the 70s. And it was different than finance or consulting, you know, 10 years ago, 15 years ago, whatever. And I think we've seen now a handful of acquisitions that are like, oh, you're at equity in the company? Right. All these Aqua. Okay.

[00:31:07] People call them Aqua hires, but they're like licensed and poached deals basically. Yeah. And I do, I mean, again, straight Pollyanna-ish, also probably I live in a glass house. So, you know, I'm going to regret this. But like those are just feel like philosophically different. And a bit of like, that's why the Trader S8 left Shockley semiconductors because they didn't have economics in the thing. And like they and like a handful of East Coast or like West Coast venture capitalists started Silicon Valley in like 1970s sense.

[00:31:37] And it feels like we've now kind of forgotten some of that. And it's like, oh, I'm the founder. I get it. Right. Well, there's a funny evolution. So one, it's like we have old school venture capital, which is clubby. Yes. Stage financing. It's sort of like. It's fair. It's like the stage financing is good because it feels like you have to prove your business along the way. Whereas right now firms, if they just want to deploy capital, they just sort of keep investing in their own companies. Yeah.

[00:32:06] There are these lessons that sort of doubling down on ownership is the way to win. The progressive quick financing. Right. To make you seem like a winner. Exactly. Ergo, you're a winner. Which I think is not wrong. Like that logic might not be wrong. Right. Yeah. I feel like the next wave is just what the sort of small business or like the three person business that raises very little money and uses sort of AI tools. Okay. To forego venture capital. I really like that vision.

[00:32:35] Who's doing that today though? It's like all a story. I feel like. Well, I mean, mid journey is the sort of the best example of like refuse to raise funding. Yeah, I know. I'm sure they say. I'm sure they made a lot of money. Like I think. Yeah, that's fair. Like everyone's great. And now they're like exploring other things. So I think they did pretty well. I don't know how much it's like, you know, not by venture capital standards, but they don't have to play. Right. By that same game. I think there was there was that famously the New York Times did a profile of. I know exactly.

[00:33:05] The one person business. It was then secretly a two person business that then it seemed like it was pretty made up. I'm clear they exist today. Yeah, yeah, yeah. So our I guess archetypal example was potentially. Right. Fake, which is, I guess, very of the AI moment. Yes, exactly. Yes. So, yeah, you don't you don't feel like looking at your like friends in Silicon Valley. That's a true story. No. Right. No.

[00:33:30] But I kind of wish it were like the businesses that I think that stuff used to get derided as lifestyle businesses. And those are kind of like, oh, you're not ambitious. You're running a lifestyle business. Right. Where I think often it was like, oh, you're just running a proper business yourself and you own 100 percent of it and you control your own destiny and make your decisions and can pull out millions of dollars a year if you want. You're like, that's actually a nicer dynamic than. I run a lifestyle business, not to pull millions of dollars out of it a year. But yeah, otherwise.

[00:34:00] You think about like where your situation versus like pick your growth stage founder, you know, different problems. But like it's not obvious to me the growth stage founder has it any better than you do. Although they get more. I don't know. They could probably get invited on more podcasts. Well, you just host your own. There you go. That's your constant. Yeah. I don't know. They're, you know, media is just like I've never tried to fundraise. I sort of like had the advantage of the sub stack paid a better salary than Bloomberg.

[00:34:26] Eventually I had money where I was like, oh, I should spend it on have an employee make my life better. Get the business in a better place. Then we figured out events. So you hire a few more people. Yeah. It's always had this like logical, somewhat linear type growth, you know, up and down. Not the type of thing you'd tell some amazing story. I'm like invest in me. And then just raising capital once you own all of the business to sell like 10%. Yeah. It becomes like why?

[00:34:55] Right now I don't report to anybody. Yes. Then I report to you for like a little bit. Like it's just like so it's never really made sense. Yeah. Besides the like sometimes envy it media companies that raise money so they have a valuation. Right. And then people can go. Oh, this is a big deal, you know. Yeah, yeah. And I guess I, you know, I, I don't know. I'm learning this as I go. Yeah. Do you feel like it hurts you in attracting talent? Even if competing against media companies? That's a good question.

[00:35:22] I, I'm sure, I'm sure it does from like being like semaphores or it's just like, I think, you know, I'm attracting sort of people who specifically get what we're doing. Yeah. You know, I mean, some of it, I have sort of a mix of people who came up through the business, people I had deep relationships with who sort of got it. And then I think our new, two newest hires, you know, both were sort of like venture ecosystem.

[00:35:49] So in some ways they got what we were doing more than necessarily were purely chasing like the best media opportunity. Yeah. And so I do think in sort of what, you know, I want to be sort of really strong in startups and venture capital. Yep. And so less in sort of like a media ego game and more people who really get venture. Right. So then I don't know that it matters a ton, but it's an interesting question. Yeah. That would like, I think people would say things about it, but again, in reality, does it

[00:36:19] like for your, does it hurt for your people? Like, I feel like the fault of like the software engineer is that they chase high valuation companies instead of companies that see upside. And so in some ways that is so that's sort of the inverse of what you're talking about, which is like, well, they could make the mistake of seeing that you're really established and legit and therefore you want to join like right before the big fundraising round, not right after, but everyone joins right after. Right. And that's just like always the case. Always the case. Yeah. Yeah.

[00:36:49] I mean, what is your recruiting strategy today? It is for engineers or just, yeah, for sort of high leverage roles. Yeah. I think a lot of it is in this AI moment, the people or the companies that win will have distribution, product market fit demand, and like a bunch of data to use as private tokens and do things that like the models can't. And turns out Vanta has those things by virtue of having 16,000 customers.

[00:37:19] And, you know, you pick your... Do you sell them on why this business is sort of differentiated and why they should bet on this case? And so it's that at a business level and then on a product building level, again, you're like, here's this domain that might seem sleepy and boring that is so amenable to agents. Come build them here. Again, with the private data, the private tokens, like with a team that is like running evals and like doing the things like come do that here.

[00:37:49] Do you want to be an accounting firm? No. No. What is the... Oh, like financial accounting? Yeah, yeah, yeah. Well, I just think of areas where agents are sort of independently doing compliance that people are... Yeah. I think we have our own parallels in like IT accounting, IT attestation, that's what it's actually called. But like those ideas applied to like a IT security domain, but not the money part. We're not going to go compete with it. What, digits and... Yeah. It's also just like a very... To the enterprise, it's just a very different buyer. Like we're like CISO org.

[00:38:19] CFO is a whole other ballgame. We got into the investing piece. I mean, in the news, talk about an early stage prestigious firm. I mean, Benchmark... Yeah. Now, I think the Wall Street Journal is saying that they're raising a growth fund. I'm curious, like... Yeah, it's just like everybody's accepting this world of like mascot. Yeah. USB might be the last sort of elite holdout. I'm sure there are other... I mean, what? Like... I don't know what Forerunner's doing, but I think of them as... I mean, Forerunner always had... Yeah. But they had like bigger funds. Did they? Okay. Yeah, yeah.

[00:38:49] Yeah, yeah. They... I think they certainly had billion dollar funds. I think their earlier stage funds did better, but you know. Yeah, yeah. I mean, there are people like Bloodgate. Like to some degree, I don't hear about them. I don't know where they've made this for the next generation. I just like haven't. First round? Oh, yeah. Have they gone bigger? I don't know. Yeah. But I was just trying to think of like... Oh, yeah. First round, I think, is holdout. Like who's in this court? Yeah, exactly. Right. So what do you... Yeah, what do you make of Benchmark? Allegedly. Oh, I think it's... What do I think?

[00:39:18] I think... I like... No... I don't know really anything... No, you're like... No, I know. I'm just impining. Anyway, so like classic VC over here. We're impining on like stuff they don't know. Back at ya. But I do, I guess, kind of read it a bit as... We tried to not play the AUM game and it doesn't work. Um, and maybe it's a... And I don't know if it's a like... We felt like we compete and win founders' approval or they'd want us to do the deal and

[00:39:47] then it would fall apart because they would get a... Because we couldn't write the check size. There was so much money. We don't have a credit on it. Exactly. There's so much money and it's like... And we... And we still want to lead deals with founders we like and so you've got to write bigger checks so you've got to have bigger funds. Right. Like that's just like the surface... For a long time, to the extent you can hold on and say, we're Benchmark, we have our unique terms. Right. It's a great model. Like you want to hold on to that for as long as you can because then you're getting...

[00:40:15] You're getting ownership at a better price and then people quickly mark it up. Also, there's like a... Again, all of Silicon Valley is a status games and there's a status piece of that. It's like we don't have to compete on everybody else's playing field. Yeah. So good. I did a piece, you know... Prestige brand. Six months ago. Yeah. I mean, they were down to, you know, three guys. Yeah. Peter Fenn, Eric Vistria, and Chayden Pudiganta. You know, and it was pretty negative for like a great firm. I mean, I said in the piece that like... There were some good tweets of that era. I mean, yeah.

[00:40:44] Well, I think I'm getting ahead of like the like benchmarks doing just fine. Yeah. I think my point in the piece, first of all, was that like LPs, you know, always make sense to invest in benchmarks. Yes. And they would do very well. And certainly I saw that Cerebrus like was a good investment. I don't think I knew it was like going to be the level that it is, but still. And I will say on the Cerebrus front, it was outside of the typical benchmark behavior. Yeah. They... It's hardware. They did... It's too tech. No, no, no. But like even they raised a standalone set of money to invest in it. So they did...

[00:41:14] That was a growth deal before this growth fund. Yeah, that's fair. Anyway. So now Benchmark, you know, more than half a year later has hired Ev from KP. Yeah. They brought on Jack Altman. So now they are back at five. Yeah, they're back. And, you know, my whole point in the piece was they were holding on to an old strategy and claiming the new partners run the firm and it's a dynamic firm. Yep. But not letting the new partners reinvent the strategy.

[00:41:42] And so clearly now they brought in these new people. Ev, you know, has a background in growth investing. He came up through Bond. Sorry, Benchmark is the ultimate like Silicon Valley really is a small world. You know, you've met many... You know these people. Like it is... I mean, do you miss... I mean... Is it still a small world? Do you miss it? Like at once I was sort of saying earlier that like the old venture model, you know, is elitist and a closed club.

[00:42:08] But there's something nice about the community where sort of people have reputations, people know each other. And therefore, if you're a bad actor, your reputation matters. Where in this world it feels like... Does that always happen in venture? No, people are dicks back then. Now that... You're right. Now Andreessen would say, you know, we have to be more founder friendly where it used to be. I don't know. What's your view on this sort of small world of Silicon Valley? I think it... I mean, it definitely is a small world. And also San Francisco is a small village, not a city, you know, a small hamlet.

[00:42:38] And like everyone knows everyone. And there's parts that, you know, it's like the great and terrible parts of that are everything you'd imagine. There's... I don't have anything interesting to say. Anyway, I think the parts of venture that are compelling is done right. It's a really like intellectually interesting job because you're just like learning about new stuff, trying to figure out which way things are going and applying that. You get to talk to smart people all day long and you get to bring them in and be like, I don't know anything about, you know, chips. You explain it to me.

[00:43:08] Hopefully you're slightly more elegant than that. But like then they do. I think it's like being a journalist in that. Right. You get to sort of learn everything, get excited about other people's business. Ask all the questions you want and be able to answer them. It's really cool. I think there are definitely parts I struggled with was they're not teams. Like it's not like a soccer team. At best, it's a swim team running relays. But like you are in the pool alone. Right. Even at the most teamy firms, it's like investing. And all these venture firms have like fucked up dynamics. All of that. They're all like... Yeah, yeah.

[00:43:38] They are like... It's funny. They're like... 10, 15 years ago. They're like your uncle's small business. Your uncle's small... But whatever. It's like your, you know, hometown small business. They just happen to manage $3 billion. And then like... But it's like the uncle's small business or hometown small business dynamics with $3 billion. Which sometimes just creates... I feel like we're seeing the path not taken. Or the psychology here is you're like, oh, this was the other life that I did not pursue. Yeah. Like do you think... Like was Vanta more successful than you thought?

[00:44:08] Or like there's a world where like... I can't say that. No, I know. I just... No. Just like there's a world where it's like, oh, I've been a VC. I feel like there are all these VCs who are like, I should go build a business. Yeah. And then it's freaking hard. It's real hard. But then you're like, oh man, I built it like a real business people are excited about. Or like... Yeah, yeah. How does it... Is it... Has it gone sort of as you imagine? I don't know. I think it's like... You probably have a version of it. It's both. You both... Like when you start these things, you're like, yeah, definitely it's going to work. Like otherwise I would like go the other path.

[00:44:37] But like, um, I got this. And then partially being like, statistically, no one has it. You know, statistically, these things don't work. And both are true at any point. And so it's like kind of balancing those two. Um, I think a thing I've done is I actually do really like the work of company building. Which one I'm just, I feel very lucky for because it's like infinity work. Um... Like the team part of it? Like the team part of it. I like the, you know, where like Vanta is both doing fantastically well.

[00:45:05] And there's 9,000 things that are messed up. Um, but there are 9,000 different things than used to be messed up. It's kind of, there's always 9,000 things, but they change. And that's actually what I feel really lucky for. Because I think the like insanity and I hate this and burnout is when it's like, no, it's, it's broken in the same way. And I've tried to fix it and I can't. Exactly. And that's when it's like, forget this. I feel like that's what I'm learning right now. It's like, okay, you can have problems. They can't be the same problems.

[00:45:33] Like if you have the same problem, you need to solve it or something's not working. Yeah, yeah. But if there are different problems, that's good. You're growing, changing, you know, whatever. Totally. And it's like, don't measure how many problems there are because there are always 9,000. And that's, that you're just going to lose. But I like, do, so do the path not taken? Like a little bit, but I actually really like the work. Right. You know, I find it like hard and rewarding and interesting and it changes and I get to learn a bunch of stuff and like, I'm only sort of good at it and I get better than it changes.

[00:46:01] And like, I really like that. Christina, this was so, so nice to have you on the podcast. Thank you so much for having me. That's our episode from AI haters to sock two compliance havers to failed candidates for the governor of California. This is the newcomer podcast where we chop it up on all things Silicon Valley. Thanks for watching. Please like, comment, subscribe, go read the newcomer sub stack if you want to get really in the weeds and understand the real business of venture capital and startups at newcomer.co.

[00:46:31] If you still yearn for podcasts, I've got the Cerebral Valley show with Max Schaul and James Wilsterman. Otherwise, probably see you in about a week. Thanks for all your support. That's our show.