Christina Cacioppo - Building an Enduring Software Company in the Age of AI - [Invest Like the Best, EP.496]

1. Key Themes

Software Is Only As Good As the Last Thing You Shipped

Cacioppo attributes Vanta's win in a crowded category to relentless shipping, not first-mover advantage. She argues that AI has made this truer: when a product can be recreated quickly, only constant differentiation counts. Her second pillar was integrations, which became a proprietary data foundation (the "trust graph") that now powers the agent.

She said: "Software, the blessing and the curse, and this is more true now even than it was 5 years ago, you're really only as good as the last thing you shipped. You can be first and you can start it, and doesn't really matter. And it is more true now because it's like someone can vibe code your thing in a weekend." 00:03:31 On the data layer: "now you can connect Vanta to one of 400 tools. We pull a ton of data out of those tools, and that's what powers the automation, the agent, the AI, all of that. We call it our trust graph. It's really just like a security data lake, and that is bigger, broader than any other provider." 00:03:55

The Cognitive Dissonance of Strong Fundamentals and Compressed Multiples

Vanta is growing fast at high margins, yet the public and private markets now pay a fraction of the old multiple for system-of-record SaaS. Cacioppo has to hold two beliefs at once: the long-run economics are fine, and the short-run game (financing, hiring, talent) is shaped by AI maximalism.

She said: "I think in the fullness of time, a 80% growth business with 80% margins will actually be better than, over the same time period, run it out long enough, a 160% growth business with 30% margins." 00:05:46 On the investor environment: "Talk to firms that are like, 'Yeah, we'll invest in the labs, and we'll basically invest in tractors in Iowa. Nothing in between. Robot tractors in Iowa and a lab.'" 00:06:31

Agent-Forward Product Design: From Alerts to Delegated Action

Vanta's product is being reoriented around an agent that does the work and asks permission, rather than dashboards that raise alerts. The UI itself is generated on the fly, and Vanta is deliberately not building traditional SaaS features like embedded BI.

She said: "Someone just left your company, and you didn't get them out of all of their accounts. I just wrote a custom agent for you that will go do that. Do you want me to go turn this on? Great. Do you also want me to go remove accounts access from these three people?" 00:09:10 And on UI: "Oh, you want reporting, we'll have our agent go make charts for you on demand based on all of our data. We're not going to like put Tableau inside of Vanta, which is probably what we would have done in 2022, 2021." 00:43:06

Token Pricing Is a Trap; Usage Comes Before Monetization

Marking up model tokens invites direct comparison with the labs, and customers are sophisticated enough to notice. Vanta is eating token costs to drive usage, betting on retention and experience now, with pricing sorted later. Outcome-based pricing is the stated goal across the industry, but nobody can agree on the unit.

She said: "People are real smart. So if you try to charge them based on tokens, they're very quick to say, 'Oh, you've just marked up a Claude token 4x. Are you 4x as good as Claude?'" 00:09:41 And: "We're taking lower margin and really concentrated on usage... we've got 25% of all of our customers in that sort of flow right now. We can get that to 75%." 00:10:34

Evals and Subject Matter Experts as the Quality Engine

Vanta's agent is "hundreds of agents" with specific tasks. The quality system is evals written by domain experts, who are former security and compliance practitioners, and then evaluated themselves. Because Vanta's agent is decision-action oriented rather than token-hungry like coding, they swap models for quality, not cost.

She said: "Really invested in using our subject matter experts, so these are the folks who like ran security and compliance programs at other companies, to write the eval frameworks, and then eval their evals, and using tooling for that. When we think about model swapping, it is mostly quality, it's not cost." 00:11:39

Adopting AI Is a Behavioral Problem: Get People "In the Muck" and Find the Real Blocker

Leaders must personally use the tools and re-calibrate every two weeks. When strong people don't adopt, the cause is often hidden risk aversion rather than lack of motivation. Vanta's onboarding team kept proposing wizards because they weren't "allowed to fail."

She said: "Definitely use it yourself. Build for your company, personally, does not matter... Do that at least every 2 weeks, because it just changes so quickly." 00:18:00 On the onboarding story: "They were like, 'We basically don't think we're allowed to fail on this project.' 'Oh, that's the thing? Great. We're just going to bet that the LLM flow is going to work and we'll make it work, and we will hill-climb all we need to, but burn the boats.'" 00:20:31

The Talent War: Comp Inflation, Valuation Narratives, and Context as the Underrated Asset

Top-end compensation has risen roughly 10x in five years, and she expects it to keep accelerating. Competitors recruit with step-up valuation narratives. Vanta counters with transparency and data. She also argues that company/customer context is undervalued relative to vertical skill.

She said: "Total comp, it's probably like a factor of 10." 00:24:12 And: "My comp philosophy is you never pay the top people enough." 00:24:16 On context: "would take a worse salesperson on sales skill who knows the Vanta pieces more." 00:28:09

Security Prioritization Is Being Inverted by Machine Persistence

AI models chain together low-severity findings into serious exploits, collapsing the old "fix in 90 days" triage model. The endpoint is continuous agentic pen-testing paired with automatic remediation, with humans writing rules and evals rather than making every decision.

She said: "These models are able to chain 17 benign-ish or benign-on-their-own things together and then really find something." 00:35:32 And: "you've just got to fix stuff as fast as you find it... if you're fixing things at machine speed, you don't have to prioritize." 00:36:06

Trust as the Scarce Resource in an Era of High Excitement, Low Trust

Vanta's long-term thesis is that as AI proliferates, tech trust erodes and the burden of proving industrial-grade security grows. Vanta sits between both sides of the trust marketplace.

She said: "We just don't trust software companies, tech companies, the way we used to. And that is getting worse year over year." 00:53:58 Patrick summarized and she agreed: "AI has ushered in this extremely high excitement, but low trust" / "Rebuild trust. And yeah, increase the trust legitimately so, not just on vibes." 00:55:03

AI Is Driving Modernization Budgets in Governments and Enterprises

AI FOMO has turned previously unfundable modernization and risk-program overhauls into funded priorities, creating a new buying motion.

She said: "Their jobs are changing because of AI, and they're saying, 'Oh, given AI and like the risks from the agents, I would like to overhaul my enterprise risk program, and I would like budget for that.' And I think if they'd said, 'I want budget for my enterprise risk program,' 3 years ago, people would have been like, 'Uh, we'll talk about in AOP. Maybe.'" 00:48:21

2. Contrarian Perspectives

Post-Training Models Is Mostly a Marketing Exercise

Cacioppo says custom post-training is largely for investor and customer optics, not quality, a view she attributes to inference providers when pressed. The legitimate reason is cost, which only some businesses need.

She said: "Go talk to the inference providers and sometimes give them, depending on the provider, give them truth serum. They will say like, look, the reason to post-train a model is cost... there is not a quality reason to do it... Mostly for investors, actually." 00:29:04 She compared handing customers a model to the pre-pull-to-refresh era: "I don't think anyone actually wants to be handed a model, the same way it's like hitting a refresh button." 00:30:38

Forward Deployed Engineers Are Mislabeled Professional Services With Upside-Down Economics

The FDE trend is a talent-arbitrage rebrand, like Chief of Staff, that only works at Palantir-scale contract sizes. At five- and six-figure contracts, the economics don't hold.

She said: "I kind of think FDEs are crazy. I think it's a great talent arbitrage... What FDE often is is professional services." 00:31:15 And: "I think we're using all FDEs in a place where there's like five- and six-figure contracts, and those economics probably are upside down." 00:31:46

The Open-Source Ecosystem Is the Under-Built Opportunity, Not the Labs

Investors have decided open-source models will be real, but the surrounding tooling and deployment companies are far less developed than the lab-centric stack. She sees that gap as the opportunity, while labs and inference providers have high entry prices.

She said: "It feels like the discourse and kind of the certainty around the open source model providers, and then the like the tooling and the companies around them, feels sort of disconnected... Basically, a bunch of the lab playbooks seems like they should apply to the open source models." 00:45:29

Outcome-Based Pricing Is Loved Conceptually but Likely Unworkable in Practice

Despite industry consensus, she argues the unit-of-work problem creates cognitive overhead no customer will tolerate.

She said: "Everyone I talk to wants to get to outcome output pricing, but it's really not clear how you get there." 00:13:26 And: "I just named three things. I could name another 47... no one wants that." 00:13:01

Founder Quality Doesn't Rescue a Structurally Doomed Market

She sides with "market wins" in the market-vs-founder debate and argues AI has turned some formerly attractive markets into brick walls.

She said: "I think this AI technology shift has made what some markets that used to look really good look really bad. The best person in the world can run in that, we'll still run into a brick wall." 00:15:40

3. Companies Identified

Vanta

Security and compliance automation platform (SOC 2, ISO 27001, HIPAA, security questionnaires, trust centers). Cacioppo's company: about 16,000 customers, five products, 8 years old. Her ambition is a big independent standalone company. Why mentioned: She described its agent-first evolution, the trust graph data foundation, and its plan to expand across security domains. "Today, we're about 16,000 customers global with about five products." 00:02:56

Notion

Workspace and productivity software company. Mentioned as a leader in modularizing its codebase so coding agents can work effectively. Why mentioned: "I know Notion has spent a bunch of time in, and they were like 9 months ahead of us on, is modularizing parts of the codebase so that the agent can just understand smaller parts of it." 00:14:04

Bending Spoons

Acquirer that buys mature software companies and runs them on an efficiency playbook. Why mentioned: Referenced as the feared "grim reaper" for incumbent SaaS, and as skilled at identifying structurally challenged markets. "I think Bending Spoons is very good at identifying these, where you can put any entrepreneur in the world in that structure." 00:15:40

Palantir

Data analytics and deployment company known for forward deployed engineers and very large contracts. Why mentioned: As the company that makes the FDE model work because of contract size. "The company that we all think does this well is Palantir, and I think they probably do. They have eight-figure contracts." 00:31:46

CrowdStrike

Enterprise cybersecurity company. Why mentioned: She expects it to do continuous pen-testing and remediation better for large enterprises, leaving Vanta to focus on a different segment. "I think CrowdStrike will do it better for an enterprise." 00:36:48

Wiz

Cloud security company whose customers and pricing start at multi-thousand-person companies. Why mentioned: Vanta sees an opening below Wiz's price point. "Where are they unlikely to go pay $150,000 for a Wiz, but very well could pay 40 or 50 for something suited to them." 00:37:30

Anthropic / Claude

Frontier AI lab and model. Why mentioned: Used as the benchmark for token pricing and as the model behind Vanta's new onboarding experience. "Oh, you've just marked up a Claude token 4x. Are you 4x as good as Claude?" 00:09:41 On onboarding: "It's basically Claude, big canvas, drag all your messy files in." 00:20:04

OpenAI

Frontier AI lab. Why mentioned: As the model for the lab-style deployment playbook, and for a security talk at RSA. "If you watch the OpenAI talk at RSA about Hugging Face, it's basically that." 00:35:32

Qwen / Chinese Open-Source Models

Open-source model family used by many French software companies. Why mentioned: For business-continuity reasons. "A lot of the French software companies in Paris are using Chinese models predominantly... we can't trust that if we build a business on one of these American models, they'll always be available." 00:33:02

Cursor

AI coding tool, cited as a talent magnet. Why mentioned: "There is a time, this is more 9 months ago, but it was the joy to go around the table and complain about Cursor. They're taking of everyone." 00:32:28

Sequoia

Venture firm, referenced hypothetically in the talent war. Why mentioned: As an example of the step-up valuation narrative competitors use. "Sequoia's going to do a $10 billion check in a month, and then somebody's going to write it up to 25 next year." 00:22:54

Long Lake

Company discussed in the context of deploying AI into traditional businesses. The host's description of the lab-style playbook ("put AI in these businesses") implies it. Why mentioned: As an example of the lab-style deployment playbook she thinks should be replicated around open-source models. "Is it Long Lake, is that what it's called, like these were basically just going to go deploy this technology, put AI in these businesses." 00:45:57

Tableau

BI and visualization software. Why mentioned: As the SaaS feature Vanta explicitly chose not to embed. "We're not going to like put Tableau inside of Vanta." 00:43:06

Hugging Face

Open-source AI platform. Why mentioned: In the RSA security talk example. "If you watch the OpenAI talk at RSA about Hugging Face." 00:35:32

Google / Apple

Big tech companies. Why mentioned: As the only tech giants she would trust with personal data. "I would rather just Google or just Apple or just insert company here have that information." 00:55:43

Sonos

Consumer audio company. Why mentioned: Used as an example in the output-vs-outcome distinction. "The outcome is actually my Sonos now works." 00:12:33

AWS and Azure

Cloud providers. Why mentioned: Where Vanta thinks it can deliver continuous misconfiguration finding and fixing. "We think we can do that for the cloud providers, like an AWS and Azure, like misconfigurations there." 00:37:07

Reddit (r/accounting)

Community forum. Why mentioned: As a surprising signal of product-market resonance. "Compliance that doesn't suck too much, which got really popular on r/accounting." 00:04:42

SaaStr

SaaS conference. Why mentioned: The venue where Vanta's marketing team first tried out-of-home advertising. "Mid-summer 2021, SaaStr conference." 00:49:44

Jira

Project tracking tool. Why mentioned: As the manual workflow some customers want to escape. "You don't want the like Jira ticket thing, fine." 00:19:22

Ramp, WorkOS, Rogo, Ridgeline (sponsors)

Ramp is a finance platform, WorkOS is enterprise-readiness infrastructure, Rogo is AI for financial institutions, Ridgeline is investment management software. They appear as ad reads. Vanta's own ad names Ramp, Harvey, and Snowflake as customers. Why mentioned: "more than 16,000 companies use Vanta, including Ramp, Harvey, and Snowflake." 00:16:20

4. People Identified

Christina Cacioppo

Founder and CEO of Vanta; former investor and microeconomics instructor. Why mentioned: Guest. Her operating philosophy: evidence-based recruiting, ruthless shipping, and calm conviction through a market downturn for incumbents. "In another life, I was a microeconomics professor." 00:12:33

Patrick O'Shaughnessy

Host of Invest Like the Best and CEO of Positive Sum. Why mentioned: Host who drew out the pricing, talent, and security discussions.

Sarah (Vanta PMM at the time)

Product marketing manager who coined Vanta's famous tagline and championed it against internal skepticism. Why mentioned: Originator of the viral campaign. "Sarah, who was our PMM at the time, came up with compliance that doesn't suck too much, pitched it to our head of marketing, who didn't like it because thought we were like negging our users." 00:50:09 "She went to me, which she usually does not." 00:50:09

Andrew Reed

Vanta investor, described as having strong internet meme taste. Why mentioned: Consulted on the tagline. "Immediately texted Andrew Reed, our investor, as like, 'What do you think? You have good internet meme taste.' He loved it." 00:50:36

Vanta's Head of Marketing

Executive who initially disliked the tagline, a useful reminder that the winning idea came from below. Why mentioned: "didn't like it because thought we were like negging our users." 00:50:09

Billboard Agency Contact

Intermediary who swapped Vanta's billboard spot. Unnamed. Why mentioned: As a cautionary tale about verbal assurances. "Contract written in crayon... It's a placement order. They paid more. So he like swapped it out underneath us." 00:52:45

Billboard Company Founder

Founder who refused to sell the spot back at double price. Unnamed. Why mentioned: "We're actually cash flow positive, so like literally I'm an inelastic seller." 00:53:11

Harvard CS Grad (archetype)

Generic reference to high-agency talent that won't sign up for services roles. Why mentioned: Part of her FDE critique. "You're not going to get the Harvard CS grad who's high agency." 00:31:15

5. Operating Insights

Diagnose the Hidden Blocker Before Judging the Person

When talented teams repeatedly default to old patterns (onboarding wizards), ask why. The blocker was fear of being "not allowed to fail," which she solved by explicitly granting permission to bet on the uncertain path. "Why were these smart, motivated people bringing onboarding wizards? So you go ask... 'we basically don't think we're allowed to fail on this project.'" 00:20:04

Modularize the Codebase So Agents Can Be Parallelized

Old codebases overwhelm context windows, forcing high-context engineers to babysit agents. Break the code into smaller, fully understandable parts. She framed it as "we want to onboard 9,000 new engineers tomorrow." 00:14:32 The same exercise can also be run with agents themselves: "We are like in the process of using agents and people to make the codebase easier to understand too." 00:14:57

Recruit With Transparency and Ask What Is Pulling the Candidate Away

Facing hype-driven offers, she shares business metrics openly and asks candidates what annoys them. In one case the root cause was decision-making authority, which she fixed by simply granting it. "What do you need to feel like you can make these? Just go make these decisions. Go." 00:23:31 She counters hype with data: "trustworthy vibes versus YOLO vibes." 00:22:27

Value Company/Customer Context Over Vertical Skill When Building Agent-Era Go-to-Market Teams

She is willing to trade sales skill for deep product and customer knowledge, because context is what agents and teams struggle to replicate. "Would take a worse salesperson on sales skill who knows the Vanta pieces more." 00:28:09

Build a Pay-for-Agency Compensation Philosophy

Her rule is to pay the top people more than feels comfortable, with wide dispersion, because high-agency, high-context individuals are disproportionately valuable. "High agency. Get shit done. That sounds so milquetoast, and that's worth millions of dollars? Like yes, actually it is." 00:24:32

6. Overlooked Insights

Enterprise Procurement Is Becoming an Anti-AI Gate

A large US enterprise asked Vanta to turn off its AI features because non-AI tools are easier to get through procurement. This hints at an emerging pattern: AI-native products may face slower enterprise sales cycles, and "off switches" or staged feature rollouts could become a go-to-market requirement. She said: "'Maybe we want your AI features, maybe we don't, but can you turn them off for now?'... 'Because it's a way easier to get a non-AI tool through procurement, and we want your tool.'" 00:43:51 The investable angle is tooling that simplifies AI governance and approval, which is exactly the trust layer Vanta sells into.

Model Geopolitics Is Creating Business-Continuity Demand for Chinese Open-Source Models Abroad

French companies switched to Chinese models after American access was restricted for non-Americans, a rational response to supply risk rather than ideology. Said in passing, it implies that foreign software companies will diversify away from US-controlled model supply, a structural tailwind for open-source and non-US inference providers. She said: "We basically all switch to Chinese models when Trump closed [access] off to non-Americans, and we just kind of realized there's a huge business continuity risk." 00:33:23