 Hello, Christina. Hello. And hello, everybody. I'll give a quick background on myself. I'm one of the partners at Sequoia. We're a global venture capital firm known for past investments in Apple, Google, Cisco, Zoom, Stripe, PayPal, et cetera. And we are lucky today to have Christina Cassioppo, the founder and CEO of one of our most exciting and certainly one of our fastest growing companies coming out of the US. And rather than giving a long-winded intro of you myself, why don't you share with the audience a little bit about your personal background? Great. Well, excited to be here today. Co-founder and CEO of Vanta, we automate security and compliance for high-growth companies. A lot of startups. Excited to chat with you all today. Prior to starting Vanta about five years ago, I was a product manager at Dropbox. Started my career actually in VC. So have some sense of what Andrew did, but was nowhere near as successful as he has been. And then I grew up in Columbus, Ohio, in the US. And I'll share a little bit about Christina. She's unfailingly humble. So I will share a little bit about my first interaction with her, which was I was introduced to Christina by Dylan Field, the founder of Figma, which is one of the companies I work with. And Dylan gave Christina a raving reference. And I actually was already familiar with Vanta by the time. I met Christina because one of my other investments, which is a business called Loom, is a Vanta customer and had put out a blog post when we got our SOC2 certification that was basically a love letter to Vanta. And I think when I met Christina, I had all that context. It was one of the fastest growing companies we'd ever seen. They got to over 1,000 customers before raising their Series A, tens of millions of revenue. And hence, the Series A was $50 million. So I think for many of the founders in the audience, in particular, having that raw and unfiltered product market fit is something most can only dream of, so why don't you take us back to when you left Dropbox and decided what you wanted to do? Yeah, so we used to joke of, will anyone believe that compliance was our first word as a three-year old, and you're a classic founder story, and that's not what happened, but left Dropbox and actually were interested in a handful of things. So we'd just spent a few years working on Dropbox Paper, which is a team collaboration tool, and so someone interested in that and then very interested in security. And to take you all back there, this was late 2016, early 2017, and so the US election had just happened. Like the Equifax data breach and Uber data breach, Capital One, there were all these really big security breaches in the headlines, and we sort of looked at those and were like, OK, hang on, what's going on here? We all keep saying security and cybersecurity is so important, and we all sort of agree, but also everyone seems to be getting breached left and right in these ways that in retrospect seem sort of obvious or predictable. What don't we understand? Something we don't get? And so basically just started asking questions and literally started with friends and co-workers. So the first of these conversations was someone who I'd worked with on the security team at Dropbox. And again, just sort of having these conversations, and it was this few months process of sort of learning that people very much did care about security. They very much tried to prioritize it at their companies, but it was often hard to trade off security versus what felt like growth or like sales or what you needed to get your startup or your company off the ground. And then we came across compliance, which was this world of acronyms. And the more we dug into that, we realized that in its kind of best form, compliance is how you talk about security. It's how you talk to your customers or talk to your prospects about the security you have, about the practices you have in place. And we kind of realized like, hey, if we can make compliance rooted in security and something that more startups have, we can actually get them to be more secure. And sort of go forward and try to secure the internet that way. And once you landed on that problem space, I think one of the questions that founders often wrestle with is how to involve early design partners or customers versus doing things kind of first principles from yourself. So maybe talk about your philosophy on that and any examples from Vanta. Yeah, so prior to Vanta, I had made a bunch of stuff on the internet, none of which you've ever heard of didn't go anywhere. And so I was pretty humbled by this point. And it's like, well, I like to think I have good ideas, but actually they generally don't survive contact with the market or customers. So for Vanta, it was the early stages where like really, really customer informed. And I sort of used the word customer loosely, user informed, because we weren't charging anyone. But actually initially we went to Figma because we knew Dylan and we knew folks there and were like, hey, can we interview you about this? And then we'll kind of play back the interview and see if that's useful. And so just picked a few early customers or users really based on personal relationships. And the personal relationship part was important because it was someone who would kind of let us come into their company and like spend time with their employees. And they trusted us enough that we weren't like totally wasting anyone's time. But did that for a few months. And even though we could code, actually very purposefully, did not write any code, so that it forced us to try to make sure we understood the problem, understood what we were trying to build before we got to like go do the fun part of writing all the JavaScript. And then maybe a little more detail on any good stories from that era. And there's one in particular that I'm thinking of. Yeah, so I mentioned we worked with a few companies. So we did a little bit with Figma. We worked with Segment for a bit. Worked with Front for a bit. And then we were like, OK, we've done sort of the same sort of consulting engagement. Again, we weren't getting paid, but like three times or three companies. And by the third one, you're like, OK, this is replicable. Great, we should like stop doing this in spreadsheets and start writing code. And actually that weekend we got an email from a former colleague at Dropbox. And the email was basically like, hey, not sure how you guys are doing. Here you've become SOC2 consultants, like compliance consultants. Super weird life choice. We should probably get a drink and figure out if it's a midlife crisis or a quarter life crisis. But also can you come to my startup and help out and then we'll get that drink? And like literally this email. And we got it, we're like, OK, no, we're not going to do that consulting. Yes, we're going to go like write code and then try to sell this person what we make, basically. But yeah, the quarter life crisis intervention email was a good sign. And then maybe, yes, certainly. And then talk about kind of how Vanta works today, both in terms of how that evolved from discussion to product. And then talk about the value that customers see from Vanta when they use it. Totally. So today, customers will come to us because they need some sort of compliance certification. So this is very alphabet soup, but you may have heard of things like ISO 2701 or SOC2 or GDPR or PCI, like letters like that, which are all basically ways for a company to prove their security against some set of requirements. Anyway, so like a startup will hear they need one of those, come to Vanta. And then our product will basically help them prepare for that, so get them in good shape, have them give them a list of the things they need to do. And then we work with auditors and certifiers to actually get them that certification so that they can go back to their customers and say, hey, you can trust us. We've been certified by this body. We have these letters, this badge. We're safe to do business with, ultimately. Got it. And then first off, that is something that very much resonates with me as a board member for software companies where you have the same story every time where you have a product roadmap, you have a pipeline. One deal in the pipeline requires ISO or SOC2. And all of a sudden, that gets wedged in front of the rest of your product roadmap. And the companies I work with that use Vanta for what it's worth, it just shrinks that period from many months to a couple of weeks and helps you get revenue faster. And I think that tends to be a pretty useful value prop to startups. Yeah, I mean, something we sort of realized is, again, somewhat idealized, but I think the version of compliance we want is where compliance is the way you have the security feature for your customers, right? And so ultimately, it's customer-centric. It's the feature the customers want. And again, it helps unlock business, helps you ultimately grow your business. And with your company, you have, obviously, lots of customers, thousands of customers. You have integration partners. You have the audit side. You have multiple certifications, those acronyms that you mentioned. And you're a former product manager, so prioritization is something that you do. How do you think about different prioritizations of all those different areas? Yeah, so on the edges, it's something that changes based on feedback. At a macro level, though, it's customer-first, right? And so has been from the early days is still, I don't see that changing. And even when we think about partners, auditors, it is through the lens of customers, right? And so an example is auditors are a very important stakeholder for us, but the customer is ultimately the stakeholder. And again, so we kind of think about it through the prism of customers. An unhappy auditor will make for an unhappy customer again, so there's some balance, but customer-first always. Got it. And one question, this is kind of a non-sequitur, but you did work in venture capital. You have seen lots of companies through that lens. You were at USV during the early crypto years of 2011-2012. Did any lessons learn during that experience shape how you navigated the path from idea to product? Totally. So I don't believe in market sizing, right? And I think some of this was 2011-2012 USV, where generally consumer internet news, like new emerging services, like Twitter, Tumblr, Foursquare, where you just couldn't do a market analysis of what is Foursquare's market, or we didn't try. The analysis we would do is, do people want to stand on street corners and tell their friends where they are to get their friends to meet up with them? And so I just became really skeptical of market sizes. And so Andrew, you can probably attest to this. In the series A pitch, there wasn't a market size slide. I probably asked about it, and I was probably like, oh, no, you don't want to ask that question. This other question of like, do you believe there will be more startups? Do you believe there will be more security requirements? Let's talk about the market that way. I think what you're saying is market size still matters, but think about it as a dynamic analysis, not a static analysis. Yeah, right. Yeah, you can bet on these. Be more creative about market size. Then whatever, that crunch-based report says, the market for SaaS is this much. And then, I guess, you work with lots of, many of our companies come to Vanto when they're just a couple of employees. And you end up being the CEOs and CTOs. I guess through that lens, whether it's market size related or not, what advice do you tend to give those sorts of folks? Yeah, I mean, obviously, various, but a few generalities of, I think, and I say this as a person like this myself, I think especially for founders that come from the technical or product or design side, it can be really fun and temporarily or short-term rewarding to go off and imagine from first principles your fantastic product and spend a bunch of time perfecting that. And then only when it feels ready, go put it in front of customers. And again, we did this less with Vanto, because I made that mistake, you know, infinity times in the past. And so it's usually a push to, especially those sort of founders, to be like, have you talked to early users? Have you talked to customers? Whether or not you're trying to charge them or you think of it as sales, like, have people who don't work for you seen what you're building and truly given feedback on it? I think the other part, and we also saw this in our early days when we were a bit confused about where we were going, was when you do ask folks for feedback on an early product, they want to help and they want to be nice. And so they will tend to say things like, oh, this is a good idea, like not for me, but maybe for this sort of person. And they're actually saying like, you don't have product market fit at all, right? But no one says it that way, because again, they're trying to be kind and nice and supportive. But I think also just taking a very critical eye to the feedback you get in the early days and basically kind of anything less than, yes, I want this now is no, even if it's not couched that way. And was there a moment when you decided we have product market fit or was it more of a spectrum? I think for a spectrum, I mean, there were like definitely post product market fit moments, like there's a period of early Vanta where I think literally like more than half of our customers asked to invest and that's where you're like, okay, this seems promising. Like they will both like give me their company money and then they're asking personal money. Yeah, I think, I mean, actually, I think the like life intervention email like felt pretty good too, even though it was a little like, oh, didn't think I'd get one. Well, underhanded? Yeah, exactly. And when you think back to those early days, I think one of the things I really admire about Vanta is just the culture you've built and the focus on craftsmanship and on people and just building a really strong team. What did you look for in your, maybe first 10 hires that have shaped some of that? So a handful of things, some of which very standard for startups, you know, you like look for impact, you look for like user centric or business centric, right? And a lot of startups look for that. I think it's very useful, but also sort of table stakes. I think two things we've looked for that were a little more unique to Vanta. The first was growth mindset. So this was just folks who maybe hadn't done what we were asking them to do, but believed they were a person who would go figure it out and you're like, tell me to look up something and I'll Google it and I'll call two friends and I'll muddle my way through it and we'll figure it out. But that outlook overall, really important for a handful of reasons, just early startup, first 10 people, even if you think you know what you're doing, you don't quite know what you're doing and so some kind of tolerance for that. The other one, and the most Vanta-specific one we call frameworks thinking, which basically just means like, hey, can you make a decision in a structured way and walk other people through it? So like, do you have a framework for your decision or how you're thinking about something and can you explain it, right? And well, like any framework you want is fine. We are not prescriptive about that but we are sort of prescriptive about the act of, again, walking people through your decisions. And that's something that's specific to us, like not a normative thing, but we just sort of realized in our early folks that the ones who were more successful were doing that and the ones that we didn't work as well with weren't doing that. And again, that was like an us thing, not a them thing. But it became something we started to look for thereafter. And then how about for the next phase of the company? So you have, I think you're something of a unique company in that you have a very high functioning and talented product engineering team and at the same time a very high functioning and productive and excellent go-to-market team, whether it's sales or customer support, et cetera. How have you thought about scaling those two independently or connectedly or whatever else? Yeah, it's hard. I think we've done more scaling independently and like now looking forward to this connectedly, right? I think in the past, I mean a lot of the thing I started up to, you know, you get lucky, honestly, with a few early hires, they know other folks and then there's like some connective tissue in teams, across teams that way. I think the thing we're thinking about now or actually now that we're a bit bigger and for context, Vanta's about 135 people today. More like formal feedback loops. So like, okay, there's 20 sales reps. They are constantly getting feedback from the market and the conversations they're having. How do you get that to product in a structured way? Right, because we used to just like slack it over, like dump it all on a slack channel and someone looks at it and we're just like past the size of any of that working. And so now it's sort of a design game of like, okay, you know, there's all this information. How do you get it to a place where other folks can understand it? I think one really tactical thing is we became a Gong company, like record sales calls company just before the pandemic, probably like January, February, 2020. And it's great. Like totally a cultural norm to record everything. People go watch calls and people will watch your calls. And I think running Vanta without Gong would be significantly harder or something Gong like. Excellent. So Gong is also a Sequoia investment, but that was not a paid partnership. Terrific. And I think one of the things that I sometimes wonder is when you have conferences like this that have a lot of very early stage founders who are in that walk through the woods period. And you look at a stage like this and people who are scaling companies that, you know, real size, the kind of is this like emotional gap there of like, how do we do it? So I'm curious if you were to like refer to those people in particular, like how did you get through the more emotional side of the kind of wander through the woods of Vanta? Totally. Okay, so the wander through the woods phase when you're like figuring out your idea. And I think at least for us, when we went and talked to more established founders and they basically be like, oh, that phase was so fun. Like the world with your oyster, you could do anything you wanted. And at the time we were like, oh, it's so fun. I don't know what to tell my mom I do with my life. Like so fun. And then at some point, like we'd have those conversations when you start being like, hey, established founder who like seems super successful out of reach. You know, did you actually like that phase? And they're like, no, definitely not. Right? Like that was, I mean, in some ways fun and in some ways like existential. And again, I had to like explain to my mom problem. Like wasn't, wasn't great. And so I think actually just like holding that in your head of like, yes, in some ways actually is really fun. And even if it doesn't seem like it, the world is your oyster and you can go out and work on whatever problem you want, truly. And I do believe that even if you know, you don't feel like you have the background for it. Like my background is not security and compliance. It now is, but it wasn't before Vanta. And so I just like believe that very strongly. And so that is like the world's your oyster. It is fun part. And then I think equally remembering that like, no one knows how to explain to their moms again what they're doing in this or most people don't. And that it feels existential, but like you'll get through it and it will be fine. And the folks who again now seem like, oh, they were always established. And it was this like clear, you know, route through the woods to product market fit. That just could up the story you tell afterward. That is not actually the lived reality for anyone. And then, so at this point, at least from what we see in the US, Vanta has become more or less a de facto product to be bought by early stage software companies, right? It's like kind of one of the first things people buy. I'm quite sure that people in Europe do not know much about Vanta yet. Can you talk a little bit about Vanta's plans for Europe? Yeah, it's actually really excited on the flush stage to announce that we're opening up in Europe. So what that practically looks like is a bunch of support for you all. A handful of products that are more Europe focused. So again, this will be compliance acronyms. But supporting GDPR for startups, supporting ISO 2701, these European standards. And we already, part of why we're doing this and honestly why we're here is we have a bunch of customers in Europe already that have heard about us through, you know, other marketing we've done or just like American startup friends. So really excited to do more in Europe, like kind of starting now and very much into next year. Excellent. I think we have, well first off, that's incredibly exciting. I think like you, Sequoia opened an office in Europe about a year ago. And I think the scale of ambition of the software companies here is very similar to that in the US. And I presume that there's going to be a lot of the same tailwinds for Vanta here. And I think for the founders in the audience, I think for some of the investors will hear, you know, ISO and SOC2 and think like, I'll have to Google that later. I think for many founders who see this in sales cycles, it becomes pretty obvious why they might need this. I think with our last three and a half minutes, I think we should talk a little bit about, you know, you're on stage with your primary investor in Sequoia. Talk a little bit about the decision-making you made in terms of finding product market fit, getting to tens of millions of revenue and then raising a Series A. Whereas I think status quo for most founders is, you know, raise money, then figure stuff out later. And so talk about the various trade-offs that you made there, pros and cons, and maybe how that decision-making went. Yep, so I think a lot of how we've fundraised or financed Vanta has come from the early VC job that we talked about. And particularly there being fortunate enough to see, I mean, see a bunch of companies, the majority of which were like tremendously successful, but not all of which were, and sort of being able to viscerally see how more money often does not make it any easier to find product market fit, and also how kind of binary that is, like it is sort of, I mean, it can be a scale, but like there are moments when you know you don't have it and there are moments when you know you do have it. And like, yeah, the money, the expectations, the like other cooks in the kitchen, all of that, just even very well-intentioned, wonderful cooks, like still does not make for a better meal always. And so I think with Vanta, it was like, okay, well, we raised a very, very, very small amount of money, like tens of thousands of dollars in the early days. And then it was just like, well, if we can't get to something off of this, like, we shouldn't go raise millions more, like that actually doesn't make sense to us. So anyway, that was the original plan. I think we pushed it much further. Like we did kind of think we'd raise a series A at a million in revenue, like you're supposed to as a startup, quote, unquote. I think the thing we found was just we didn't need it. Particularly we were like making money. We were hiring as fast as we could. We still were making money. And so then it felt a little silly to go out and like run this process and go, you know, figure that out, take a bunch of time doing that, to have more money in the bank and like, yes, try to hire faster, but you know, we were kind of doing that as fast as we could. And we just kind of pushed it for longer than I think even I expected we would. So then we did raise, it was like, people actually think Vance is quite small. How do we like convince them where we are the de facto standard, you know, we are much larger? I think on the downside, there was that of like, we seemed smaller than we were, which I was pretty into. I really didn't want to, like I didn't particularly want to put a target on our backs. I think at some point, like more scrutiny came and so then you just sort of embrace it. I think also it made recruiting harder, right? Cause we'd come to people and they'd be like, you're a seed company that's raised like kind of nothing. And we'd be like, oh no, but also, you know, we're 50 people, we're so big, we have a thousand customers, like you shouldn't think about us like a seed company. And they would be like, Crunchface says you're a seed company. And that back and forth, they're like, you know, folks wouldn't even really like talk to us cause we didn't like on paper fit what they were looking for. There was a little bit of like worries about adverse selection. Like, oh well, you haven't been funded cause you're not a good company. And so that was very real in the market too. It was like, we just have to like kind of start some recruiting conversations by like objection handling all of that, just like not the best way to start one of those conversations. And then for the founders in the audience who have been putting off getting SAC2 compliant or ISO compliant or everything else, how can they reach you good folks at Vanta? We'd love to help. So we have a booth, if I can do this correctly, near the amphitheater stage by the code check and the north door. That was complicated also by the Salesforce booth. And then Vanta.com, V-A-N-T-A.com. And we'd love to chat. Thank you everybody. Thank you.