Latest / Startup Stories with Fexingo: Conversations About Founders, Funding, and Building Companies from Zero / How Vanta Won Compliance Automation by Making Audits Invisible
Transcript
- Lucas: So Vanta hit a two-point-four-five billion dollar valuation in their Series C last year, and I think a lot of people heard 'compliance automation' and just glazed over. But the company is genuinely fascinating because it solved a problem that almost every B2B software company hates: the SOC 2 audit. Luna: Right. Anyone who's sold software to a large company knows the drill. The procurement team sends you a hundred-question security questionnaire and you have to manually pull evidence from every corner of your infrastructure. Lucas: Exactly. And Christina Cacioppo, the founder, had lived that pain firsthand. Before Vanta, she was at an enterprise sales startup called Sailthru, and she watched deal after deal stall because compliance took weeks. She once said in an interview that the process felt like 'doing your taxes every quarter but with a gun to your head.' Luna: That's vivid. And her insight wasn't just 'let's make a tool for auditors.' It was 'let's make the audit invisible for the engineering team.' Lucas: That's the core of it. Most compliance tools at the time were built for the compliance officer — a dashboard where you manually upload PDFs. Vanta said, what if we just monitor your AWS, GitHub, Okta, Slack — all the infrastructure — and generate the evidence automatically? The engineer doesn't have to do anything. Luna: And that's why it took off. They launched in 2018, and by 2020 they had hundreds of customers. Today they claim over seven thousand. I think the product-market fit was so strong because the pain was universal and no one had made it painless. Lucas: Let's talk about the metrics that matter. Vanta's pricing is tiered — starts around twelve thousand a year for a basic SOC 2, goes up from there. But the real magic is that they reduce the time to get audited from months to weeks. One customer, a startup called Datadog competitor? No, actually, a company called Loom — they got SOC 2 in two weeks. Luna: Two weeks. That's insane. Usually it's three to six months for a first-time audit. Lucas: Right. And that speed matters because for a startup, getting SOC 2 is often the gate to selling to enterprise. Without it, you can't close deals over a certain size. So Vanta effectively removes a bottleneck. Christina called it 'turning compliance into a growth lever.' Luna: But I want to push back a bit. Is there a risk that Vanta creates a kind of lock-in? Once you have all your evidence flowing through their platform, switching costs are high. And what about the actual security — is continuous monitoring really enough? Lucas: Those are fair questions. On lock-in: yes, it's real. But I think the counterargument is that compliance is inherently a recurring process — you have to do it every year. So the stickyness is actually a feature for them. On security: continuous monitoring is generally better than point-in-time audits. The SOC 2 framework was originally designed as a snapshot. Vanta's approach shows a real-time posture, which auditors are starting to accept. Luna: And the auditors themselves have to adapt. I saw that the AICPA, which governs SOC 2, issued new guidance in 2025 about continuous monitoring. So the regulators are catching up. Lucas: That's a great point. And Vanta has been proactive there — they actually built an auditor side of the platform, so auditors can log in directly and pull evidence without emailing back and forth. That removes another layer of friction. Luna: Let's talk about the founder. Christina Cacioppo is not your typical SaaS founder. She studied English at Yale, worked in journalism briefly, then moved into product management. How did she get the domain expertise? Lucas: She taught herself. She joined a startup called Sailthru as a product manager, then became a product lead at a company called VTS. But she's said in interviews that she didn't come in knowing security — she learned by talking to dozens of CTOs and CISOs. Her superpower was asking good questions and synthesizing the pattern. Luna: That's such a classic startup origin story. A smart outsider sees an industry where everyone assumes the pain is just 'how things are' and says, wait, we can fix this. Lucas: And she raised capital from smart investors. Vanta's seed round was led by Lachy Groom, who was an early Stripe exec. Then Sequoia led the Series A. The Series C was led by Craft Ventures, and the valuation jumped from around six hundred million to two point four five billion in about eighteen months. Luna: That's a massive jump. What drove it? Was it revenue growth? Or just the market narrative around security? Lucas: Both. By mid-2025, Vanta was reportedly doing over fifty million in annual recurring revenue. And the compliance market is huge — every regulated industry needs some form of audit. But I think the narrative was specifically about 'invisible infrastructure.' Investors love companies that remove a headache so completely that users forget it exists. Luna: Like Stripe for payments, or Twilio for communications. Vanta for compliance. Lucas: Exactly. And the question now is: can Vanta expand beyond SOC 2 into other frameworks like HIPAA, FedRAMP, ISO 27001? They've already started. And they've launched a product for vendor risk management, which is a natural adjacen— Luna: Wait, vendor risk — that's the other side of the same coin. Large companies have to assess all their vendors' compliance. If Vanta can be the platform where vendors prove compliance and customers verify it, that's a network effect. Lucas: That's the vision Christina has talked about. She calls it 'the compliance layer of the internet.' And I think it's plausible. But there are competitors — Drata, Secureframe, Thoropass. They all raised significant funding. So it's not a winner-take-all market yet. Luna: Drata especially. They've been aggressive with pricing and features. But Vanta seems to have the brand advantage. When I talk to founders, they say 'we need to get Vanta' the same way they say 'we need to get Stripe.' Lucas: That's because Vanta made compliance cool. Which is a hard thing to do. But let's be honest — the core product is still about a boring necessity. The question is whether the market is big enough for a standalone public company. The compliance software market is estimated at around fifteen billion globally. So yes, probably. But it's fragmented. Luna: I think it'll depend on whether Vanta can become the standard for continuous compliance, not just a tool. And that means winning the auditor community, which they've started. Lucas: One more thing I want to highlight: Vanta's go to market was very developer-focused. They had a free tier for small startups — basically a self-serve product that let you connect one or two integrations and see your compliance score. That's brilliant because it let engineers try it without a procurement process. Luna: Yeah, that self-serve funnel is classic SaaS. And then once you're in, you upgrade to get the full audit package. It's like Dropbox's 'get a free account, then upgrade for space.' Lucas: And speaking of free, if these conversations have moved your work forward in some small way, listener support is what keeps this ad-free. People who care about the show can support at buy me a coffee dot com slash fexingo. But no pressure — we're glad you're here. Luna: Absolutely. It helps us keep digging into these stories without interruption. And today's story about Vanta really shows how a founder can turn a painful chore into a scalable business. Lucas: So back to the bigger picture: I think Vanta's success tells us something about the current startup environment. The best companies aren't always the ones with the flashiest tech. Sometimes they're the ones that make a deeply boring process disappear. The question founders should ask themselves is: what invisible friction exists in your industry that everyone has accepted? Luna: And Christina Cacioppo answered that with Vanta. It's a great case study in finding a problem that's painful, recurring, and underserved. Lucas: And doing it with an api first, developer-friendly approach that scales. For next time, I want to look at a company that's tackling a similar 'invisible infrastructure' problem in a completely different vertical. Maybe something in logistics. Luna: Sounds good. Until then, keep building.