👋 Howdy to the 2,320 new legends who joined this week! You are now part of a 110,042 strong tribe outperforming the competition together.

LATEST POSTS 📚

If you’re new, not yet a subscriber, or just plain missed it, here are some of our recent editions.

🍳 The Negative CAC Media Pyramid. Cost to acquire a client is changing, and you'd be smart to change with it.
🫡 The Job Description Of A CEO. Five roles to rule them all. The most detailed CEO job description to date.
🏴‍☠️ THE DREAD PIRATE ROBERTS. The wild story of the founder of the Silk Road, Ross Ulbricht.

PARTNERS 💫

HOUSEKEEPING 📨

I am sitting here finalising this piece post midnight, after setting a new record in the dental chair this evening. Four and half excruciating hours. What a horrible, horrible time. Luckily, I am very excited to ship this piece out to you. It took a lot of work, and is a new record for size and scale that we have profiled in the founding story of. So, it’s all quite exciting.

That is aside from any predictions pieces I ever do—which I have only ever done once—where political predictions have ramifications for business. Anyway, just thinking out loud here. Enjoy today’s post!

ZERO TO ONE 🌱

Cybersecured: Vanta’s Zero To One

Anyone who is familiar with Harry Potter, the Star Wars franchise, Lord of the Rings and other great tales throughout our culture with be familiar with the Hero’s Journey. Either consciously or unconsciously, they will be familiar with the call to adventure, meeting the mentor, test, allies, enemies and more. They will have seen their hero go through the ordeal, the reward, the resurrection, and finally the return with the elixir.

Well forget furry-footed Frodo, and throw out little Lukey Skywalker, today we have a real-life hero. Today we are taking you through the Hero’s Journey of Christina Cacioppo, the powerhouse leader who is building an industry giant trust management platform, Vanta. A company that made it to $10M in ARR before they raised an institutional round, and $100M in ARR within their first half-decade. This is their zero to one.

To get to the bottom of this founding story, I sat down to chat with the woman in question, Christina, along with early Vanta hires Sarah, and Boris. I also spent time chatting with Jeremy Epling, who wasn’t technically at Vanta when the first cups of Kool-Aid were getting passed around, but now runs product for the company, and Stevie, who is the CRO. Today, Jeremy is the man who is actually in charge of making the Kool-Aid, and Stevie is in charge of distributing it. Anyway, let’s dive into it.

Why security matters today

Back in the ‘80s, when it was power suits by day, acid wash by night, viruses spread via floppy disks, the Morris Worm being the first major shot across the security bow. Years later a short program of 99 lines of code crippled thousands of computers in 1998, bringing large parts of the internet to a standstill. In the early days, hackers were mostly curious misfits, but there were signals of a bigger problem: suddenly, code could cause chaos at scale.

As the internet took off, so did cyberattacks. Corporate websites got defaced for fun, but criminals also started stealing real money. Companies wised up: it wasn’t just about brand embarrassment, it was about protecting that sweet, sweet data—customer info, credit cards, you name it.

Fast-forward to the last decade. One of the most consequential attacks in recent memory was the 2020 SolarWinds breach—a supply-chain meltdown that infiltrated major government agencies and Fortune 500 companies. It hammered home that even if your security is tight, your vendors’ vulnerabilities can still be your downfall. Meanwhile, high-profile breaches at Target, Equifax, Sony, and dozens more showed that even the big dogs aren’t immune. Data is the new gold, and hackers want it.

It’s not just about avoiding bad PR—breaches can sink trust, lose customers, and trigger monster fines. With remote work, cloud everything, and constant device-hopping, the attack surface is bigger than ever. A robust cybersecurity game isn’t just a nice-to-have; it’s existential.

The call to adventure

Christina was raised in a family that valued education. Both of her parents were professors at Ohio State, and the love of learning rubbed off on her; at Stanford she majored in economics. Christina would go on to say that she had “wanted to be a professor until I was twenty or twenty-one.”

The path of being an educator was not on her bingo card though. She was too entrepreneurial to stay in that lane. All the way back in 1997 Christina, an 11 year old Christina, was managing a flourishing Beanie Baby business on eBay.

Armed with nothing more than energy and inquisitiveness, Christina began searching around for what she wanted to do next. What came next was a job at Union Square Ventures—a venture capital firm that focuses on early-stage, growth-capital, late-stage, and startup financing. The chance encounter Christina had with a blog article titled; ‘Bidding Andrew Goodbye,’ would lead to her last-minute application—in which she secured the role—followed by two and half years of career-shaping mentorship by Fred Wilson and the team at USV.

After dipping her toes in the investment world at USV, Christina liked what she saw, but rather than continue down the path of venture capital, she began to think maybe it was her turn to be pitching the investors with her own breakthrough product. “I realized that I didn’t need the time machine. I didn’t need to go back to age 7. It wasn’t too late.” The path to finding a problem worth solving was not a straight line though.

First, there was the design book website that was “Goodreads, but better, but worse.” Then came the semi-successful, Hoot, which she described similarly as “Snapchat, but worse, and themed with owls.” I think there was a real owl theme in Silicon Valley at the time. Hoot would go onto a large exit of $20,000 to a teenage entrepreneur in Tennessee. And then finally, a third attempt at cracking the entrepreneurial code with a coding education platform that never really took off either.

Although armed with intelligence, desire, and her new hard-won experience, Christina decided it was time for her to regroup, recharge her batteries, and take a job as a product manager of the 10-person team building Dropbox Paper (at Dropbox). It was here at Dropbox that Christina would begin to solidify her idea around Vanta. Dropbox, you see, claimed to have a security culture internally citing; “The Dropbox Security Team is responsible for securing around 1 exabyte of data, belonging to over half a billion registered users across the world.”

But Christina’s team, and their new product, Paper, was an off-shoot of Dropbox and was so siloed that the legal team told Christina that Paper, wasn’t actually technically SOC 2 compliant itself. And the entire process of getting there could take up to 18 months. News to Christina of course; “I remember thinking, what do those words mean?’”

This experience of seeing a hugely successful, incredibly well-resourced company like Dropbox, not be able to sell new products to their own customers left Christina with an itch she needed to scratch. This was exaggerated by the fact there had been a number of high impact security breaches around the world at this time. The 2016 Uber leak of 57 million users data was followed closely by the Hilary Clinton email saga. Which in turn was followed by the 2017 Equifax breach of 150 million. This piqued Christina’s interest.

What did Vanta end up becoming? It became a company that set out with the mission to: secure the internet and protect consumer data. A battle well worth waging, and a founder ready to run headfirst into the fire.

Best product since sliced wholegrain

Before I get into the actual crux of the zero to one stage at Vanta, I want to make something clear. My understanding after countless hours of research, and a handful of lengthy interviews is that Vanta is atypical. They don’t seem to have had the almighty pivot story a la early Slack, the Neumannian wars with investors, or the unceremonious removal of the founder from polite society like the stories of Theranos, FTX, and more.

So if you’ve come here for the drama, you’ve come to the wrong place. This is a story of excellence from top to bottom. Now that we have cleared that up, let’s get back to our founding story.

Market validation pull

Today Vanta is a household name in the world of tech, and a global megastar in the world of security and compliance software. They serve over 10,000 companies worldwide, from early-stage startups, to the likes of Intercom, Duolingo, Ramp and Atlassian. But how did Christina, fresh off her stint at leading product at Dropbox Paper, begin to validate that this thing she had in her mind was actually worth building?

“The initial idea was to build a security company that small companies use daily,” Christina told me during our interview. “We realized that to truly engage small companies, we needed to change their incentives so they would prioritize security earlier than they typically would. This led us to integrate security with driving revenue, growth, or improving product-market fit.” The way I understood this was quite interesting.

Historically, most companies thought of compliance as a chore. The ‘dental checkup’ of the startup world. But it shouldn’t feel as if you are getting your teeth pulled. Compliance is a way for early stage startups, mid-market, or even enterprises to move up-market. Sarah Scharf, Vanta’s VP of Marketing, put it best during our call; “We’re a revenue acceleration company.“

A revenue acceleration company you say? Hmm. Well, don’t mind if I do. One personal anecdote from my side is that I know this to be true. My startup, Athyna, has been actively breaking into the enterprise market for the last 12 months.

But we have lost a lot of revenue due to not being SOC 2 compliant. We are currently engaging Vanta to help us ‘accelerate our revenue’ and close more of these high-ticket deals.

As they continued to gather intel, they began serving a few bespoke customers, beginning with Segment, who were struggling to nail their SOC 2 compliance at the time. In order to test their assumptions that compliance could be standardised, Christina put together a spreadsheet version of the steps the Segment team would need to take, and lo and behold - they loved it. Sure, it was clunky, and a little rough around the edges, but it gave startup founders some semblance of process and structure around an otherwise intimidating process.

It wouldn’t take long before more companies began reaching out. Founder friends of Christina’s founder friends who were struggling with their own SOC 2. This signalled the market was ready. It was time for the team to take things more seriously. It was furry mascot time.

Y Combinator, a llama, and a little bit of real growth

Come 2017, Christina, had validated the idea and proved that people would be ready for a faster, safer, smarter way to handle their compliance. The problem was: they were down to their last $50,000. The solution: Y Combinator winter batch for 2018.

And what a batch it was. Led by Vanta, the 2018 batch also boasted Replit, Mutiny and OpenSea. The Y Combinator experience gave the team an incredible network, a little bit of funding, and a lot of momentum. Momentum that would carry them directly into their $3M seed round shortly after. But at this point, Vanta decided to make a retreat back into the startup wilderness.

This would be a strategic retreat. Christina and the team knew they were onto something, and the pull from the market was so strong, they wanted to get as far in front as they could before the copycats came for them. Up until now, the GRC (governance, risk, and compliance) world was filled with rusted on slow-moving consultancy. Market share Vanta knew it could eat up, and quickly. The industry position reminds me a lot of how Deel, a company I profiled earlier, attacked the lucrative EOR market.

It wasn’t until 2019, when Vanta would launch a public-facing website. Up until then, it was referrals only. And when they did launch their site, it literally just showed a llama, and an opt-in form.

I don’t know what it is but I feel like if you have a friendly little animal for a mascot, you are destined for success. Vanta says so, so do our friends at PostHog.

But she also added that; “It wasn’t the usual fierce or clichéd security imagery like a guard dog, it was friendly and memorable, which helped soften our image and make us more approachable as a security company.” A real pattern interrupt.

This low-key approach to brands was working: in the first five months of Vanta’s life, the company surpassed $500,000 in sales, all of it founder sales, handled by Christina.

Although it had been somewhat smooth sailing in the nascent stages of Vanta’s existence, it wasn’t without some pain and pressure. When I asked Christina the one thing she knows now that she wished she knew then she said it was customer success.

But not everything was painful. For as much pain and stress an early stage startup can be, it’s also quite exhilarating; “It was intense, fast-paced, and unlike anything I had experienced before,” Sarah told me with a big smile on her face during our call. “Everything moved at lightning speed, and there was a heavy emphasis on action. One of our core principles—bias for action—was already deeply ingrained.”

Now that they were beginning to really accelerate, it was time to diversify their product offering, and start winning larger deals. Vanta was getting close to launching itself on the global technology stage.

PARTNERS 💫

The early GTM channel mix

Usually, when doing these zero to one stories, I like to dive into the tangible channels that were working—or those that were not in the early days. And for this section, instead of writing it in a narrative fashion, I am going to take the transcription from my interview with Sarah Scharf, VP of Marketing over at Vanta.

Bill Kerr (me): “So tell me, what was working at the time? What were the main go-to market levers?”

Sarah Scharf: It was all SEM and SEO. Our biggest driver of demand came from people who were asked for a SOC 2 report, had no idea what it was, Googled it, and found Vanta. That was the entire playbook in the beginning. Beyond that, one of the best early decisions we made was advertising on podcasts. We became an early sponsor of This Week in Startups and rode the wave of the rising popularity of tech podcasts. That helped us reach founders directly and build brand awareness in a space where trust mattered.

Our first viral marketing moment came in 2021 when we put up a billboard on the 101 before SaaStr that said: Compliance that doesn’t SOC 2 much. That campaign got a ton of attention and was one of the first moments where we really leaned into creative marketing.”

Bill Kerr (me again): “Why do you like the owned audience like Podcast space so much?”

Sarah Scharf (again): “Podcasts have been incredibly successful for us, and we hear it all the time—people saying, ‘Oh, I first heard about Vanta on a podcast.’ For certain shows, we now have attribution pixels, so we can actually track how much traffic and demand they drive. And it’s significant. Beyond that, podcasts allow us to speak directly to the audiences we care about. We got in early, built deep relationships with hosts, and crafted messaging tailored to their listeners.

We started with founder-focused podcasts, but over time, we expanded into security-focused ones to reach CISOs. One of my personal favorites is our sponsorship of Arnold’s Pump Club, Arnold Schwarzenegger’s podcast. We leaned into the idea that being a founder is like being a bodybuilder—you have to put in the reps, stay disciplined, and build something strong. Every time we iterate on the messaging, we push it to be a bit zanier, but hearing Arnold Schwarzenegger say Vanta is just amazing. That alone makes it worth it.”

_{*Below, in summary, you will see my rough estimation of the main GTM channels in early Vanta days.}

‘A magical piece of software’: Stealth to Series A

f I told you that Vanta had raced to $10 million dollars in ARR, basically in stealth, before raising their Series A, would you believe it? Probably yes—because I am writing this story—but it is quite hard to believe right? That’s what they did. To put that in context, most of the startups raising in the frothy markets of 2021 would have had a million or two in ARR at their A. To get to a number like $10 million, would usually be seen at the top end of a Series B round.

How and why were they so successful by this point in time though? Sure they were scratching a market itch, but they were also expanding their product suite rapidly as they grew. First came SOC 2, then the ISO 27001, and HIPAA frameworks, then more and more acronyms you only know if you really need them.

But it wasn’t just the offering that were expanding. The incumbents had all the offerings. It was the ease in which they could be applied that was something else. Ari Shahdadi, who now heads up peopleand legal at Vanta, discovered the platform while working at a previous role at Enigma. “We bought Vanta, and then also got hooked up with an external security consultant, and got the whole thing done in 30 days. We went from having spent a year puttering around, spending a lot of money, not getting anything done, to now this magical piece of software gets installed.”

”A magical piece of software.” Take note all you founder nerds out there. These are the words you want to hear. If you could only be so lucky that someone, somewhere, someday will utter those B-E-A-uuuuuutiful words to you. It comes from what Boris, VP of Product, told me is relentless execution; “There's this idea that whoever runs through walls fastest builds the best product. I fully subscribe to that, and Vanta was definitely good at running through walls.”

_{*Note to self: to build a great product that works like magic, one must prepare to run through walls.}

This relentlessness means that while the incumbents are scrambling to modernise, and the copycats are trying to catchup, Vanta just continues to ship, and ship, and ship. Delivering value hand over first for their clients, every single month, from early stage to enterprise.

“There’s a saying by Greg LeMond: ‘It doesn’t get easier, you just go faster.’ That’s very true in startups,” Christina would say.

What in 2018 began as a nifty way for startups to get their SOC 2, has now grown into the leading trust management platform, boasting not only SOC 2, but also ISO 27001, GDPR, HIPAA, all the way to custom frameworks—Vanta now supports more than 35. It’s a one stop shop to automate and scale compliance, pain free.

So come May of 2021 it was time for Vanta to announce to the world it had arrived, with the news that the world’s premier venture capital firm, Sequoia Capital, would lead their $50 million dollar Series A. It was now officially Vanta’s world, and we are all just living in it.

The Wall of Christina Love

There seemed to be a real through-line during my research for this post. That throughline was Christina. No matter where I looked, or who I spoke to it seemed to be more and more clear to me that this founder is a force unto herself. So, with that being said, here is my dedication to her. The unofficial Wall of Christina Love.

And in the fashion of a true leader; below I give you Christina’s very low-key, very humble, appraisal of herself.

Future

I think by now I have done a decent enough job of convincing you that Vanta is a powerhouse. And they seem to be getting stronger and stronger each day. This tweet below from Christina to celebrate them crossing the $100 million dollar ARR mark was in January one year ago. They had 7,000 customers at the time. Today—one year later—they have over 10,000.

Another huge green flag is Sequoia’s backing. Not only did they lead the Series A, but have since tripled down by following in both the Series B, then again leading their Series C. This is notably rare for the world’s premier venture capitalists, so if you were expecting Vanta to slow down anytime soon, I have bad news for you. Sequoia partner Andrew Reed put it best when he said; “Data privacy and security is one of the things that is important and getting harder over time, as opposed to getting better over time. And she [Christina] decided she wanted to solve that thing, as opposed to the number of other areas that are getting easier and easier over time.”

This is what a generational entrepreneur looks like, ladies and gentlemen. A hero, only a small part of the way through her journey. This is Christina Cacioppo.

Fun facts

Extra reading / learning

And that’s it! You can keep up with Christina, Sarah, Jeremy, Stevie, and Boris on LinkedIn or check out Vanta on their website.

HIRING ZONE 👀 

Today we are highlighting AI talent available through, Athyna. If you are looking for the best bespoke tech talent, these stars are ready to work with you—today! Reach out here if we can make an introduction to these talents and get $1,000 discount on behalf of us.

BRAIN FOOD 🧠 

Just caught a wild episode from the IAI channel, discussing the impacts of a world led by big tech. A number of very sharp minds diving into how tech giants really have their fingers in pretty much everything—government, economy, you name it. Worth a look.

TWEETS OF THE WEEK 🐣 

TOOLS WE USE 🛠️

Every week we highlight tools we actually use inside of our business and give them an honest review. Today we are highlighting Attio—powerful, flexible and data-driven, the exact CRM your business needs.

See the full set of tools we use inside of Athyna & Open Source CEO here.

HOW I CAN HELP 🥳