👋 Howdy to the 1,078 new legends who joined this week! You are now part of a 111,120 strong tribe outperforming the competition together.

LATEST POSTS 📚

If you’re new, not yet a subscriber, or just plain missed it, here are some of our recent editions.

🦙 Cybersecured: Vanta’s Zero To One. A deep dive look into the growth of a pioneer in the trust management sector.
🙂‍↕️ The Negative CAC Media Pyramid. Cost to acquire a client is changing, and you'd be smart to change with it.
🏴‍☠️ THE DREAD PIRATE ROBERTS. The wild story of the founder of the Silk Road, Ross Ulbricht.

PARTNERS 💫

HOUSEKEEPING 📨

Very chill this weekend for me. For the first time in months I have had zero sleep debt on my Whoop the last three days. It’s mainly because I have been so exhausted that I have been needing to have a full sleep cycle of 90 minutes before the afternoon even begins.

ZERO TO ONE 🌱

Unfiltered: The Details Behind Vanta's Meteoric Rise

Last week, I unpacked the journey of how Vanta transformed itself from a bold concept into a force in the cybersecurity compliance sector. This week, we're diving deeper, making it more personal. Today, we're exploring the unfiltered narratives from the visionaries who made it all happen. No paraphrasing, no sugarcoating—just the real deal straight from the horse llamas’ mouth.

From their first daring steps, to the finer details of their journey, founder Christina Cacioppo, along with early team members Sarah Scharf and Boris Logvinsky, will share their raw experiences and insights on building Vanta into the security giant that it is today.

Christina Cacioppo - CEO & Founder at Vanta

Christina is the visionary CEO and co-founder of Vanta, the real MVP in security and compliance. Before launching Vanta, Christina spearheaded product management for Dropbox Paper. Based in San Francisco, she balances her demanding role with her personal passions for running and reading.

First question: why the llama?

The choice of the llama was a bit of serendipity mixed with practicality. In the early days, our website was incredibly basic—just a landing page that said 'Vanta' with an email address below it. Our sales team was pushing for something more substantial because, as they put it, the plain page was doing them no favors. We needed imagery that was distinctive, but wanted to avoid the typical stock photos that felt too corporate or impersonal.

When the illustration came back, the llama was just undeniably cute—irresistibly so. We had nothing else that matched its charm at the time, so it quickly became part of our branding.

What started as a simple attempt to fill a gap on our website turned into a defining part of our identity. The llama was different; it wasn’t the usual fierce or clichéd security imagery like a guard dog. It was friendly and memorable, which helped soften our image and make us more approachable as a security company. Over time, every time we thought about changing it, the llama just kept coming back. We've named her Ilma and she's become such a beloved part of our brand that now it’s hard to imagine Vanta without her.

What was the initial idea?

The initial idea was to build a security company that small companies use daily. There are a lot of security companies building for enterprises, but there were very few tailored for SMBs. Originally, we thought building a better user experience was the way to achieve this, but we soon learned that while helpful, this was only marginally so. We realized that to truly engage small companies, we needed to change their incentives so they would prioritize security earlier than they typically would.

This led us to integrate security with driving revenue, growth, or improving product-market fit, often through what is commonly known as compliance. Compliance reports, for example, can open up new markets and attract new customers, allowing companies to move upmarket. For instance, when we got our SOC 2 certification, we were able to go through procurement with companies that had substantial contracts worth around $500,000 each, totaling about two and a half million dollars.

By tying security directly to revenue via compliance, we found a way to encourage even smaller companies to invest in security earlier. The original idea always centered around using SOC 2 as a starting point—a wedge into the broader market—because it's something companies recognize and value. They understand that having a SOC 2 can significantly enhance their business prospects compared to, say, just asserting that their AWS environment is secure without quantifiable proof. We saw SOC 2 as a practical entry point into building a broader security company.

Who did you run the idea by? How did you validate it?

We ran the idea by dozens of people—anyone who would give me the time of day. This included a variety of profiles such as CTOs, technical founders, CEOs, business co-founders, heads of security, and heads of engineering at different companies. We wanted to gather diverse perspectives on security needs and priorities. During these conversations, I would ask how they thought about security, how much security work they did, and what would enable them to do more. I also spoke with sales engineers to understand how often they encountered security questionnaires and how they managed them.

The validation came when a friend of a friend, who had heard about our work through word of mouth, reached out unexpectedly. They mentioned that they hadn't spoken directly with me before but knew I was working on something related to compliance. Intriguingly, they thought it was an unusual career choice yet also knew someone who desperately needed the service.

This kind of unsolicited feedback and interest was a strong validation of our idea, showing not only the presence of a market need but also that our approach could resonate well beyond our immediate network.

What type of market validation did you do?

Honestly, I'm not a big fan of traditional market validation, which I picked up from my first job at an early-stage VC firm where neither the investors nor I liked the conventional methods. Instead, my approach was more practical and direct. I talked to a broad spectrum of potential users ranging from founders of nascent startups to compliance teams at well-established public SaaS companies valued at around $5 billion.

I expected resistance, especially from compliance teams who might view our automation efforts as a threat to their roles. Surprisingly, they were quite receptive. Their feedback revealed a genuine frustration with the mundane aspects of their jobs, particularly evidence gathering—a task they found tedious and time-consuming. This was the part of their job we aimed to simplify, and their positive reaction boosted my confidence in our product's necessity and potential impact.

These interactions not only helped me gauge the immediate response to our idea but also allowed me to understand how different market segments perceived the value we offered. The insights gained were invaluable; they highlighted a clear need for our solution and suggested that we could indeed make significant inroads, especially with smaller companies.

Additionally, we tried to quantify the market potential in a more structured way during our Y Combinator sessions. Initially, the market seemed small—with estimates around one thousand SOC 2 reports being conducted annually. To make our case stronger for investors, we expanded our market definition to include related compliance areas like HIPAA and PCI, increasing our projected market size to about $7-8 billion. This exercise, although somewhat speculative, helped us argue that the market had significant growth potential and justified the need for rapid product expansion.

Reflecting back from 2025, the market has grown much faster than anticipated, and the broad applicability of our product across multiple compliance frameworks has become more apparent. This evolution has confirmed that while the initial market seemed niche, the underlying demand and potential for expansion were much greater than first assumed.

Who was on the founding team, and why did you choose those specific people?

Our first hire was a compliance expert, which might sound a bit unusual for a startup, but it was a strategic choice because we were making promises about compliance services we hadn't yet delivered. Although we were committed to fulfilling these promises, having someone with deep compliance knowledge was crucial to ensure we could actually deliver what we were promising. This person not only brought necessary expertise, but also played a dual role in customer success, filling in gaps where the product was still developing.

So, bringing in a strong engineering team early on was essential to transform these ideas into a functioning service that could begin to meet our customers' needs effectively.

This team composition reflected our immediate needs to establish credibility in compliance and build a robust product foundation. The mix of deep industry knowledge and strong technical skills was crucial for us to start effectively addressing the problems we set out to solve.

What is something you wish you did in the early stages?

Do you want a funny answer? Or a more serious one? Well, my funny answer is about how no one tells you how constantly hungry you are when starting a company. It's like, you think, 'I'll just send this email, then I'll go home for dinner.'

But on a more serious note, what really threw me was customer success. I underestimated what it really entailed. Initially, I thought of it as just support or an upsell opportunity, which was naive. It's so much more than that. There are numerous activities involved that are crucial from the get-go, especially when you're at the stage of trying to prove your product's worth. We started staffing our customer success team too late, and they were almost immediately overwhelmed. This oversight hurt us, because it affected both our service quality and our relationship with customers. We've since improved significantly in this area. But learning that lesson the hard way, about how vital a robust CS team is from the start, was tough yet essential.

These experiences—the humorous and the challenging—shaped our journey from zero to one. They taught us about the importance of addressing not just the visible aspects of a startup, like your product and sales, but also the underlying support systems that sustain customer relationships and product delivery.

What is the best thing that you did in the zero to one stage?

I think what really set us apart early on was that we truly identified a problem that was deeply overlooked, yet critically needed solving. Working on Vanta has been an utterly unique experience compared to anything else I've ever done. The traction we gained early was remarkable, and while I'd love to claim it was all because our product was superior, the reality is also that there wasn't much else available that addressed the problem in the way we did. This lack of alternatives meant that the product-market fit we experienced was not just real, but intense.

From a very concrete perspective, one of the best decisions we made was to charge annually upfront. This strategy isn't just about having great cash flow dynamics—which it does provide by alleviating the immediate need for external funding—it also puts you in a stronger position when you do decide to engage investors. Venture capitalists are naturally more inclined to invest in a business showing substantial upfront committed revenue. It's like having a scoreboard that consistently shows how your revenue is stacking up, making the business progressively more attractive with each sale.

This approach turned out to be an amazing cheat code for us. It was something I picked up from a blog post by a founder who had gone through something similar; it's a strategy that not only stabilizes your finances early on, but also builds a solid foundation of customer commitment.

You don't often hear about these tactics in popular startup advice, probably because it sounds risky or unconventional, but it can dramatically change how you scale. It's these kinds of strategies, rooted in real, actionable experiences, that have made a significant difference for us at Vanta.

Why are you suited to build this product?

I think, with all humility, coming to GRC (governance, risk, and compliance) from outside of GRC has been incredibly helpful. Most of my career was not in compliance, but in areas where I was using engineering to solve different kinds of problems. This outsider perspective has been key in seeing what could be changed about compliance processes that many in the field accepted as given. Because I wasn't steeped in the traditional ways of doing things, I could ask naive questions that sometimes led to innovative answers.

Additionally, my background at Dropbox, where I handled product management, exposed me to high-scale tech environments. This experience gave me a solid foundation in not just managing, but also understanding how technology can streamline complex processes. This understanding is crucial in reimagining compliance, which has historically been a manual and cumbersome process for companies.

What I bring to the table is a blend of technical skills and a fresh perspective, combined with a deep desire to make compliance less painful. I think these elements make me well-suited to build Vanta. Our goal is not just to create another tool, but to fundamentally change how compliance is managed and perceived. I'm excited because I believe we are on the right track, transforming a traditionally staid and complicated field into something that feels more manageable and modern.

PARTNERS 💫

Sarah Scharf, VP of Marketing + Boris Logvinsky, VP of Product

Sarah is the dynamic leader of the Product, Corporate, and Customer marketing teams at Vanta, bringing a wealth of experience from her time at Google, where she led release marketing for the Android platform. As Vanta's inaugural product marketer, Sarah excels in turning complex technical features into compelling market advantages. Living in San Francisco, Sarah enjoys horseback riding and cooking in her leisure time.

Boris is VP of Product at Vanta, and brings a deep understanding of product management from his previous role as Director of Product Management at Flexport. A Stanford University alumnus, Boris is instrumental in enhancing Vanta's product offerings, ensuring they meet the highest standards of usability and security.

Fun fact: Boris and Sarah, started their Vanta journey on the exact same day, and are still with the company now, nearly five years later.

When did you join and why?

Sarah: I joined Vanta in November of 2020. I was working at Google at the time and had been there for six and a half years. Initially, I wanted to leave to work for my former boss, who had gone to Apple. I was interviewing with Apple, got an offer, and thought that if I took the job, I’d probably retire from one of five big companies. Before Google, I had been at a startup, so I wanted to explore that space again. A friend in VC mentioned Vanta and spoke highly of them. When I met Christina, her interview questions were so incisive that it stood out. For a product marketing role, I had to go through five rounds, including a values interview and a work presentation.

At first, it felt intense—like, I didn’t even have to go through this much to get an offer at Apple! But as I got to know Christina and her way of thinking, I realized I didn’t want to bet against her. I wanted to bet on her.

I knew nothing about SOC 2 or compliance. In fact, before my interview, I kept calling it "S-O-C 2 compliance" until a friend, who was a Vanta customer, corrected me—it’s pronounced "sock two." The space was new to me, but the caliber of Christina and the early employees I met was so exciting. The company was thriving without raising institutional funding and didn’t take a Series A until they hit $10 million in ARR. It was a unique story with a unique founder, and I saw an opportunity to join and support Christina.

Boris: I typically think about three things when joining a company: the people, the market, and the product—and that's exactly why I joined Vanta. First, the people. Christina stood out immediately; she was clearly a powerhouse with a compelling vision, and she'd already brought on an exceptional team. I knew I'd have great colleagues to learn from and work alongside.

Second, the market opportunity was fascinating. Previously, my startup experiences involved companies that aimed to improve existing products or services rather than creating entirely new categories. At Vanta, there was a unique opportunity to define a market and become a true category creator, which I believed would provide invaluable learning experiences.

Lastly, the product itself already demonstrated strong product-market fit and had noticeable momentum. Customers clearly loved it, and I felt excited about the potential to build upon that success by exploring new ideas and product innovations.

Can you try and detail the interview stages to me?

Sarah: My hiring manager screen was with Christina. She asked me in about 17 different ways—very nicely, as she always does—if I really understood that this was a startup, not Google, and whether I could actually execute in a startup environment.

After that, there was a written assignment—I think it was writing a Vanta customer newsletter. Then I had interviews with a few people, including PMM and our first salesperson, Eric Martin (E-Mart), who’s still with the company, as well as our head of post-sales at the time. Then came the presentation round, where I had to do a fictitious product launch for Christina—explaining how I’d position and market a new product. Finally, there was the principles interview, which has been a staple for every Vanta hire.

It was a way to test whether someone could think through impact, time constraints, and prioritization without full information. Another question was: ‘Tell me about the most meaningful project you’ve worked on and why.’ It wasn’t about flashy achievements—it was about understanding what someone values in their work. That interview process has evolved, but the principles have stayed the same.

What role did you play in the zero to one?

Sarah: When I joined, there was another marketer who had started six weeks before me, but essentially, there was no marketing function in place. My role was to set the foundation. We were running some paid ads, but no one was really tracking them because they were managed by a contractor with little oversight. My first project was the website—at the time, it was just a picture of a llama with a button to request a demo. It was wild to see how well the company was doing with a website like that.

I focused on building a real website with product pages that clearly explained what Vanta did. That involved defining our core positioning, understanding our customers, and articulating why SOC 2 automation mattered to founders. We weren’t just helping companies get a SOC 2 report, we were enabling them to close deals faster. Beyond that, I worked on our first sales collateral and helped shape the company’s messaging. It was all about setting up the fundamental marketing infrastructure that would help Vanta scale.

Boris: I joined Vanta as a product lead, heading up the product team. At the time, there were two other product managers, the engineering team was growing, and the overall product organization was expanding quickly. Aside from Christina, there weren't many people who had previous experience in a product leadership role.

My main task was helping build out the engineering-product-design (EPD) triad structure, working closely alongside the head of engineering. We didn’t have a head of design back then, so establishing that function was also part of my role. Essentially, my job was to transition us from making casual, ad-hoc decisions—what we jokingly called ‘decisions made on the couch’—to developing more structured processes for prioritizing and building products.

It wasn’t about adding complexity, but as the team expanded from just a few people to dozens, we had to coordinate effectively, figure out clearly what problems we were solving, and ensure everyone understood the direction. My primary responsibility was to maintain our momentum, ensuring we were addressing the most pressing customer needs and continually opening new market opportunities.

What was the best thing you did in the 0→1 stage?

Sarah: The best thing we did was nail the core insight—recognizing that more and more companies would need to prove their security to enter enterprise deals. Christina bet that SOC 2 would become the common app for security, the shorthand companies would use.

At the time, our biggest driver of demand was startups that were at the one-yard line with a deal, got asked for a SOC 2 report, and had no idea what it was. They’d find us and urgently need our help. Unlike today, where companies prepare for compliance in advance, back then, it was all reactive.

That urgency created a massive tailwind for us. It wasn’t just about security—it was about enabling companies to close deals and grow. The positioning was key: we weren’t just a security company; we were a revenue acceleration company. That framing made a huge difference in how we communicated our value and why we were so successful early on.

What was something that totally bombed?

Sarah: Like any early-stage startup, we had a lot of things that were duct-taped together. One big challenge was how reliant everything was on just one person. For example, if our top sales rep went on vacation, we basically couldn’t sell any deals.

Another pain point was how we handled inbound leads. We had so much demand that we didn’t have a proper system in place to route meetings. Instead, one person was manually placing meetings on sales reps’ calendars, which in hindsight was completely unsustainable.

What was the overall vibe of the company during that time?

Sarah: It was intense, fast-paced, and unlike anything I had experienced before. I joined in November 2020, so I was working remotely from my mom’s house, and most of us had never met in person. The sheer number of hours everyone was putting in was a huge shift from Google. Everything moved at lightning speed, and there was a heavy emphasis on action. There was this mindset that most decisions are two-way doors, so it’s better to move forward and iterate than to overanalyze. At the same time, because we were a trust company, we had to balance speed with accuracy.

We even had a weekly Friday morning session called Coffee & Compliance, where an auditor would come in and teach the entire go-to-market team about the nuances of security and compliance. It was at 9 AM, which was brutal, but it was necessary to make sure we truly understood the space we were operating in.

What advantages did Vanta have at the time?

Sarah: Before Vanta, getting a SOC 2 meant doing everything manually in spreadsheets. For example, one SOC 2 requirement is that every employee must have multi-factor authentication enabled. Before Vanta, startups had to collect that evidence manually—each employee would take a screenshot showing MFA was turned on, send it to someone, and then that person would organize all the files in a drive folder for the auditor. It was an incredibly manual process.

Vanta automated all of that. Instead of relying on screenshots, we could just check if MFA was enabled across the company. For a long time, we were the only game in town. Competitors have entered the space since, but our key differentiator was being the first to automate a process that had never been automated before.

That automation meant that many startups—who otherwise wouldn’t have been able to get a SOC 2—could now compete for enterprise deals. By helping startups succeed, find product-market fit, and survive, we also created a wave of companies that were more secure from the start. That’s always been the long game—aligning economic incentives with the incentive to become more secure.

Boris: Looking back, it's funny because when I think about what we were doing then compared to now, it feels like a lot of it was pretty scrappy. But the one thing Vanta did exceptionally well was our ability to move quickly and solve problems collaboratively.

We were consistently focused on getting in front of our customers, understanding their needs, and rapidly iterating. If a problem popped up, we'd come together as a team, tackle it, and make progress immediately. There's an idea in startup culture about "running through walls"—whoever runs through walls the fastest builds the best product. That approach perfectly describes Vanta during those early days.

We weren't always building the perfect thing or even solving the exact right problem at first, but we were always making progress. We kept pushing forward, figuring things out together, and executing quickly. That mindset was probably our biggest strength at the time.

What was working at the time? What were the main go to market levers?

Sarah: It was all SEM and SEO. Our biggest driver of demand came from people who were asked for a SOC 2 report, had no idea what it was, Googled it, and found Vanta. That was the entire playbook in the beginning.

Beyond that, one of the best early decisions we made was advertising on podcasts. We became an early sponsor of This Week in Startups and rode the wave of the rising popularity of tech podcasts. That helped us reach founders directly and build brand awareness in a space where trust mattered.

Our first viral marketing moment came in 2021 when we put up a billboard on the 101 before SaaStr that said: ‘Compliance that doesn’t SOC 2 much.’ That campaign got a ton of attention and was one of the first moments where we really leaned into creative marketing.

Was there anything Vanta did uniquely well that I haven't asked you about?

Sarah: I remember when we had our SOC 2 product and were trying to launch HIPAA and ISO 27001—our next two frameworks. Getting those products into beta was incredibly hard. A lot of companies go through this when expanding from one product to multiple, even when the products aren’t that different. But the process took much longer than anyone wanted.

Christina often pointed to that moment as a turning point. We realized we needed to move faster and stop overanalyzing. That experience was really the start of our bias for action principle. We had spent so much time navel-gazing—figuring out how to launch, aligning across product, marketing, and go-to-market—that we lost momentum.

Once we finally got those products out the door, everything shifted. The mindset became: launch 10 new things next year. From that point on, we kept our foot on the gas—constantly evolving our positioning, iterating on our product, and maintaining a level of execution velocity that has been key to our success.

Why is Christina so excellent?

Boris: I think it's a combination of things. First, Christina is relentless—she simply doesn't give up. Building a company involves facing countless unexpected challenges, and her determination to keep pushing forward despite those obstacles has been incredible. But beyond persistence, she's also extremely thoughtful and adaptive. She doesn't just stubbornly push ahead; she genuinely learns from experiences, evolves, and improves how she operates and leads. Seeing her growth from four years ago to today has been remarkable.

Her intellectual horsepower is also unmatched. There's this running joke internally that Christina could step into nearly any role at Vanta—product management, sales, you name it—and perform exceptionally well. It gives her the unique ability to empathize deeply with different teams because she truly understands their work.

Lastly, Christina deeply cares about the people at Vanta. Building a company like ours requires that level of genuine care and empathy for the team, and she consistently shows that she has it.

Why do you still work at Vanta today?

Sarah: All the corny answers are true. The people are fantastic. I’d follow Christina into battle anywhere—I trust her implicitly. My product counterpart, Boris, started the same week I did, and having someone that empathetic and great to work with has been rare and invaluable.

Beyond that, the opportunity keeps expanding. When I joined, we thought our TAM was one size, and now it’s so much bigger. Every time we execute well, the next lane opens up in front of us. If I were still talking about SOC 2 every day after four and a half years, I probably would’ve left by now. But the landscape, the product, and the challenges keep shifting and evolving, and that’s kept me engaged and excited to stay.

Boris: I think for me, it comes down to the same three reasons—people, market, and product. First, the people here continue to be fantastic. I've genuinely enjoyed working alongside this team, and it remains a great group to build and learn with.

Second, the market opportunity is still huge. I definitely understand our market better today than I did four years ago, and although it's changed significantly, the opportunity for us remains enormous.

Lastly, from a product perspective, we've done many things I initially hoped we'd do. We started with compliance, but have since expanded into trust centers, risk management, and questionnaire automation—and there's still more coming. The challenges and opportunities haven't stopped. The potential to continue innovating and making an impact remains incredibly high.

Extra reading / learning

And that’s it! You can keep up with Christina, Sarah, and Boris on LinkedIn or check out Vanta on their website.

BRAIN FOOD 🧠 

Just tuned into a cool conversation on the BG2 Pod with Bill Gurley and Brad Gerstner. They dive deep into some buzzing topics like Grok 3, AI advancements in memory and voice, the dynamics in China, and even the recent shifts in the public markets. There’s a bit on DOGE and how global events are shaping tech and investment strategies. A definite worthwhile listen.

TWEETS OF THE WEEK 🐣 

ASK ME ANYTHING 🗣

I want to be a trusted resource for you. If you think anything I know in relation to brand, culture, global teams, sales and growth would help you unblock a problem in your weeks shoot me a line.

Ask in the comments or reply to this email and I will do my best to answer it in a future edition. 🙌🏼

TOOLS WE USE 🛠️

Every week we highlight tools we actually use inside of our business and give them an honest review. Today we are highlighting Paddle—a merchant of record, managing payments, tax and compliance needs—we use their ProfitWell tool.

See the full set of tools we use inside of Athyna & Open Source CEO here.

HOW I CAN HELP 🥳