This interview covers how Vanta, a security and compliance software company, is adapting to the AI era. CEO Cacioppo believes the market undervalues high-growth, high-margin SaaS firms but will self-correct long-term. Key points: Vanta is shifting to an 'agent-first' product where AI agents automatically handle tasks like deactivating ex-employee accounts (25% of clients already use it); the company absorbs AI inference costs to boost adoption, not yet monetizing; top talent pay has risen about 10x in five years, and company-specific knowledge is more undervalued than vertical skills.
Christina Cacioppo, founder and CEO of Vanta, discussed on the program how to build enduring software companies in the AI era. Vanta now serves over 16,000 enterprises and has become a leader in the security and compliance space. The core thesis is that Vanta is shifting toward an "Agent-first" prod
Christina Cacioppo, founder and CEO of Vanta, discussed on the program how Vanta has grown from a compliance audit startup into a leader in the security and compliance space (serving over 16,000 companies), and how to reshape a software company in the age of AI. Key takeaways include: Vanta is shifting toward an "agent-first" product architecture, where AI agents directly complete tasks rather than merely assisting users; the company has chosen to absorb AI inference costs itself to drive adoption, with no immediate plans to monetize; compensation for top talent has risen roughly 10x over the past five years; software pricing is moving from a per-seat model toward outcome-based approaches, though the path remains unclear. Cacioppo believes the AI trust crisis is a currently underappreciated risk, and Vanta positions itself as a security company, focusing over the next five years on automated security monitoring and continuous penetration testing.
The host asks: When Vanta was founded, this was a new category with multiple companies trying to do the same thing. How did Vanta become the sole winner?
Cacioppo attributes the victory to three factors:
1. Continuous Execution: "Software is both a blessing and a curse—you're only as good as your last release. You can be first, but it doesn't matter, because now someone can replicate what you do over a weekend using vibe code. So you have to keep shipping new products and new features."
2. Data Infrastructure (Trust Graph): Vanta has invested heavily in integrations, now connecting over 400 tools and pulling large amounts of data from them. Cacioppo calls this the "trust graph," essentially a security data lake. "This data foundation allows us to build new things faster—both software and agents."
3. Sustained Go-to-Market Push: This includes "surprisingly good" billboards and building word-of-mouth in the r/accounting community ("compliance isn't that bad").
The host notes that Vanta is a high-growth (80% growth rate), high-margin (80% gross margin) business, yet the market valuation multiple for such businesses is now only one-third to one-quarter of what it was four years ago. The host asks Cacioppo, as an entrepreneur, how she navigates this environment.
Cacioppo acknowledges the existence of "cognitive dissonance," requiring the simultaneous holding of two ideas:
She identifies three sources of pressure:
| Source of Pressure | Specific Manifestation |
|---|---|
| Funding Environment | Many investors are "AI maximizers"—they only invest in labs and tractors in Iowa (robotics), with nothing in between |
| Talent Competition | Employees see other companies raising funds every six months and seeing their valuations quintuple, leading them to question whether they are on the "right ship" |
| Narrative Pressure | The market demands that every company tell a story of "tens of billions or trillions" |
"You have to live for the full length of time. I believe this will all self-correct eventually."
The host asks: How does Vanta address the challenges of the AI era? Does it consider itself an AI company?
Cacioppo states that Vanta has advanced significantly in productizing Agents, and has yet to find a more leading AI application company.
How Agents Work:
Specific Example:
"Someone just left your company, and you haven't removed all their accounts yet. I wrote a custom Agent for you that will handle this. Do you want me to enable it? Okay. Do you also want me to remove access for these three people? Okay."
Adoption Data: Currently, 25% of customers are already using this Agent workflow, with a target to increase it to 75%.
Cacioppo explains why Vanta chooses to "eat" AI inference costs:
1. Users are savvy: "If you try to charge by token, users will quickly figure out — you're just marking up Claude's tokens by 4x. Are you 4x better than Claude? I don't know, let me try."
2. Avoid direct competition with models: Token-based pricing places the application in direct competition with the underlying model.
3. Current focus is adoption: "This is a phase of technology usage and deployment. Get it right first. Monetization can come later."
Cacioppo reveals that Vanta invested significant effort in evaluations (evals) early this year — having security and compliance experts write task-specific evaluation frameworks.
"When we consider model switching, it's mainly about quality, not cost. Part of the reason is that we don't consume as many tokens as coding. Coding Agents use a lot of tokens, followed by legal and document drafting. Our domain involves decisions and actions, with relatively low token usage, allowing us to optimize for quality."
The host asks: What are other founders doing? What will the end state look like?
Cacioppo states that "everyone wants to achieve outcome pricing," but the challenge lies in defining the "outcome."
She distinguishes between output and outcome:
Vanta attempts to define a "neat unit of work"—such as "document draft completed," "alert closed," or "account offboarding processed"—but the problem is:
"I just named three things, and I could name 47 more. Then the user has to think: If I use the Agent for this, I pay this price; if I do it myself, I pay that price... No one wants this."
She criticizes token pricing and the disguised approach of "credits" pricing:
"Users are smart; they know what you're doing. You're just obfuscating token pricing."
Moderator asks: As an 8-year-old company, how well is Vanta using AI tools internally?
Cacioppo gave herself a relatively low score, primarily due to aging codebase:
"An 8-year-old codebase—the context window can't grasp the whole thing, and the Agent does stupid things. Then you need a high-context engineer to supervise it—that helps, but to some extent defeats the purpose of the Agent."
She mentioned that Vanta is working on modularizing the codebase, enabling the Agent to understand smaller parts and work effectively. Notion is about 9 months ahead in this regard.
"Companies have always had this problem—when new engineers join, it takes time to understand the codebase. The Agent just amplifies the issue: now we want 9,000 new engineers to join tomorrow."
Moderator asks: On a scale of 1 to 10, how much does AI change everything? Cacioppo answers: "9. The principles remain the same—everything is hard, people matter, all the clichés are still clichés. But the way things are done should be completely different."
The moderator asked: If Cacioppo returned to a teaching role, what would be the 101 for adopting AI?
1. Use it yourself first: "It sounds obvious, but you must use it yourself."
2. Continuous learning: "Update your understanding of the model at least every two weeks—where it excels, where it falls short, and what 'harness' means. Things change too fast."
3. Get more people involved: "You need hands-on experience with what works and what doesn't, so when someone says, 'I'm going to fire all SDRs because I built an Agent,' you can judge what's right and what's wrong."
Cacioppo shared a specific case: Vanta aimed to improve the customer onboarding experience this year. The team—talented and motivated people—repeatedly submitted "onboarding wizard" proposals, the traditional SaaS approach with progress bars and confetti effects.
She repeatedly said, "No wizards, use an LLM," but the team kept bringing wizards.
The real reason:
"They didn't know if the drag-and-drop file feature could work—maybe not. But they knew the wizard would work because they had done it before. They felt this project couldn't fail."
The solution was: "We bet the LLM process would succeed, we would make it succeed, and if necessary, we would iterate like climbing a mountain, but burn the boats and just make this thing work."
The host asks: How much has compensation for top-tier talent increased over the past five years?
Cacioppo estimates total compensation has risen by roughly 10x and believes "it should actually be higher."
Her compensation philosophy: "You can never pay the best people enough. Never. You should always try, but you'll never get there."
What makes top talent so valuable?
"High agency—getting things done. It sounds mundane, but it's worth millions. A high-context person who understands the company, clients, and domain, makes broadly reasonable decisions, sometimes makes bad decisions and iterates, just keeps moving forward—that's incredibly valuable."
The host asks: Will it rise another 10x in the next five years? Cacioppo believes acceleration is likely, but there is a counterforce—investor focus on dilution and equity incentives.
"In 2022-23, the industry did discuss equity compensation issues, but that's certainly not the case now. Without pressure on dilution, people will just earn more and more, and that's probably as it should be."
Cacioppo says she historically hasn't cared much about valuation multiples, but now cares about employee sentiment:
"Employees feel they are at a growing company, and growth relative to other opportunities in the market. There are companies in the market that raise funding every six months and see their valuation quintuple—those are real talent competitors."
On tender offers (employee share buybacks): She considers them "unhealthy," but "my opinion doesn't matter. Tender offers have become normalized, and people expect them as part of compensation. If you don't offer them, you need to make up for it with something else."
| Item | Rationale |
|---|---|
| Token Pricing | Users will see through the markup, putting the application in direct competition with the model |
| Low Margins Per Se | "Low margins for the sake of low margins" makes no sense |
| Custom Post-Training Models | Primarily marketing value, especially to investors. Inference providers argue: the reason for post-training is cost, not quality |
Company & Client Knowledge (Company Context):
"Hiring, training, and onboarding new people into a company remains very difficult. Someone who has been at the company, knows how to navigate it, and understands the client is undervalued. I now value this more than vertical skills (e.g., being great at sales). I would rather have someone with slightly weaker sales skills but who knows Vanta better."
She believes that when AI labs and fast-coding AI companies build their go-to-market teams, they overvalue the skill of "being a good salesperson" and undervalue the value of company context.
Cacioppo argues that FDE is essentially "professional services," but the FDE label attracts a different (and better) talent pool.
"If you call it a professional services role, that's a completely different talent profile. You won't get Harvard CS graduates, high-agency individuals who want to learn how to build a business, signing up to be the 4th or 12th professional services person at a company."
She notes that Palantir succeeded because it had eight-figure contracts, while many companies use FDE for five- to six-figure contracts, "and those economic models may be inverted."
The host asked: What did you learn from conversations with global founders?
Cacioppo shared his exchange with a French client:
"A few weeks ago, I was meeting clients in Paris. I was quite surprised to find that many French software companies primarily use Chinese models. Initially, I assumed it was nationalism or anti-American sentiment, and foolishly raised that guess. Someone quickly corrected me: 'Absolutely not. We basically switched when Trump closed Fable to non-Americans. We realized there was a massive business continuity risk—we couldn't trust that if our business was built on American models, they would remain available.'"
The host asks: What is Vanta’s vision for the next five years?
Cacioppo positions Vanta as a security company, not merely a compliance company.
“We started with compliance. The best form of compliance is proving the security you have. You must first have good security. We can and are entering multiple security domains as a platform—we already have the data, already have the intelligence through agents, and can layer more security products on top of that.”
Core thesis: The need for security proof will only increase in the AI era.
“Whether working with large enterprises, governments, regulators, or legislators, you must prove your software is industrial-grade. This will happen in more ways and across more domains. Vanta connects both ends of this market.”
Cacioppo believes the security threat posed by AI is not zero-day vulnerabilities but chain attacks:
“These models are far more persistent than humans. A person gives up after about 9,000 attempts; a model will try 9 trillion times. They can string together 17 individually benign actions to find a real vulnerability.”
She cites OpenAI’s presentation at RSA on Hugging Face as an example.
Impact on the security industry:
“In the past, you’d say, ‘This vulnerability is low severity, fix it in 90 days.’ But AI completely upends prioritization. Saying ‘everything is critical’ doesn’t help—then what do you do? In reality, you must fix at machine speed. If you fix at machine speed, you don’t need prioritization.”
“A continuous white-hat hacker agent that keeps trying to break in. Every time it finds something, a partner agent fixes it. That’s the ultimate vision for part of Vanta’s product—very effective for most customers. CrowdStrike may do better for large enterprises, but Vanta focuses on the customer base where it’s already embedded.”
Cacioppo notes that Wiz’s customers start at companies with a few thousand employees, and its pricing starts at that level as well. Vanta targets customers who are “unlikely to spend $150,000 on Wiz but are very willing to spend $40,000–$50,000 on a product that fits them.”
The host asked: How has Cacioppo's personal motivation changed over time?
"At the beginning, I had this feeling of 'People think I can't do it, I think I can, and I'm going to prove them wrong.' That's still there, but it's lost some of its darker edge. It's more like, 'Oh cool, we're here. Now let's see how far we can run' — this feels more like fun and joy. Not joy all the time, but it feels more like 'Let's see how far we can go,' whereas at the start it was more like 'You think I can't even cross the starting line? I'll prove you wrong.'"
Cacioppo said what surprised her most was that she enjoys go-to-market more than she expected.
On public speaking:
"I used to be a terrible public speaker. I was most nervous in front of my own team — because I cared most about their opinions. Exposure therapy helped a lot — you just do it, and you get better."
What makes a good speech?
"No one remembers what you said, but they remember how you made them feel — that cliché is annoying, but very true. The content has to be genuine. If you go on stage feeling like you have nothing to say, the audience will feel it too. The key is to find your own version — for me, I put real content in, while remembering that no one will remember any facts, so that's not the point."
"Heart matters much more than mind. And the key to a good heart is: you believe it yourself. Sincerity. One-on-one, on stage — people are very good at reading each other."
The host asks: What is the biggest trade-off at present?
Cacioppo highlights two key trade-offs:
1. Agent-first vs. Traditional SaaS UI:
"We are trying to build everything in an agent-first manner. You want a report? The agent will generate charts on demand based on all the data. We are not stuffing Tableau into Vanta—something we might have done in 2021-22. We believe this is the future of software. But maybe that tractor company (referring to traditional SaaS) needs 10 years. If you are right but too early, and if we are wrong..."
2. AI resistance from large enterprises:
"We are negotiating with a large U.S. enterprise, and they say, 'Maybe we want your AI features, maybe not, but can you turn them off first?' The reason is: non-AI tools are easier to get through the procurement process. We don't have an off switch—we don't want to build that. We would rather spend our time and effort on things that are truly useful."
The host asks: If Cacioppo were still an investor, where would she be looking?
Cacioppo says she does not envy the current investor landscape:
"If you haven't invested in labs or inference providers over the past four years, you should shut down your fund—what are you doing? This feeling is sharper on the investor side than on the company side."
She identifies overlooked opportunities:
| Area | Rationale |
|---|---|
| Open-Source Model Ecosystem | The infrastructure around open-source models is far less developed than that of major labs, yet the market has already "decided" that open-source models will be important |
| Safety/Cybersecurity | Seeing more startups here than in any other area |
| Revenue Technology (Rev Tech) | Legacy SaaS revenue tech providers should be doing this, but they don't seem to be—they are taking the PE/Bending Spoons route |
| Robotics | "Models have gotten very good there too, which is obvious. It may still be undervalued compared to all the attention on software." |
"Vanta has seen increased collaboration with all levels of government (federal, state, local, both in and outside the U.S.) over the past few years. AI has created FOMO among government officials. They have always known they lack modernized processes or software, but now the urgency feels greater."
The host asked: What important issue is being overlooked?
Cacioppo believes the AI trust crisis is a currently underestimated risk:
"From data center conversations to personal agents, we simply don't trust software companies and tech companies the way we used to. And this situation is worsening year by year. It's hard to imagine it rebounding to the kind of useful optimism we had 15 years ago."
Vanta's positioning:
"Helping companies prove they are trustworthy, industrial-grade, and secure through actual metrics and definitions. At a $250 billion valuation, Vanta sits at the center of all these transactions—helping companies meet high standards, then helping them communicate that and accelerate their business."
The host summarized: "AI brings extremely high excitement but extremely low trust." Cacioppo responded: "Yes. Vanta's job is to maintain the excitement while increasing trust. Genuinely increasing trust, not just by feeling."
"Faster, more intense, more aggressive—hopefully, because we need more white hats to fight back. Speed must reach levels we've never seen before. You have to bring humans up to that speed—remove part of the human decision-making process. Humans may architect systems and write rules, but not make every decision. Perhaps in the future, we'll all be writing evaluations (evals)—writing evals all day long."
"Expansive. We have this incredible customer and data foundation, and now we can build on top of it. It took eight years to get here, and we can build on it for another five or eight years."
| Position | Guest View or Explicit Action | Key Basis and Data |
|---|---|---|
| Vanta | Founder and CEO, positioned as a security company, currently undergoing an Agent-first transformation | 16,000+ customers, 5 product lines, 400+ tool integrations, 25% of customers already using Agent workflows |
| CrowdStrike | Believes it performs better in the large enterprise market; Vanta does not directly compete | Focuses on a different market segment |
| Wiz | Overlaps in cloud security configuration, but customer base and pricing differ | Wiz customers start from companies with a few thousand employees, pricing starts at $150K+; Vanta targets the $40-50K market |
| Notion | Leads Vanta by approximately 9 months in codebase modularization | Cited as a benchmark for AI engineering practices |
| Cursor | Mentioned as a source of talent competition ("complains about Cursor poaching talent") | No position action |
| OpenAI | Cited as a reference for AI security discussions (RSA Conference speech) | No position action |
| Palantir | Cited as a successful case of the FDE model | Has eight-figure contracts, economic model is viable |
1. "You are only as good as your last shipped product" (Cacioppo) — The eternal truth of the software industry is amplified in the AI era, as the barrier to replication has dropped significantly.
2. "Users are smart; if you try to mark up Claude tokens by 4x, they will find out" (Cacioppo) — The AI application layer should not attempt to profit from token spreads, as this places it in direct competition with the models themselves.
3. "You can never pay enough for the best people" (Cacioppo) — Compensation for top talent has risen roughly 10x over the past five years and is still accelerating, because the value of highly motivated, high-context individuals is magnified in the AI era.
4. "Company context matters more than vertical skills" (Cacioppo) — People who understand how the company operates and who its customers are hold more value than those who are merely skilled in a specific function, especially as AI tools lower the skill barrier.
5. "French companies use Chinese models not out of nationalism, but due to business continuity risk" (Cacioppo) — Geopolitical uncertainty is reshaping global AI infrastructure choices.
6. "AI brings extremely high excitement but extremely low trust" (Host/Cacioppo consensus) — Vanta’s positioning is "stay excited, increase trust," which may be one of the most important business opportunities in the AI era.
7. "Maybe in the future we will all write evals — write evals all day" (Cacioppo) — The human role in the AI world may shift from executor to rule-maker and evaluator.