YouSaid · the spoken record

Christina Cacioppo

lines on the record: 68
first: 2021-06-17
most recent: 2021-06-17
sittings or episodes: 1
sources: podcast

Every line below is reproduced as it was said and linked to the record it came from. Nothing here is summarised or generated. Directory · Search · Corrections

“There's a lot going on there, and there's a lot that's like deeply unfair and deeply messed up in that. But I think for me, that was actually realizing this is like, again, really messed up and really unfair. And I should not be able to do this for lots of reasons, but how can I sort of harness all of this for the benefit of my colleagues who clearly should actually be the ones doing this? And so I think just a lot of stuff around figuring out how to maneuver around the system you're in.”
2021-06-17 · Invest Like the Best · Christina Cacioppo - Building the New Standard in Security – [Founder’s Field Guide, EP. 38] · IDENTIFIED FROM THE TRANSCRIPT · source
“Was Thailand and Uganda, and Uganda summary of the journalist ostensibly, and that was just like getting comfortable being able to call people up and ask them questions and, you know, say, hi, I'm Christina. And I'm like kind of a random person, but can I come over and ask you a bunch of questions? And then being like, yeah, totally go for it. And so some amount of just being able to do that. Rwanda summary, it was with the Rwandan NGO that didn't do any work in Rwanda because of the political climate stuff in neighboring countries, but because I was a young Western academic, also a 19-year-old, I could go ask questions about Rwandan stuff. And so that summer actually, the government decided to let a bunch of the prisoners who had been in jail for a decade from the genocide walk home to go for these local courts. And it was like the big thing in that summer, right? But no Rwandan could really ask those questions. And I could walk in and be like, hi, I'm doing a like school project. Can I ask them stuff? And they would basically feed me questions to go ask my colleagues would.”
2021-06-17 · Invest Like the Best · Christina Cacioppo - Building the New Standard in Security – [Founder’s Field Guide, EP. 38] · IDENTIFIED FROM THE TRANSCRIPT · source
“So good at this question. I attempt to prepare. So there's also like parent things, but I actually think one thing that's first and probably doesn't even know they did was so when I was in undergrad freshman year, I ended up meeting a senior at the time at school who I'm not quite sure why she did this. Her name was Alice. She basically sat me down and was like, hey, there's a lot of money at Stanford to like have them send you places for the summer. You just have to know how to apply for it and what to say and how to do that. And she sat me through and like ran me down how to apply for student grants basically and the different ones. And I spent every summer minus the Google summer somewhere in the world. I had this grant, right? We're like break even for the summer. And I think the experience, the like, I'm going to send myself to Rwanda at 19 and just live alone. It'll be cool. And it was fine, right? But just so much came out of that. And I'm just eternally grateful for her for doing that.”
2021-06-17 · Invest Like the Best · Christina Cacioppo - Building the New Standard in Security – [Founder’s Field Guide, EP. 38] · IDENTIFIED FROM THE TRANSCRIPT · source
“And it was like a mid career switch. And they were like, one is not true. And two, like, oh, well, you can go learn that. It'll only take two years. It'll be fine. Then just go do it. Why wouldn't you do that? And I think that optimistic take was just. Really helpful, kind of having these are the people who believe in you more than you believe in yourself”
2021-06-17 · Invest Like the Best · Christina Cacioppo - Building the New Standard in Security – [Founder’s Field Guide, EP. 38] · IDENTIFIED FROM THE TRANSCRIPT · source
“Literally, people just, and we're well intentioned, but they're just like, This is a great job, it's a great springboard. Think about your email address, the left side, Christina. There's a right side USV.com. The right side's clearly stronger than the left. Why would you leave it? So well intentioned and so infuriating. And I think now, especially with Krishna, you can look back and be like, that was horrendous advice. For a few reasons, but I think one, there was like a bet on myself that I was very willing to take there. And I think that helped, even though I got a little confused with everyone saying that that was really helpful. And I think on the flip side, I also had people around me who were like, you can go be in it.”
2021-06-17 · Invest Like the Best · Christina Cacioppo - Building the New Standard in Security – [Founder’s Field Guide, EP. 38] · IDENTIFIED FROM THE TRANSCRIPT · source
“Listen to the people you want to listen to, don't listen to the people who seem like they know what they're saying. So a few parts one, I had a bunch of people tell me I shouldn't leave USV. And in retrospect, you're like the pinnacle of my career. Anyone's career was when they were 24. Like, come on.”
2021-06-17 · Invest Like the Best · Christina Cacioppo - Building the New Standard in Security – [Founder’s Field Guide, EP. 38] · IDENTIFIED FROM THE TRANSCRIPT · source
“Think there's a part, so we still do this. In the early days, we talked about customers on a first name basis, talk about Dan, here's how Vanta made Dan happy and sad. Everyone knew Dan is a real person. Everyone knew what Dan was happy and sad. We talked about it in that way, which is, you know, in some ways really juvenile, but it was actually like emotional and kind of purposely so because it was like, look, we're building software for millions of internet businesses, you know, ideally, but also there's real people behind it and our decisions affect them. And I think while we're past the stage of everyone knows who any given Dan is, there's very much like that ethos, like that is our version of customer centricity where we are building software that affects real people and again makes them happy and sad. We want to like do the best or take that kind of responsibility seriously.”
2021-06-17 · Invest Like the Best · Christina Cacioppo - Building the New Standard in Security – [Founder’s Field Guide, EP. 38] · IDENTIFIED FROM THE TRANSCRIPT · source
“It's probably a like clarity of thought and communication piece of just figuring out how to harness what I have in my head, articulate it in a way that both makes sense to people who are not me, and communicate it clearly. I think I've gone between probably like the classic founder, like being way too prescriptive, and then spent some time definitely not quite too hands-off, but just being like, oh, well, you're a smart motivated person. And like, I wouldn't want someone telling me what to do. So you just go, but needing, then realizing like, no, some direction is actually really helpful, especially if you want quick decisions, good decisions, et cetera. And so just kind of like trying to find an equilibrium on that continuum.”
2021-06-17 · Invest Like the Best · Christina Cacioppo - Building the New Standard in Security – [Founder’s Field Guide, EP. 38] · IDENTIFIED FROM THE TRANSCRIPT · source
“And we needed like interventions and drinks about what we were doing with our lives. We do the business, it's quite good, but the times have changed. And so just like how can we raise the profile of the company and what we're doing where honestly a lot of this stuff doesn't come supernaturally to me. I am much more of a like, I'll just go sit in the corner and work and emerge when you're done. That's not quite the game on the field. And I think you do have to play the game on the field.”
2021-06-17 · Invest Like the Best · Christina Cacioppo - Building the New Standard in Security – [Founder’s Field Guide, EP. 38] · IDENTIFIED FROM THE TRANSCRIPT · source
“So, two, I mean, a lot of things top of mind, but two things top of mind one structuring relationships with like other folks in our ecosystem, so whether it's audit partners or kind of adjacent vendors. I think coming from VC, people think you're probably great at this stuff, but it was only two years. I was like mostly talking to people, right? I wasn't giving out term sheets. So that piece of just learning how to structure some of those relationships so both sides are quite happy with them, sort of get to like the discovery, what's actually important to you. And I think the first answer is always revenue, but then you keep going and there's five more interesting answers that you can really build around there. I think, honestly, like brand marketing and just profile raising, if we've been really quiet about Fanta for the last few years. And a lot of it was because we actually thought we had a great business and we didn't. We wanted people to still think we were like often, you know, some bizarre corner.”
2021-06-17 · Invest Like the Best · Christina Cacioppo - Building the New Standard in Security – [Founder’s Field Guide, EP. 38] · IDENTIFIED FROM THE TRANSCRIPT · source
“Still, read a lot of them actually go in waves, so I kind of won't read a book for a month or two, and then I will over the course of a month read 10, 12 books. And it's this sort of strange wave pattern where it kind of averages out to call it a book a week, but it's much lumpier than that. A big part of reading for me consciously is fiction books. Again, some of it's, I've always liked this. This is actually where I just feel, some ways feel very comfortable. That's what I just did as a kid. In terms of other things, I mean, podcasts, just the last decade, I mean, kind of last few years, listening to podcasts for a decade and a half, but really the last few years in the explosion there has been really neat to see newsletters, conversations, probably more conversation skewed than ever, I think, also. Yeah.”
2021-06-17 · Invest Like the Best · Christina Cacioppo - Building the New Standard in Security – [Founder’s Field Guide, EP. 38] · IDENTIFIED FROM THE TRANSCRIPT · source
“So, we think about Vanta being part of every software transaction. One business of buying software from another business and as part of that evaluation, are you reasonable? I'm going to give you a bunch of data. Are you going to leak it on the internet or are you going to do the right thing with it? And that's sort of answers MO is we help. We talk about those vendors first, but vendors actually do the right thing, know what they're doing, get secure, and then prove that security or demonstrate it to their buyers. And over time, helping those buyers reason about the security of their software vendors. So we really do see Vanta as part of every transaction.”
2021-06-17 · Invest Like the Best · Christina Cacioppo - Building the New Standard in Security – [Founder’s Field Guide, EP. 38] · IDENTIFIED FROM THE TRANSCRIPT · source
“Joking, but not, I someday look forward to the feeling of mastery, but I kind of can't remember what that feels like. Just feeling like you're good at something, truly good at it, is not something I've experienced in the last few years. I think that was more than I expected. And again, I'm someone who, to a fault, kind of likes to run up steep hills metaphorically and actually, but yeah. And I think it's because in a role like this, your job really is to like figure out something well enough such that you can get someone who's infinitely better than you to do it. As soon as I start feeling like, oh, mastery was like, you know, sometimes like reasonably confident at something, then you're like, oh, I have to give this away now. Never going to go back to square one with something else. But just, yeah, I think for me, actually, there is like a just recognizing that calling that out and being like, okay, great. Some days will change, but mastery is not the game I'm playing right now.”
2021-06-17 · Invest Like the Best · Christina Cacioppo - Building the New Standard in Security – [Founder’s Field Guide, EP. 38] · IDENTIFIED FROM THE TRANSCRIPT · source
“Versus kind of more thrash. We've kind of gone a little bit more on the Change Things upside. I think the other place this shows up in organizations is handoffs, particularly sales to CS, because where success is one. Some of that is inevitable, but we also have tried to really buddy up sales and CSM, so they really like understand each other as people. And so it's less of like, I signed the customer, fling them over. I guess they'll get onboarded, who knows what happens next and more like, no, if you're a salesperson, but you spend a bunch of time with someone in customer success and understand how they talk to customers, you're probably subconsciously going to change some of the things you say.”
2021-06-17 · Invest Like the Best · Christina Cacioppo - Building the New Standard in Security – [Founder’s Field Guide, EP. 38] · IDENTIFIED FROM THE TRANSCRIPT · source
“Do you think about it because we've done it? And it's always very well intentioned. I think actually it speaks to the power of incentives and the power of structure and actually how much organizational design and incentives can have these totally seemingly disparate downstream effects. So one thing we've done is I think just a trade-off on that is you can just change your organizational design more frequently. And so we've basically every three to six months for the company's history changed how product is structured, what problems are tackling. There's definitely cost to this. You definitely have the bit of thrash, bit of adjustment, but the flip side is you actually are kind of like forcing people to like pivot and think about problems in different ways. And so they don't get kind of too calcified in what they're doing. And so yeah, on that, like everyone is kind of stable going, but going in these very well-defined ways that end up being exposed to users unexpectedly.”
2021-06-17 · Invest Like the Best · Christina Cacioppo - Building the New Standard in Security – [Founder’s Field Guide, EP. 38] · IDENTIFIED FROM THE TRANSCRIPT · source
“Culture and one of our values, and actually we recently did something of a poll internally. Our most popular value is our most controversial one, which is frameworks thinking, which is basically like have a framework for your decisions and articulate it. We're actually not prescriptive about which framework you use, but we are prescriptive in that you have one and it's articulated. And I think that mostly just has the effect of making the decision maker stop. And even if they're like, look, I know the answer is have a llama on the homepage, it still makes them stop and write down why that is the right answer and that forces them to think through it. And so that, I think, is actually one of our better tools for that.”
2021-06-17 · Invest Like the Best · Christina Cacioppo - Building the New Standard in Security – [Founder’s Field Guide, EP. 38] · IDENTIFIED FROM THE TRANSCRIPT · source
“I think probably because on the internet scale, it is just so different than real life. And so we don't actually have a lot of practice thinking about it. Some people talk about, I think it's also hard to sort of actually reason about what exponential growth is because you don't often see that. But I think similarly actually the patterns and like the differences of interactions between different users on a service in different ways or like buyers and sellers is just so much going on there and there's so much complexity. It's really hard to reason about. And yet there's just not real world analogies at the same scale because like Dinner is just like the giant Monte Carlo simulation and it's just running so much that like everything along the spectrum actually happens whereas in real life the low probability things don't happen very much”
2021-06-17 · Invest Like the Best · Christina Cacioppo - Building the New Standard in Security – [Founder’s Field Guide, EP. 38] · IDENTIFIED FROM THE TRANSCRIPT · source
“Obvious statement of like you have to maybe a less obvious statement of you have to keep trying things and it is not always what you think will be the competitive advantage that ends up being the competitive advantage for me to try to say it differently I think it's actually kind of hard often to predict upfront what some of this will be and so you just have to try a few things and you might be surprised by what works but I think that actually just puts pressure on like iteration speed more than whiteboard sessions in some way trying to be overly academic about this is not I think that what USB a path to success here again it's a little too reductive but it's like attackathons it's just trying things what are real people actually going to use which is always hard trying to reason about the network effects which is really hard i think even 10 i guess 15 20 years into like large networks of engage users”
2021-06-17 · Invest Like the Best · Christina Cacioppo - Building the New Standard in Security – [Founder’s Field Guide, EP. 38] · IDENTIFIED FROM THE TRANSCRIPT · source
“Almost there, but this stuff is just hard and so much is going on, and so it's so easy to have things flip through the cracks. And so a lot of security broadly, right, you're only as strong as your weakest link. And so there is just, even if some of this stuff just sounds dead simple and like kind of trivial, I actually do think there's a ton of value in helping people shore it up.”
2021-06-17 · Invest Like the Best · Christina Cacioppo - Building the New Standard in Security – [Founder’s Field Guide, EP. 38] · IDENTIFIED FROM THE TRANSCRIPT · source
“Lot of what makes it into headlines are like you know a nation state is attacking somebody most companies their problem is not you know a nation state wants to attack them most companies their problem is they can't sell their product so this was like from a security perspective why you kind of think actually you go in through a wedge of compliance again the problem's not China wants you the problems no one wants you so if you can help this the other part too is for most companies they're not doing the basics and again sort of twofold one there's like lots of basics and two there's just lots of stuff going on in a company so actually also in the very early days at Vanta one of the very first tests we wrote like checks we started doing was does everybody in the company have two factor in their email and there are about 10 companies we did this for initially nine out of ten of them told us they had two factor on everybody's email account two out of 10 actually did so when you go look at the lists seven in the middle oh it's everyone but the founders it's everyone but the office manager there”
2021-06-17 · Invest Like the Best · Christina Cacioppo - Building the New Standard in Security – [Founder’s Field Guide, EP. 38] · IDENTIFIED FROM THE TRANSCRIPT · source
“Yeah, very much so. And people talk about these are all little colored, but people talk about the better business bureau and those ratings or like credit ratings for consumers, FICO scores, Moody's bond ratings. And in some ways, I think this is broadly similar to what the purpose of SOCT2 serves. Do we think Moody's is the most rigorous thing in the entire world? No. Is it tremendously useful? Do lots of people rely on it? Yes. You're a rough heuristic. I think what we're trying to do is just a more nuanced version of that of are you baseline reasonably secure? Baseline have the organizational muscle to go through one of these intense audit processes that you can get from a SOC too. But what is the company's security actually like? Is it in place continuously? Is much more something we're trying to move towards?”
2021-06-17 · Invest Like the Best · Christina Cacioppo - Building the New Standard in Security – [Founder’s Field Guide, EP. 38] · IDENTIFIED FROM THE TRANSCRIPT · source
“We sometimes have the coast is the company behind Magic the Gathering. They have a game with like eight sided die where they like sort of like open source the game design here. And so there's like lots of people made games with eight-sided die, but theirs was actually always the most popular. And so with rising tide lists all boats, more people. Lowered the barriers to entry in a way, but they were”
2021-06-17 · Invest Like the Best · Christina Cacioppo - Building the New Standard in Security – [Founder’s Field Guide, EP. 38] · IDENTIFIED FROM THE TRANSCRIPT · source
“Twofold little share about. And it's like a constant conversation internally at Fanta, as you might imagine. One is actually on the commoditization piece. So just like, can we drop the costs of getting a Sock 2 generally? I think we have. Maybe slightly less a dollar cost, but very much the time and effort costs, a mental overhead piece. And so this is standardizing, standardizing what a Sock 2 is, how you prove it, what these pieces are. This helps us also, I think, makes it easier for some competitors to build on. But I think actually the important part, it is Avanta standard way and other people can totally use that who is defining what the industry needs. That's Vanta, because that's what we've always done. Back to the early days, here's a very rigid list of things to do. And so there's some amount of like the Wizards of the Coast example always gets used here, but right, they like standardize some of the game design pieces and there's like a lot more game design.”
2021-06-17 · Invest Like the Best · Christina Cacioppo - Building the New Standard in Security – [Founder’s Field Guide, EP. 38] · IDENTIFIED FROM THE TRANSCRIPT · source
“Because the kind of lasso around it all is compliance. It's not actual tool category. We are several tools bundled into one. And so there's just a lot of stuff and a lot of complexity there”
2021-06-17 · Invest Like the Best · Christina Cacioppo - Building the New Standard in Security – [Founder’s Field Guide, EP. 38] · IDENTIFIED FROM THE TRANSCRIPT · source
“Yeah, I think, I mean, we're still working through this, but a SOC2 covers so much, again, from who's hired at a company, what role do they have, what access to systems should they have? How is our AWS account set up? What do employee laptops look like? Like there's just so much stuff. There's a part of this that was very compelling to me initially because I'm a bit of a shiny objects person. I love learning about new things. And one of the things, one of the USD partners, Brad actually told me as I was leaving was he was like, look, go off and do what you're going to do and you're going to be great and all these good words, but also you, Christina, are going to struggle with just choosing one thing because you like so many things, which is actually deeply true. Anyway, I'll just say, Sock to and compliance has a bunch of different things to go think about, which is fun, but there is just so much stuff. There's so much stuff to build. There's so much stuff to maintain. We have so much product surface area.”
2021-06-17 · Invest Like the Best · Christina Cacioppo - Building the New Standard in Security – [Founder’s Field Guide, EP. 38] · IDENTIFIED FROM THE TRANSCRIPT · source
“Capable can learn all the things, but also are just doing 97 other things at once. Do they want to go learn all the nuances of compliance? Absolutely not. They just want to get the thing done. And so to the extent Vanta can be that translation layer between them is actually a really powerful and really helpful place to be. We can speak compliance to one audience and we speak engineering to another.”
2021-06-17 · Invest Like the Best · Christina Cacioppo - Building the New Standard in Security – [Founder’s Field Guide, EP. 38] · IDENTIFIED FROM THE TRANSCRIPT · source
“Good and bad, I sell like a product manager. Hey, I made this thing. What do you think of it? Is it a need? Can I ask you all these questions about how you think about the world? So I end up actually being like really strong, what salespeople call qualification, what I would call need finding, but it comes out of like a product manager's desire to understand them. I can sometimes get way too far in the weeds of that the other part and be like, oh, I have another shiny thing to show you. And someone's like, no, I just want a contract. Right, right. Sorry. Yeah, that's why we're talking. So that's kind of funny. But I think there was a part of that, especially in the very early days, because we sold and sell to CTOs. And so there was just a part of credibly being able to talk about things, answering the really minute questions. And one early customer sort of described us as this babel fish between engineering and compliance, which I actually really liked because when we think about our users, they're engineers who smart, motivated.”
2021-06-17 · Invest Like the Best · Christina Cacioppo - Building the New Standard in Security – [Founder’s Field Guide, EP. 38] · IDENTIFIED FROM THE TRANSCRIPT · source
“One model I have generally is actually the go to market side of a company is much more like engineering. I know in software engineering, I mean like industrial engineering. You have a system, it has inputs, there's transformations, there's conversions, you have outputs, and you can measure and optimize all of that. That is my model for the go-to-market side of a company. I think the actual engineering side, like the end of product design side, that is much more like art. If you try to turn that into a system with inputs and outputs, doesn't work. So when I think about sales, I do think about it as sort of a system of, again, leads come in, right? There's conversions at different stages, and then you have customers that go out. And so then you're just okay, how can you track and measure and understand differences at each stage and do that? That's my broad framework for sales. I think more specifically, so I sold the first few hundred thousand dollars worth of Vantas have been far outstripped by many, many salespeople at Vanta at this point.”
2021-06-17 · Invest Like the Best · Christina Cacioppo - Building the New Standard in Security – [Founder’s Field Guide, EP. 38] · IDENTIFIED FROM THE TRANSCRIPT · source
“And it's just one of those good reminders. It is easier to create the world you want than it ever seems to a universal law that pricing should look like this and you're like, no, I called five friends in 2017 and like here everyone is. There's just so much like the butterfly flapped its wings and all of this. But anyway, I think that's like a helpful reminder. I try to remind people advantage of that of just like we can change all these things for good and bad. But in terms of the future business model innovation, there's some stuff we're playing with. I'm actually really excited about this. I think there's sort of the obvious fast stuff of, well, why don't we have pricing scale somehow with company size in a sort of autopilot way per user, some sort of metered billing. I think that broadly is probably worth fast pricing is going. And so there's definitely stuff there. But I also think there's some other kind of more interesting things we can do too.”
2021-06-17 · Invest Like the Best · Christina Cacioppo - Building the New Standard in Security – [Founder’s Field Guide, EP. 38] · IDENTIFIED FROM THE TRANSCRIPT · source
“One question we often get is like, hey, isn't this one time thing? And have you just glued a SaaS model on top of it? Because that's what the cool kids do in the early 2020s, late 2010s. And I usually don't think that is, and I don't think it is, because to your point, the historic way to do this with auditors, and they charge you annually. And it's not subscription revenue, but they like, have you signed kind of three-year contracts? And so we came in with a subscription, but again, it wasn't totally unnatural with it. And that sort of pillars are one, yes, you want to get ready for your SOC2 initially or whatever compliance audit. And then two, just the continuous monitoring. And there is just value to having something going and checking. Have you kept all of your doors and windows locked at all times? So that is still where we are today. And it is, our pricing is tremendously unsavvy, somewhat of a point of pride, but also just kind of an embarrassment at this point. It's been interesting to watch the industry standardize around some of our prices.”
2021-06-17 · Invest Like the Best · Christina Cacioppo - Building the New Standard in Security – [Founder’s Field Guide, EP. 38] · IDENTIFIED FROM THE TRANSCRIPT · source
“Then basically centered on this price of, these were all baby startups to like kind of $10,000 was like roughly what people told me. Definitely it dropped the phone moment in there. You're like, wait, this is like the jankiest website. What do you mean? It is worth five figures. But that was the basis of our pricing for kind of up until today.”
2021-06-17 · Invest Like the Best · Christina Cacioppo - Building the New Standard in Security – [Founder’s Field Guide, EP. 38] · IDENTIFIED FROM THE TRANSCRIPT · source
“Let them kind of poke to them a little bit for a week or two and then called everyone back up one by one and got them on the phone and like ran through this semi-structured survey, which was basically like, so what did I give you? What is Vanta? You tell me, was it useful? Why? What is it? And then monetizing innovation book, which I actually really like, what is an expensive, a reasonable price, an expensive price, and a prohibitively expensive price to pay for this thing that I gave you. Ask 10 people this and sat back and it was actually pretty impressive where one, people actually explain Vanta to me the way I kind of thought they would. And this was actually something of a light bulb moment. I distinctly remember that feeling to the earlier conversation, spent years building things no one wanted, literally years. And so to like give something to someone and them have be like, oh, it's all the words you want me to say back. Wait, had that happened, you know?”
2021-06-17 · Invest Like the Best · Christina Cacioppo - Building the New Standard in Security – [Founder’s Field Guide, EP. 38] · IDENTIFIED FROM THE TRANSCRIPT · source
“Advantage still prices this way. So good and bad. Okay, so late 2017. So we had the Wizard of Oz website basically. So generously, lots of scurrying in the background. So sent this to about 10 friends who are in companies and had them use it, give them a little bit of like, okay, here's how we'll get your information. Here's your Vanta dashboard, right? Here's what you can do with it internally, externally when you're selling, whatever.”
2021-06-17 · Invest Like the Best · Christina Cacioppo - Building the New Standard in Security – [Founder’s Field Guide, EP. 38] · IDENTIFIED FROM THE TRANSCRIPT · source
“Oh, we definitely get the skepticism. Yeah, yeah. And it's actually deeper from folks who've gone through one of these audits because they're like, no, no, no, no. I did the 18-month version. Like, what are you talking about? Very long data, but actually think it just speaks to like broader the trends we write or just like dashboards are really powerful information is really powerful just having a streaming up to date sense of where you are and then putting that in front of motivated employees stuck it's done way faster So actually, I think it's much more that in a lot of ways.”
2021-06-17 · Invest Like the Best · Christina Cacioppo - Building the New Standard in Security – [Founder’s Field Guide, EP. 38] · IDENTIFIED FROM THE TRANSCRIPT · source
“We've had two person companies proverbial, two founders on a couch, knock it out and basically a week. Bigger companies often write because there are multiple owners. Someone owns this piece versus that piece. There's, again, the coordination. Probably a median customer if they're motivated two months or so. Like it's quite fast.”
2021-06-17 · Invest Like the Best · Christina Cacioppo - Building the New Standard in Security – [Founder’s Field Guide, EP. 38] · IDENTIFIED FROM THE TRANSCRIPT · source
“Oh, the auditor is saying I'm screenshot from this system, screenshot from this system manually diffing them in their heads, all of that time can go away too.”
2021-06-17 · Invest Like the Best · Christina Cacioppo - Building the New Standard in Security – [Founder’s Field Guide, EP. 38] · IDENTIFIED FROM THE TRANSCRIPT · source
“So much faster. And again, it's sort of a few fold. One is just reducing the complexity of what do you need to do again, making that standardized and much easier to understand. It sort of gets at the Joel sposally commoditized the complement stuff, but just like if you can make stuff simpler, you are just dropping time costs, the actual cost. So there's that piece of it. There is the monitoring piece. So a big part of compliance projects in a pre-Vanta world are just people running around and saying, is stuff in good shape today? Or the auditors coming in next week? I need to do an audit myself before the auditor comes in. So I make sure everything's okay. And so there's just so much work about work with it. Because when you think about one of these projects, there's talked a lot about the engineering pieces, but there's HR pieces. There's legal pieces. There's IT stuff. It's actually pretty broad. So there's a huge cat herding component. So you don't go in. So the auditor doesn't come in and find unfortunate things. And then there's what used to be screenshots, right?”
2021-06-17 · Invest Like the Best · Christina Cacioppo - Building the New Standard in Security – [Founder’s Field Guide, EP. 38] · IDENTIFIED FROM THE TRANSCRIPT · source
“Yep, it's kind of twofold. And again, we didn't like now we can converticulate this a few years in. Step one was just standardizing the list of stuff, add and remove stuff on the edges, but 80-20. And then step two is like, yeah, how is everything looking? And so to a customer, you're getting engineering customer in particular, you're getting like monitoring and alerting. How are things, what's off, how should I fix it, et cetera, to an auditor, you're getting evidence. You're getting proof that such and such was in place over whatever time period you want.”
2021-06-17 · Invest Like the Best · Christina Cacioppo - Building the New Standard in Security – [Founder’s Field Guide, EP. 38] · IDENTIFIED FROM THE TRANSCRIPT · source
“Our tests all the time, hundreds of times a day, which is not something a person has to go into the office and check or even pull up a dashboard and check, kind of get tired, they're going to go on vacation. They're not going to do this every day, but our code just doesn't get tired. And so kind of your streaming point where you're just like constantly getting information about configuration, constantly checking it and surfacing what's kind of set up correctly and what's set up incorrectly all the time.”
2021-06-17 · Invest Like the Best · Christina Cacioppo - Building the New Standard in Security – [Founder’s Field Guide, EP. 38] · IDENTIFIED FROM THE TRANSCRIPT · source
“Static piece, and like, again, the way joking, but not when you have someone in there looking at some. Sort of continuous. But continuous means, hey, I'm going to just come in a few times. I'm going to come in today. I'm going to come in next Tuesday. I'm going to come in next month. And if you like survive my spot checks, I'm going to say you're continuous, which again, when you look at this from a software perspective, you're like, that's still point in time. It's just three points in time. The core of Anto, we call tests, and this is actually becomes something of an industry standard. Tests are not a SOC 2 concept. They're Avanta concept. And the idea of a test is, okay, you have this statement, everybody is true factor in their email. And then Vanta wrote a test that says, okay, here's my employees, here's all the two-factor information. Does everybody have two-factor? Yes, no. And that is just the core of our software and what we do. And again, it was kind of applying the software engineering mindset to the compliance thing world where you're like, you are testing whether these statements are true. And again, because it's software, we just run.”
2021-06-17 · Invest Like the Best · Christina Cacioppo - Building the New Standard in Security – [Founder’s Field Guide, EP. 38] · IDENTIFIED FROM THE TRANSCRIPT · source
“Year or so was actually taking the here's this configuration information from AWS, how do you actually filter it all the way through into like a report and a test and to all of that? But yeah, the first version is just totally manual.”
2021-06-17 · Invest Like the Best · Christina Cacioppo - Building the New Standard in Security – [Founder’s Field Guide, EP. 38] · IDENTIFIED FROM THE TRANSCRIPT · source
“Okay, so first of Van Abby two field form to put in your AWS credentials. We will scan your word for it. You will like look at the configuration in your AWS account and then generate a report. It was sort of like generating our spreadsheet, basically. And so we're like, oh yeah, just put in the credentials and the software's a little slow. So we'll send you the report tomorrow. Meanwhile, behind the scenes, it's not much software. So we would get the credentials. We would go look at the AWS configuration flat out all the information. And then I would go through and like read the big data blob and like write the reports. That was the V1 of software. And then send it to people and be like, oh, sorry, yeah, yeah. You know, we're just a little slope. But here's your thing. And they mostly believe it slash didn't, I think, think too hard. It's just like two people on a couch what's going on over there. But then the next.”
2021-06-17 · Invest Like the Best · Christina Cacioppo - Building the New Standard in Security – [Founder’s Field Guide, EP. 38] · IDENTIFIED FROM THE TRANSCRIPT · source
“Spreadsheets are really easy to change, and code, I mean, it's changeable, but it takes much longer to change. So that's like, you just have infinity flexibility relatively with spreadsheets. We didn't know what we should check for. And so you just like add rows, delete rows, move them around, whatever. Whereas when you're doing that in code, you're like talking about data models. When you're talking about migrations and moving things around, again, it's all, you can change anything in software. It's not that it just takes so much longer. And so in the early stages, when you sort of don't know what you're doing, and that's fine, I think you just want to index on infinity flexibility. I think there's also a user expectations piece if you can color code a spreadsheet and try to make it look pretty, but people's expectations are pretty low spreadsheet. Whereas if you start showing them things in a web browser, you start getting, oh, that's an ugly font. Oh, the spacing is off. And like, yeah, the spacing is off and it's ugly. But you're like, no, no, no, don't pay attention. What do you actually think of the content?”
2021-06-17 · Invest Like the Best · Christina Cacioppo - Building the New Standard in Security – [Founder’s Field Guide, EP. 38] · IDENTIFIED FROM THE TRANSCRIPT · source
“You are on the right track. What is a check in SaaS apps, but compliance software? So actually, at that point, we're like, oh, we're not going to go give this person a spreadsheet where we are going to go start writing code to try to turn our spreadsheet into software.”
2021-06-17 · Invest Like the Best · Christina Cacioppo - Building the New Standard in Security – [Founder’s Field Guide, EP. 38] · IDENTIFIED FROM THE TRANSCRIPT · source
“A drink seems like you've become stock two consultants. Super weird life choice. Anyway, so worried about you. Also, can you do this for my startup? But like, seriously, maybe I should have an intervention after you do the work for me, which actually seemed like, oh, this is great for several reasons, like people think we're nuts, but you actually want the thing, like game on. Everything is proceeding according to plan. This is actually also a USV thing. Like when people think you're not, you're actually on the right track.”
2021-06-17 · Invest Like the Best · Christina Cacioppo - Building the New Standard in Security – [Founder’s Field Guide, EP. 38] · IDENTIFIED FROM THE TRANSCRIPT · source
“Level. Here's what we think you need to do, and here's how far away you are from doing it. We did this for a friend's company and really just trying to test one, could we make a spreadsheet? Two, do they believe our spreadsheet? So we did this for one company. It's actually segment, walked in, didn't charge them for it because we didn't really know what they're doing. And I think they let us do it because they knew us and were like, well, you're smart people who will work hard. We're not quite sure why you're working on the SOC2 thing, but sure, it might be useful. Anyway, so we made crazy color coded spreadsheet, whatever, gave it to them. They actually seem moderately pleased with it. Then we went to another friend's company, went to Front. And the trick there was like, okay, we're going to try to use our old spreadsheet, but just to get the segment pieces and put in the front pieces and see if they actually match, right? Like, can we standardize? So we did that. It was much faster. It took three days, 15 basically. French seemed to like it reasonably much. And then at that point, actually, we got an email from someone at Dropbox basically saying we should probably.”
2021-06-17 · Invest Like the Best · Christina Cacioppo - Building the New Standard in Security – [Founder’s Field Guide, EP. 38] · IDENTIFIED FROM THE TRANSCRIPT · source
“Big problems, I sort of mentioned this the old prevanta, the way you got one of these things was step one talk to or consult, look deep inside your soul, like figure out the hundred things you should do. And one that's just a lot of overhead and a lot of learning, especially for harried CTO who's trying to do 14 other things. And second, if you're thinking about building software against it, building software against a moving list that's different for every company is not super easy. Truly actually the first thing we tried to do with standardize the list. And it was like, honestly, some amount of naivete when we talk to people who are in the industry. They're like, can't do that. And then we're pushed on it. Someone in a naivete and somewhat out of just being product people and software engineers. And we're like, the way, again, Dropbox protects customer data be all that different than the way segment protects customer data. No, there's just best practices here and everyone should just be reasonable. So our very first version was a spreadsheet of, here's a SOC 2 standard really.”
2021-06-17 · Invest Like the Best · Christina Cacioppo - Building the New Standard in Security – [Founder’s Field Guide, EP. 38] · IDENTIFIED FROM THE TRANSCRIPT · source
“And so, how do you reconcile that? Everyone says security on the internet is really important, there's more and more effort around it. Have thousands of front doors that you can leave open, and so closing all of them is actually the hard part, even though any one looks sort of trivial. And the second part was just prioritization. A business, especially one that is growing or wants to grow, will prioritize things that let it grow. And stopping and being like, one moment, can I check door number 4000 is just hard to prioritize and kind of doesn't get done until, to your point, you're trying to sell to someone bigger. You're trying to like move up market, expand your market, grow more, and someone says, hey, you need this SOC2 thing in order to do that, then you're going to go back and do everything really quickly. The joke about Vanta, that's not really a joke, is it's a security company masquerading as a compliance company. But it was just because we saw compliance with such a powerful behavior motivator for businesses that wanted to grow.”
2021-06-17 · Invest Like the Best · Christina Cacioppo - Building the New Standard in Security – [Founder’s Field Guide, EP. 38] · IDENTIFIED FROM THE TRANSCRIPT · source
“Yeah, actually backing up one moment, there's a second key moment around why Vanter, why start this company, which was to left Dropbox late 2016, early 2017, and to take you back there. This was like 2016 election. Everybody had emails everywhere. Equifax had just happened. Uber had just left a bunch of data open on the internet, DNS3 bucket. And we were sort of looking around and going like, hey, everyone says, like, if you want to think about macro trends to go bet on, more security sounds like a great one or internet security seems like a great one, but then you look around and see like we're not very good at internet security. And there's definitely difficult things, but these breaches seem to happen for, well, you left the front door open. You left the storage bucket open. And like, yeah, somebody came and found it. What do you kind of expect?”
2021-06-17 · Invest Like the Best · Christina Cacioppo - Building the New Standard in Security – [Founder’s Field Guide, EP. 38] · IDENTIFIED FROM THE TRANSCRIPT · source
“Yeah, so again, so this isn't a legal standard at all, like no laws. It's actually a really interesting example of how this became a de facto standard in the industry. So who demands it tend to be, I mean, it used to be really big companies, but it was basically people who bought software. And some part of buying software and procurement is doing risk assessment or security analysis. And so you're a company buying software. You're probably buying a lot of software. And so you have a team internally that's basically like, is this a good vendor? If we give them a bunch of data, will they leak it on the internet? Or like, can we trust them? SOC2 has become the shorthand answer to that. Are they trustworthy? And I think it's like, well, do they have a sock too? And I think it's a little bit of what SOC2 tests for, but also honestly, a lot of organizational maturity. They had the organizational maturity to deal with the consultant and deal with the auditor and convince everybody they're reasonable. And so they're probably less likely to be doofists.”
2021-06-17 · Invest Like the Best · Christina Cacioppo - Building the New Standard in Security – [Founder’s Field Guide, EP. 38] · IDENTIFIED FROM THE TRANSCRIPT · source