YouSaid · the spoken record

Christina Cacioppo

lines on the record

68

first

2021-06-17

most recent

2021-06-17

sittings or episodes

1

sources

podcast

Every line below is reproduced as it was said and linked to the record it came from. Nothing here is summarised or generated. Directory · Search · Corrections

1. “Yes, there's CPAs that sort of specialize in this, but like fundamentally, they are accountants. That's the bulk of their professional education. So you get the outcomes you might imagine from that. So anyway, so the company goes and scurries around and does all the things they said they would. And then the auditor comes in and they basically say, okay, you say you have two factor on everybody's email account. Prove it to me. You'll be like, oh, okay, let me like pull up my admin dashboard of G-suite or Office 365 or whatever it is. show them the employee list and you'll show them all the check marks next to MFA and the column and they'll say well that looks good but how do I know that's the full employee list you say ah one moment and then you like pull up your payroll system and you get to your list of employees and then the accountant is like okay this person this person this person and then they're like ah but you got the intern Sally you know you're like shoot the intern Sally you know I'm joking but not this is kind of the thing and it takes two weeks of like someone sitting there and like comparing”

   2021-06-17 · Invest Like the Best · Christina Cacioppo - Building the New Standard in Security – [Founder’s Field Guide, EP. 38] · IDENTIFIED FROM THE TRANSCRIPT · source

2. “Step one was historically if you're a company and you wanted a SOC two, you would call up a consultant. The consultant would ask you questions about what sorts of security things you did, like how you secured customer data, how you talked about employees who had access to what systems, if you had cloud infrastructure, an AWS account, how you set that up, they would ask you what you wanted to do and then they would come back and basically give you a list of 100 controls and compliance, speak or just security rules that you should follow. So every employee has two factor on their email. All data is encrypted at rest. Stuff like that. You just have a hundred of these things. And yeah, step one was choose your own adventure. Make your own list. And again, there's some light guidance on what those things should be, but it's very light. But then you have this list of rules. Okay, then the consultant says, hey, go make sure these are all in place. And when you're good, call in your auditor and your auditor is a CPA. Like it is.”

   2021-06-17 · Invest Like the Best · Christina Cacioppo - Building the New Standard in Security – [Founder’s Field Guide, EP. 38] · IDENTIFIED FROM THE TRANSCRIPT · source

3. “In software, and they started doing those audits. They called it SOC2, I think, sort of like a Java and JavaScript thing. They're not actually that related. We're just TAM expanding and like using the recognizable name to go to the second one. It was a really successful TAM expansion, honestly, because the accountants would come in then and they're like, look, we're going to do the financial stuff, the SOC one thing, and then we'll, you know, tack on this SOC two piece, this technical piece. And so it just became a bit of a de facto standard for when you get the one thing that you get, you'll get the second one. And so it's sort of that I think started the snowball rolling of people knowing that this was a standard that they needed to get.”

   2021-06-17 · Invest Like the Best · Christina Cacioppo - Building the New Standard in Security – [Founder’s Field Guide, EP. 38] · IDENTIFIED FROM THE TRANSCRIPT · source

4. “Of course, you know, just to make it more confusing, used to stand for stuff, then we, I guess, decided not. Origins are with accountants. So it's a standard controlled by the American Institute of CPAs. And it started with the computerization of a lot of financial systems. Basically, your accountants will come in and check your books and see if you've kind of done followed accounting rules. That's happened for a long time. That's grand. Then maybe 90s or so, they started coming in as again as there was like digitization and just software for some of this. Are your accounting rules being followed and your financial controls being followed in the software you're using? And that was a SOC one. And it was, again, all accounting rules implemented in software. There's been a few iterations, but kind of mid-2000s, I think honestly, I think it was TAM expansion by the accountants where they were like, look, we're checking for accounting rules and software. Why don't we check for other rules and software? And so then they started checking for security controls, which are basically just commitments.”

   2021-06-17 · Invest Like the Best · Christina Cacioppo - Building the New Standard in Security – [Founder’s Field Guide, EP. 38] · IDENTIFIED FROM THE TRANSCRIPT · source

5. “Game on. Like I call people up all day and ask them for more money. I would love to send them something new. So we had this great thing going over lunch, basically, until legal realized what I was doing and they were like, hello, do you know what a contract is? And I've sort of like, no, a piece of paper, like what's going on? And they were very polite and very good at doing their jobs, to be clear. But basically, you know, came and were like, look, the Dropbox contracts say Dropbox products are secure and compliant and pen tested and this, that, and the other. And you've got a nice prototype over there, like kind of a science experiment that is in fact none of these things. So you either need to meet the bar that we've established, or you can't talk to anyone who pays for Dropbox. Then you're like, oh, okay, well, what's this bar? What are these things? And you go and you learn about what to talk to is or HIPAA and you learn just what a pain is. And like we kind of costed it out really high level and we're like.”

   2021-06-17 · Invest Like the Best · Christina Cacioppo - Building the New Standard in Security – [Founder’s Field Guide, EP. 38] · IDENTIFIED FROM THE TRANSCRIPT · source

6. “Yeah, so there are two meaningful encounters. So, first one at Dropbox. So I was working on Dropbox paper, sort of Dropbox's version of Google Docs, like a real-time collaborative editor. The product and tech came in through an acquisition, which means it was totally separate than the rest of Dropbox. We as like a six, seven-person team thought this was the best thing in the world because we weren't slowed down by the monoliths that was Dropbox in year 10 of its life. It was all great until we started kind of trying to launch it and it wasn't even like launch with fanfare and PR. We just wanted users. It basically pulled every string of getting someone's partner or roommate or college friend or trying to use the product. But we really weren't having a ton of success with initial users. How you can tell I've never worked at a company before, I went to the account management team and was just like, hey, account managers, can you give this away to your customers? And the account managers were like,”

   2021-06-17 · Invest Like the Best · Christina Cacioppo - Building the New Standard in Security – [Founder’s Field Guide, EP. 38] · IDENTIFIED FROM THE TRANSCRIPT · source

7. “Thing, so I spent another year or so, a little less working on different ways to make software engineering easier to learn, made some stuff that I think is sort of interesting, also realized through that it was what I was working on was definitely not a business. So I ended up also joining Dropbox. It was actually the first time I had worked at a real company. And so learned a lot of just like what is a company and what does a marketing person do and what does cross-functional alignment mean and joking but not, it was really kind of my first real job in a lot of ways.”

   2021-06-17 · Invest Like the Best · Christina Cacioppo - Building the New Standard in Security – [Founder’s Field Guide, EP. 38] · IDENTIFIED FROM THE TRANSCRIPT · source

8. “One of those country bay engineers sort of knew from undergrad, we spent more time together. We both decided we kind of wanted to try to start a startup. We didn't know what we wanted to do the startup around, but we wanted to see if we liked working together. So we figured we would work on a side project. Our side project was a campus straight face, was an owl themed video messaging app 2013. And like, why wouldn't you do that? This was going to be like a month-long project, see if we liked each other, like move on nine months later. I think we both woke up and we're like, why are we making this? We actually do like working together, but what are we doing with our lives? That was an interesting arc, the owl era. This person actually now works at Fanta as our head of engineering. So full circle, but there's a lot of owls initially. There's the owl era. Matt ended up joining Dropbox and I was sort of frustrated with myself and was like left to go start something and then I ended up on this owl detour, but I want to go do the real.”

   2021-06-17 · Invest Like the Best · Christina Cacioppo - Building the New Standard in Security – [Founder’s Field Guide, EP. 38] · IDENTIFIED FROM THE TRANSCRIPT · source

9. “Putting books on shelves. There's probably like six, seven months where I just sat there and did that. And it was great and the hunch engineers, Hunchy Bay engineers, were like so kind and friendly and they would tease me when I wouldn't come in one day. You know, where were you yesterday? And you're like, I don't have a job. But it was just the ruse kept going for pretty long. And that was just extraordinarily helpful.”

   2021-06-17 · Invest Like the Best · Christina Cacioppo - Building the New Standard in Security – [Founder’s Field Guide, EP. 38] · IDENTIFIED FROM THE TRANSCRIPT · source

10. “So I realized with myself, structure is helpful. And so I basically tricked myself into thinking I had a job. Chris Dixon actually was in New York at the time, New York City entrepreneur well-known, and he was sort of really good at taking in young entrepreneurs. And so he had recently sold his company Hunch to eBay, had this huge office in New York, eBay New York, this flagship. And I emailed him and was like, hey, can I have a desk? And he's like, sure, come on over. Actually, eBay happened to be almost literally across the street from USV. So I like tried not to change things. I like woke up, got dressed. I like walked to work, just walked across the street to eBay. I sat in one of the eBay New York desks with the punches, eBay's software engineering team. They did their work. I did mine. Mine was like starting with how to make a blog tutorial that Steve Hussman, have Reddit Fame had online. And I like made this blog. And then it was like, okay, now I actually want to book website. So then I started like changing rather than writing blogs.”

    2021-06-17 · Invest Like the Best · Christina Cacioppo - Building the New Standard in Security – [Founder’s Field Guide, EP. 38] · IDENTIFIED FROM THE TRANSCRIPT · source

11. “All the different models of a founder, similarities and differences are, and just how many different models there are and how dumb the sounds, but like how you don't have to look like or talk like Mark Zuckerberg or be Mark Zuckerberg to be very successful. But I had one last hang up, which was I couldn't code. I know lots of people start technology companies without being able to code, but I couldn't get over that. So after USV, I took my bonus from one year and just lived off it for stretched it over two years, taught myself to code, built a bunch of stuff, none of which you have heard of or anyone has heard of, but learned some amount of how to build products and just experimented with a bunch of different stuff.”

    2021-06-17 · Invest Like the Best · Christina Cacioppo - Building the New Standard in Security – [Founder’s Field Guide, EP. 38] · IDENTIFIED FROM THE TRANSCRIPT · source

12. “So I was somewhat confused about a year in because part of me really liked early stage venture. It was all the parts about being an academic that I thought I'd liked and kind of being a journalist too. You could pay to like run around and learn about new things and call people up and ask them questions and then they like come in and very politely answer all your questions. And it was just like tremendous racket. So they're part of it I really liked. The part I didn't like was I kind of felt like I was young and full of energy and just wanted to go do things and go build on the railroads back to that analogy. Instead, I was learning a lot, but sort of sitting there learning a lot rather than doing. But USP, great for great people, great opportunity, but ultimately decided I just really wanted to be one of the people who came in and pitched rather than someone who is pitched to. I guess another part of it, I had just been really fortunate to basically spend two years straight meeting with different entrepreneurs, 10 of them a week every week for two years. I got to”

    2021-06-17 · Invest Like the Best · Christina Cacioppo - Building the New Standard in Security – [Founder’s Field Guide, EP. 38] · IDENTIFIED FROM THE TRANSCRIPT · source

13. “Think it's more a fiction of me than the firm, certainly. Yeah, you can have a subscription, but like, is there a way to turn this into a marketplace? Is there a per transaction way to think about this? USV really, really. Non standard business models because there's a lot of talk of like that's where a lot of the innovation can come from. And maybe it's technology that opens us up, but that's kind of one of the key parts of innovation. A deep appreciation for that from USV.”

    2021-06-17 · Invest Like the Best · Christina Cacioppo - Building the New Standard in Security – [Founder’s Field Guide, EP. 38] · IDENTIFIED FROM THE TRANSCRIPT · source

14. “Your 2010 to 2012, this was the era of large networks of engaged users, as we called them. I think I joined like right before the Foursquare investment, but that was an arc and there's New York arc. The company I still think of as Tangen, which is Mongo. So that arc of companies and a few things. So one is I really don't like top-down market sizing, which I think I got something from USV because right when you're like trying to top down market size, a check-in app to go find your friends in the East Village, you just can't do it. So you're thinking about that more from first principles, from is this a behavior that people will adopt? Who are these behavior, that sort of thing? So I think there's that piece from them. I also think I haven't figured out how to work this one into Vanta yet, but sort of a curiosity and openness to new business models. So I'm actually going to kind of didn't know the word SAS when I was there.”

    2021-06-17 · Invest Like the Best · Christina Cacioppo - Building the New Standard in Security – [Founder’s Field Guide, EP. 38] · IDENTIFIED FROM THE TRANSCRIPT · source

15. “That and thought it sounded crazy, and who would actually get this job? But I actually deep secret, not on LinkedIn, I actually had a job. Then I was working as a management consultant, did not like my job, couldn't figure out if it was because I didn't like it or, you know, I was just being angsty of new grad, whatever it was. But anyway, with sitting in a large, you know, corporate tower in New York City moving boxes on slides and literally on the last day, just screw it. Like I said, it's not the life I thought I was promised. and sent USV four links and nascent blog, Doppler, still my favorite web service, Twitter might have been it. Like I don't even think I sent them LinkedIn. And they emailed me and asked me to come in and chat with them. And I was like, totally abstract, but ended up in me spending two years at Union Square Adventures.”

    2021-06-17 · Invest Like the Best · Christina Cacioppo - Building the New Standard in Security – [Founder’s Field Guide, EP. 38] · IDENTIFIED FROM THE TRANSCRIPT · source

16. “To one, actually, in undergrad, I spent one summer interning at Google. It was in what was then Cheryl Sandbergland online sales and operations. It was basically doing support for Google News. And it was a really formative summer in lots of ways, mostly because I realized there were really interesting jobs at Google. And Google did really interesting things. And it was not at all the internship I had. And so that actually got me to go back to school and take a few more CS classes because again, I was just like, I felt like I couldn't get the jobs I wanted. But actually seeing them up close was formative there. I think the other part to my first job out of undergrad was at Union Square of Ventures in New York. And that was dumb luck. USV and classic USV fashion put up a blog post that said, hi, we had a great analyst, but he had to move cities. So we need someone else. If you're interested, send us links to your web presence. And I read.”

    2021-06-17 · Invest Like the Best · Christina Cacioppo - Building the New Standard in Security – [Founder’s Field Guide, EP. 38] · IDENTIFIED FROM THE TRANSCRIPT · source

17. “Internet and all of that, and sort of realizing building on the internet is just our generation of railroads. And so if you want kind of the most like interesting, quickly changing, challenging thing you can find, go build on the internet.”

    2021-06-17 · Invest Like the Best · Christina Cacioppo - Building the New Standard in Security – [Founder’s Field Guide, EP. 38] · IDENTIFIED FROM THE TRANSCRIPT · source

18. “So, it wasn't at all a foregone conclusion. Both of my parents were professors, academics, who predominantly researchers loved their research, have big labs. They're social scientists. And so until I was probably 12 years old, I didn't really realize adults did different things with their lives. And then I kind of thought I would be a professor until I was about 21, 22. Well, a few things happened around then. One was during undergrad getting to travel a bit and just seeing the impact of technology, specifically spent one early summer in Rwanda. It's so cliche now, but just seeing mobile phones and how they spread and the impact they had and like the beginnings of mobile banking and realizing, oh, if I can walk through an ATM at Tresitor at Stanford, that's cool. But mobile banking when you're living in the second tier city in Rwanda is just a totally different game changer. So some of those that and some of it was also just seeing the buildup on the”

    2021-06-17 · Invest Like the Best · Christina Cacioppo - Building the New Standard in Security – [Founder’s Field Guide, EP. 38] · IDENTIFIED FROM THE TRANSCRIPT · source