Christina Cacioppo, founder of Vanta (valued at $2.45B), joins Shaan to discuss her path from USV VC to founder — including 22 failed attempts, two years of self-teaching code, a job at Dropbox, and eventually building Vanta around the insight that nobody was doing security for startups. The through-line: not counting yourself out even when the evidence tells you to.
Speakers: Christina Cacioppo (founder, Vanta), Shaan Puri (host)
The Forbes List and Midwest Modesty [00:00:00]
Shaan: Do you know what you, Katy Perry, and Serena Williams have in common?
Christina: I’ve got nothing.
Shaan: You’re all on the Forbes self-made women list. And you are ahead of them. Isn’t that kind of amazing?
Christina: I would have preferred that list never existed.
Shaan: You have the Midwest modesty.
Christina: Nothing good will come from that list.
Shaan: Those lists are made for the wrong type of people. Jail time later or something.
Christina: I’m deeply glad I was never on the 30 Under 30. That turned out to be an anti-signal.
Not Counting Yourself Out [00:03:00]
Shaan: When I was thinking about this episode, the through-line for your story is not counting yourself out. You had a good job and you quit to try something new — something a lot of people want to do but don’t take the leap. You took the leap. And it’s not like it hit right away. You created Vanta, this multi-billion dollar company, right off the bat — but first you did like 35 things wrong.
I love that. Because I spent eight years of my life banging my head against the wall with failure after failure, each time believing, “This is the time.”
Let’s start where you had a good job. You hustled your way into USV.
Christina: I would say stumble-hustled. They announced the job like they do all their jobs on the internet — fill out this form, send some links to your web presence. So I literally sent them three links to my web presence and didn’t email anyone who knew them, didn’t pull any strings. Just sent links and put them in a form and was like, “Now I’ll go back to making slides.”
Those links were Twitter, Flickr — that’s the era — and I had started a design blog a couple months before. I lived in Berlin because I wanted to be a designer who lives in Berlin, and those people seem to have design blogs. So I started one. That was it. And they hired me, which is crazy.
The Advice She Didn’t Take [00:08:00]
Shaan: I read that someone at USV — Fred or someone — told you to specialize in crypto. Is that true?
Christina: Kind of. When I was leaving at the end of 2012, a friend said two things. One: you’ve got to get over the imposter syndrome. You can either do it by out-hustling people — the fake it till you make it strategy. He’d worked with me for two years and said that probably wasn’t my path. The other strategy: pick something, go deep, and be the expert where no one else is. In the fall of 2012, he recommended crypto. Really good advice in retrospect.
Shaan: Did you not believe in crypto, or just weren’t drawn to it?
Christina: I didn’t know if I wanted to be a VC at all. I wanted to go make things.
Self-Teaching Code and the Book Website [00:12:00]
Shaan: Take me back to that decision. Was it easy to quit a prestigious VC job?
Christina: I had so much angst. It was a great job, great people. But I didn’t like it. And my plan was: I’d save my bonus, give myself a year off, and figure out what to do.
The reality of the startup world I’d seen at USV was confusing. I’d walk in and feel like everyone was Mark Zuckerberg — young person has vision, builds it, everyone uses it. I probably just wasn’t one of those people.
USV was really helpful in changing that view. They basically said: a very small number of people can do that. Most people try a bunch of stuff, and eventually something might work. It might be thing five, it might be thing 55. Nobody really talks about that because it’s painful and not romantic. But it’s real.
I think the expectation that genius has a vision and executes it is discouraging a lot of people. It’s like watching romantic movies and then thinking that’s how love works.
Shaan: So what did you do during that year off?
Christina: I built a book website. Like Goodreads but better — or actually worse, because I didn’t know what I was doing. When I visited a friend’s apartment I’d always be drawn to their bookshelf. So I thought: what if I could see everyone’s books online? Clearly not a business — best case, $50 a month in Amazon referral fees.
But I wanted it. That forced me to learn real CSS animation, and figure things out because I cared about the output.
Shaan: Did you ever switch gears to “I’m going to do the startup thing that might actually get me out of self-induced poverty”?
Christina: I got on this idea that if we could make programming environments better, more people would learn to code and that would matter. I was really into that personal problem. But this confused everyone around me. They’d be like, “So are you competing with Amazon? Are you competing with Goodreads?” And I’d be like, “Well… with my friends. But no.”
The actual answer was: I’m mostly battling JavaScript errors and spending time on Stack Overflow.
Going Back to Work at Dropbox [00:22:00]
Shaan: You eventually went back to a job at Dropbox.
Christina: I did. After two years of self-teaching, I was like: okay, I can code, but I’ve never had a real job, never worked at a company, never worked with people. Also, my friends are getting promoted. I couldn’t tell if I was even employable.
At Dropbox, I worked with the product security team and they were great — really good educators. They’d come sit next to you and explain why something was important and how to fix it. Not formal seminars, just: let me show you this.
That was what made me think security might be an interesting space. Not because I woke up every morning thinking about it, but because they made it feel like a real competitive cat-and-mouse problem. There’s a dashboard. It’s almost like a game.
The Insight Behind Vanta [00:30:00]
Shaan: So how did you get from Dropbox to Vanta?
Christina: I wanted to start a security company serving startups. Security was this huge market, but nobody was focused on startups. And I kept asking: why don’t startups use security tools?
The inflection comes when startups start dealing with enterprise customers, because those enterprises require compliance certification — SOC 2, ISO 27001, and so on. But getting those certifications was an enormous, expensive, manual process. It could take a team 6-12 months and a bunch of money.
The insight: what if you could automate that? Connect to the tools a startup already uses — AWS, GitHub, Slack — read their configuration automatically, and generate the evidence for compliance without them having to lift a finger. Go from a months-long painful process to weeks and then eventually days.
Shaan: Now that you frame it, it seems obvious. But how did you figure that out?
Christina: I talked to a lot of early-stage security founders who kept saying, “We need to do compliance but it’s a nightmare.” Same problem over and over. That was the signal.
Also: at the time I was like, I’m not sure this is a startup. This seems useful, but the TAM might not be huge. And it was sort of just what I knew — it fit the experience I’d built. If I’m going to burn 18 months and learn something, why not learn about security? Even worst case, it was a useful education.
The Accountability Sunday Form [00:38:00]
Shaan: What were you telling yourself during the two years when the evidence was basically saying, “You might suck”?
Christina: This is silly, but I made a Google Form for myself. I filled it out every Sunday. What are you working on? How do you feel about it? What’s your next goal?
Most of the questions were useless. The only one that ended up mattering was: “What would make you stop working on what you’re working on right now?”
My present self always thinks I should keep going. But my past self sometimes knows current self should stop. I was actually looking at those answers over time and using them to tell the story about whether to continue.
On Fundraising and Negotiating [00:44:00]
Shaan: Eric told me he thinks you’re great at negotiating. He was not wishy-washy about it. He said, “She’s incredible — one of the best I’ve been around.”
Christina: That’s surprising to me.
Shaan: He said ask you how you do it.
Christina: I think if I’m confident in something, I’m actually confident. And then I won’t swerve. If we’re playing chicken, I won’t blink. If I believe the terms, I’ll just stand there and wait. I’m genuinely happy to sit there and wait at that point.
Shaan: That’s the move. Most people break.
Closing [00:50:00]
Shaan: Thank you for doing this. This has been amazing. Where should people find you and find Vanta?
Christina: Vanta.com — vanta.com. If you need help with anything security or compliance related, we’d love to help.
Shaan: Thank you so much.