Summary of Christina Cacioppo - Building an Enduring Software Company in the Age of AI - [Invest Like the Best, EP.496]

Overview of Invest Like the Best — Christina Cacioppo on Building Vanta in the Age of AI

Christina Cacioppo, CEO and co-founder of Vanta, discusses how the company evolved from a SOC 2/compliance tool into a broader security platform and how AI is reshaping both the product and the business. The conversation focuses on what it takes to build an enduring software company now: shipping constantly, using data well, adapting to agents, navigating lower valuations and talent wars, and staying focused on trust in an increasingly AI-driven world.

Vanta’s Evolution

From compliance to trust infrastructure

• Vanta started about eight years ago with a simple thesis: help companies build and earn trust.
• The original focus was compliance automation, especially:
  • SOC 2
  • ISO 27001
  • HIPAA
  • Security questionnaires
  • Trust centers
• Today, Vanta serves around 16,000 customers and has expanded into multiple security-related products.

Why Vanta won

Christina credits Vanta’s success to:

• Relentless execution
• Constant product shipping
• A strong integration layer with data from hundreds of tools
• A large underlying trust graph / security data lake
• Better go-to-market positioning and brand clarity

Her core belief: in software, you are only as good as the last thing you shipped.

AI Is Changing the Product

Vanta now thinks of itself as an AI company

• Vanta is increasingly built around agents that do real work, not just surface alerts.
• The product is shifting from “here’s a problem” to “I went and handled this for you—do you want me to proceed?”
• Example use cases:
  • Offboarding employees and removing access
  • Acting on security gaps
  • Automating repeated compliance/security workflows

Agentic UX vs. traditional software

• Christina argues that many products will move away from static SaaS UI and toward agent-driven workflows.
• Vanta is experimenting with:
  • Chat plus UI hybrids
  • Auto-generated UI
  • Flow-based experiences that keep users moving without friction

What mattered most in adoption

The hardest part has not been building the agent itself, but getting teams to actually use AI tools deeply:

• Use the tools personally and frequently
• Understand where models are good or bad
• Build real evals for task-specific agent performance
• Keep experimenting, because the field changes fast

Pricing, Margins, and the Economics of AI

Token pricing is a trap

Christina is skeptical of pricing directly on tokens:

• Customers can see when software is just marking up model costs
• Token pricing puts apps in direct competition with model providers
• Users are smart and will compare value quickly

Vanta’s current approach

• Vanta is currently eating token costs and accepting lower margins
• The bet is that better usage and retention now matter more than immediate monetization
• The company wants to prove the value of the agentic experience first, then figure out pricing later

Outcome pricing is appealing, but hard

Everyone wants “outcome-based pricing,” but Christina says it’s conceptually cleaner than it is practical:

• It’s hard to define the right unit of work
• Outputs are easy to name, but true outcomes are often messy or multi-step
• Customers don’t want to think about pricing in too much detail every time an agent does work

What AI Is Forcing Companies to Rebuild

Old assumptions are breaking

Christina says many companies from the last software era now face a stark choice:

• Adapt aggressively to AI
• Or get left behind

For Vanta, that has meant rethinking:

• Product design
• Data structure
• Onboarding
• Codebase architecture
• Internal workflows

Modularization matters

A major practical lesson:

• Agents work much better on smaller, modular codebases
• Large legacy codebases create context-window and reliability problems
• Vanta is investing in restructuring its code to make AI tools more effective

Talent Wars, Compensation, and Culture

Talent is getting more expensive

Christina describes a sharp rise in compensation expectations:

• Top talent is now paid much more than five years ago
• She believes comp dispersion should be wider
• The best people are paid for:
  • High agency
  • Deep context
  • Strong judgment
  • Speed of execution

What talent wants now

Many candidates are being offered huge upside elsewhere—sometimes framed as a path to a trillion-dollar company. Vanta responds by:

• Being transparent about the business
• Showing the actual data
• Emphasizing what the company really is, not hype

Cultural principle

A recurring Vanta value: do what you say on the tin.

• Be honest about the business
• Let the facts speak
• Avoid overpromising
• Build trust internally the same way Vanta helps customers build trust externally

Security’s Future

Security is becoming more active and more continuous

Christina believes security over the next five years will be:

• Faster
• More persistent
• More offensive
• More automated

Why AI changes security

• Models can keep probing where humans would give up
• They can chain together seemingly minor issues into serious vulnerabilities
• Security is shifting from periodic review to constant machine-speed testing and remediation

Vanta’s long-term vision

Vanta wants to be at the center of this new trust stack:

• Helping companies prove they are secure and industrial grade
• Serving enterprises, governments, regulators, and auditors
• Expanding from compliance into broader security workflows

Her one-word description of Vanta’s next five years: “Expansive.”

Notable Insights

• “You’re only as good as the last thing you shipped.”
• Token pricing often just exposes how close software is to the model layer.
• AI is making trust and verification more important, not less.
• The best companies will be those that combine strong customer context with strong company context.
• A big part of AI adoption is not technical—it’s organizational willingness to change.

Main Takeaways

• Vanta has evolved from compliance automation into a broader, AI-driven security platform.
• The company is leaning into agents as a core product shift, not a side experiment.
• Christina is skeptical of token-based pricing, post-training as a marketing crutch, and overhyped AI packaging.
• The biggest durable edge remains combining data, customer trust, product shipping speed, and deep domain knowledge.
• In the AI era, security and trust are becoming even more central to enterprise software.