Compliance at scale and why TAM is a distraction, with Christina Cacioppo of Vanta

Christina Cacioppo, founder and CEO of Vanta, explains how her company automates compliance and security programs for software vendors, turning high-level standards into monitored controls. Drawing from her Dropbox experience, where launching a new product stalled due to missing compliance proofs, she built Vanta to make startups "audit-ready" continuously, serving 15,000 customers with 60%+ annual growth.

Origin and Product Mechanics

Vanta started in 2018 after Cacioppo observed startups ignoring security until a customer demanded SOC 2 compliance—a "buying moment" that forced implementation of best practices. Founders faced questionnaires or audits without prior work, while enterprises tracked controls in spreadsheets or Jira. Vanta provides a tailored list of applicable controls (derived from 30,000+ past audits, customer contracts, and questionnaires), implements them as automated "tests" modeled on unit tests—pulling data from GitHub, GitLab, etc., to enforce rules like separate doer/approver in code reviews. This ensures ongoing monitoring, dashboards, deviations, and auto-remediation, with outputs like logs for auditors. Early-stage users get prescriptive guidance; larger ones focus on observability, like Datadog for compliance.