How AI Is Repricing Every Software Company

1. 0:00 – 4:17

   Intro

   1. SPSpeaker0:00

      We have talked to our customers a lot about token-based pricing, and I think what we've generally heard, people are real smart, but actually, and so if you try to charge them based on tokens, they are very quick to say, "Oh, you've just marked up a Claude token 4X." Are you 4X as good as Claude? I don't know. Let me go try it out. You actually put yourselves in a competitive position against the models. And so what we've seen on token pricing is, like, if you're trying to mark up at all, users are very smart, and you will lose on that comparison.

   2. POPatrick O'Shaughnessy0:35

      [upbeat music] So Christina, I've been so excited to do this with you. I think it's been five years since we last did it, so a lot, a lot has happened.

   3. SPSpeaker0:55

      A lifetime ago.

   4. POPatrick O'Shaughnessy0:55

      A lifetime ago. Uh, you've been very successful in the intervening five years, so, so I'm excited to catch up. Can you give us, like, the one-minute history of Vanta? I know we've done this before-

   5. SPSpeaker1:03

      Yeah

   6. POPatrick O'Shaughnessy1:03

      ... but just for, to level set for people, when you started it, why, what it did then, how it's evolved-

   7. SPSpeaker1:08

      Yeah

   8. POPatrick O'Shaughnessy1:08

      ... what it does now, just, like, a, a quick, quick overview.

   9. SPSpeaker1:10

      Started Vanta about eight years ago, which feels about-

   10. POPatrick O'Shaughnessy1:12

       Whoa

   11. SPSpeaker1:12

       ... 8,000... Yeah, exactly, or, like, in 17 centuries ago, [laughs] with the premise of can we help companies build and earn trust? And build trust is, like, start security programs and compliance programs or mature them, and then go, go get credit for their customers through audits like a SOC 2 or ISO 27001, HIPAA, et cetera, security questionnaires, trust centers. But basically this idea of can we build a security company by helping companies implement security 'cause it's what their customer is asking for?

   12. POPatrick O'Shaughnessy1:45

       Mm.

   13. SPSpeaker1:45

       And so we were initially known for SOC 2. We had a billboard. We do have a billboard on the 101 that we're mostly known for making billboards, I joke. But it started, like, very compliance, very audit centric. The idea was always, hey, that's just, like, one way to get a company started on this. And so since then we've gone into different areas of security. We've gone into different ways of, like, earning trust with your customers. And so today we're about 16,000 customers global with about five products.

   14. POPatrick O'Shaughnessy2:14

       How did you win? Like, th- this, this was a new category when you started.

   15. SPSpeaker2:18

       Yeah.

   16. POPatrick O'Shaughnessy2:18

       And then I remember I had to go through at my old business to get SOC 2 compliant and certified in order to win certain accounts or whatever. And so it became an important thing kind of in the software era. There were many companies, I, I could probably name a handful, that were trying to do what you're trying to do.

   17. SPSpeaker2:32

       Yes.

   18. POPatrick O'Shaughnessy2:33

       You've emerged as sort of the only major winner. What would you attribute it to over the last, since we last talked, like, how did you win?

   19. SPSpeaker2:39

       Execution. I think you have to both... Like software, the blessing and the curse, and this is, you know, more true now even than it was five years ago. You're, like, you're really only as good as the last thing you shipped. And so you can be first, and you can start it, and it doesn't really matter. I mean, it's more true now 'cause it's like someone can vibe code your thing in a weekend. And so you've just got to, like, constantly be shipping new products, new features that make the experience better for customers and, like, running on that differentiation. And so there's some feature level. I think the other thing we really invested in when it got competitive that was very good was integrations, pulling in data from other tools. And so now you can connect Vanta to one of 400 tools. We co- we pull a ton of data out of those tools, and that's what powers the automation, the agent, the AI, all of that. We call it our trust graph. It's really just like a security data lake.

   20. POPatrick O'Shaughnessy3:35

       Mm.

   21. SPSpeaker3:35

       And that is bigger, broader than any other provider, including some of the security providers, 'cause we touch areas they don't. And I think that, in retrospect, that data foundation has let us build new things faster, software and agent. There's that piece. And then I think on the go-to-market side, it was, like, just-

   22. POPatrick O'Shaughnessy3:55

       Good billboards

   23. SPSpeaker3:56

       ... keep pushing. Good billboards, like shockingly good. Compliance that doesn't SOC too much, um, which got really popular on r/Accounting, which none of us knew was a bucket list item in our lives. But, um, when r/Accounting likes your things, you're like, "Okay, something, something worked." And then the lived experience is just, like, you can feel like you are going as fast as you can, and you should in fact lean in further and, like, push harder.

2. 4:17 – 9:40

   Surviving the SaaSpocalypse

   1. POPatrick O'Shaughnessy4:17

      What was the scariest moment?

   2. SPSpeaker4:19

      I mean, you know, the last 12 months, SaaSpocalypse. You're like, "Okay, great, you know, great job building a system of record. You're now screwed."

   3. POPatrick O'Shaughnessy4:26

      You're now worthless.

   4. SPSpeaker4:27

      Yeah, exactly. You're worth- Like, "Good job playing the game. Here's some steak knives." Parts of that are true, and parts of it are not true. But again, in the vein of, like, you're only as good as the last thing you shipped, you're like, great, so, you know, what are you... What is the agent? You have all this data and a system of record. Fine. What, what the heck are you doing with it?

   5. POPatrick O'Shaughnessy4:42

      Say more about what that's felt like. Roughly, Vanta is a business that is growing very fast by historical standards-

   6. SPSpeaker4:48

      Yeah

   7. POPatrick O'Shaughnessy4:48

      ... with very high margins-

   8. SPSpeaker4:49

      Yes. [laughs]

   9. POPatrick O'Shaughnessy4:50

      ... which four years ago was considered, like, the best business model ever.

   10. SPSpeaker4:53

       Yep.

   11. POPatrick O'Shaughnessy4:53

       Um, nothing changed about that. I think you're probably growing faster-

   12. SPSpeaker4:56

       Yes

   13. POPatrick O'Shaughnessy4:56

       ... and the margins are-

   14. SPSpeaker4:57

       It's all true

   15. POPatrick O'Shaughnessy4:57

       ... are, are margins are still really high.

   16. SPSpeaker4:59

       Yep.

   17. POPatrick O'Shaughnessy4:59

       And yet the market has decided that the multiple for a business like yours is a third of what it used to be or a quarter-

   18. SPSpeaker5:04

       Yeah

   19. POPatrick O'Shaughnessy5:04

       ... of what it used to be.

   20. SPSpeaker5:05

       Yeah.

   21. POPatrick O'Shaughnessy5:05

       So what is that... Yeah, what, what has it been like to live through that as one of those entrepreneurs?

   22. SPSpeaker5:09

       I think cognitive dissonance. Like, you've got to hold two things in your head, right? One is the, like, look, I think in the fullness of time, a 80% growth business with 80% margins will, like-

   23. POPatrick O'Shaughnessy5:22

       Be good. [laughs]

   24. SPSpeaker5:23

       ... be, well, not to... Yeah, be good and actually be better than, like, over the same time period, run it out long enough, a, you know, 160% growth business with 30% margins. You're like, one of these will, like, return more cash, right, in the fullness of time. But today, the latter is valued at, you know, 3X, 4X the multiple of the former. It's 10X [laughs] the multiple of the former, right? And so there's a part where you're like, "Hey, guys, everyone's being irrational here." And then there's a... And, like, this is a good business and you have to keep do- you know, keep doing the things that make business sense and doing the things that customers want, which may or may not be, you know, token pricing models that put you more in the latter category than the former profile. Then there's, like, a very clear, like, game on the field piece, where you're like a do- like, well, if you need to be financed, again, you're looking at investors today, many of whom are kind of AI maximalists and are like... Talked to firms that are like, "Yeah, we'll invest in the labs, and we'll basically invest in tractors in Iowa, and, like, nothing in between." You know, robo to-

   25. POPatrick O'Shaughnessy6:22

       [laughs]

   26. SPSpeaker6:22

       Like, robo tractors in Iowa at a lab. [laughs] And, like, everything else. And you're like, "Huh, interesting point of view." And then from a, like, talent perspective, right? Like, people, you know, you hire ambitious people who wanna do things, and if it feels like they're not in the right boat, they're gonna change boats, right? Like, the talent war part is very real, too.

   27. POPatrick O'Shaughnessy6:43

       Mm.

   28. SPSpeaker6:43

       And so you've just kinda gotta live with, like, okay, in the fullness of time, I think this will all kind of sort itself out, and you have to live for the fullness of time. [laughs]

   29. POPatrick O'Shaughnessy6:50

       S- so there's this, there's this kind of funny fear that now, like, bending spoons is, like, the Grim-

   30. SPSpeaker6:54

       Yeah, yeah, yeah
3. 9:40 – 16:17

   The AI Pricing Trap

   1. SPSpeaker9:40

      of that, we end up using a lot of tokens. We have talked to our customers a lot about token-based pricing, and I think what we've generally heard is, like, people are real smart, but actually... And so if you try to charge them based on tokens, they are very quick to say, "Oh, you've just marked up a Claude token 4X."

   2. POPatrick O'Shaughnessy10:00

      Mm.

   3. SPSpeaker10:00

      "Are you 4X as good as Claude? I don't know. Let me go try it out." And so, and then you're like, you actually put yourselves in a competitive position against the models that probably no application really wants to. Like, we're gonna talk about harnesses. But, like, you don't wanna get there. And so what we've seen on token pricing is, like, if you're trying to mark up at all, users are very smart, and you will lose-

   4. POPatrick O'Shaughnessy10:25

      Mm

   5. SPSpeaker10:25

      ... on that comparison. You can, like, not mark up, and this gets to the margin question, right? Um, but anyone who is marking up Claude tokens 4X and trying to, like, pass that off to their users, I think it's just like-

   6. POPatrick O'Shaughnessy10:38

      So what are you doing?

   7. SPSpeaker10:38

      ... that is not a [upbeat music] Ramp is the only platform built to make your finance team leaner, faster, and better, saving businesses 5% annually on average so you can stay focused on growth. Ramp just opened for business in the United Kingdom, so if you're running a business in the UK, you can now use Ramp's AI-powered finance platform to manage cards, expenses, bills, approvals, and accounting all in one place. I run my business on Ramp, and so should you. Learn more at ramp.com/invest. OpenAI, Cursor, Anthropic, Perplexity, and Vercel all have something in common. They all use WorkOS, and here's why. To achieve enterprise adoption at scale, you have to deliver on core capabilities like SSO, SCIM, RBAC, and audit logs. That's where WorkOS comes in.

   8. POPatrick O'Shaughnessy12:12

      Instead of spending months building these mission-critical capabilities yourself, you can just use WorkOS APIs to gain all of them on day zero. That's why so many of the top AI teams you hear about already run on WorkOS. WorkOS is the fastest way to become enterprise-ready and stay focused on what matters most, your product. Visit workos.com to get started. Rogo is the AI platform purpose-built for financial institutions serving tens of thousands of bankers and investors at hundreds of leading firms worldwide. Rogo's AI agents autonomously execute large chunk of your firm's workflows. They can screen deals, draft sims, run buyer outreach, and due diligence on data rooms, all with full security and compliance handled. Every action feeds Rogo Intelligence, the firm's context layer, turning years of deal experience into a secure, governed institutional memory that makes each new transaction stronger than the last. To learn more, visit rogo.com/invest. I'm also so curious that you said marking up a Claude token, but what about marking up like a Kimi token or like something that's much cheaper? Like, how... What, what's it been like deciding what to use, what's good enough versus cost if you're not passing through the-

   9. SPSpeaker13:19

      Yeah. This was something we started concentrating on at the beginning of the year. It was basically like evals-

   10. POPatrick O'Shaughnessy13:24

       Yeah

   11. SPSpeaker13:24

       ... for all of these, and like task-specific or agent-specific evals. From a product perspective, we call it all the Vanta agent, and it's one thing. Of course, behind the scene, it's like hundreds of agents that all have specific tasks and use tools and have computers and, you know, that whole setup that I think everyone's converging on. But in the beginning of the year, really invested in using our, our subject matter experts, so the folks who, like, ran security and compliance programs at other companies, to write the eval frameworks and then eval their evals, and using tooling for that. Anyway, and so when we think about model swapping, it is right... Again, right now it's like mostly quality. It's not cost. I also think some of it too, this is 'cause we don't use as many tokens as coding. I think we're also all starting to, it's like coding is, and coding agents, lots of token use. Maybe legal and, like, document drafting next. And then when you get to more of the decision action world, which is where we are, again, relative to coding, we just don't use that many tokens.

   12. POPatrick O'Shaughnessy14:23

       Hmm.

   13. SPSpeaker14:23

       Anyway, and so that like kind of lets us, like, optimize for quality versus being as concerned about cost as some of the other companies.

   14. POPatrick O'Shaughnessy14:29

       When you talk to other founders, both of your era and of this new era, what, what are they doing here? Are they also eating the cost and just charging a software fee? What do you think the r- the end state's gonna be?

   15. SPSpeaker14:39

       I think everyone wants to get to outcome pricing, and if you actually go talk to a pricing person, they will tell you it's actually output pricing 'cause it's not... But whatever. Like, everyone wants to get to that. And like, in another life, I was a microeconomics professor. Like, I love this conceptually. Like, I love the, like, we will... We get paid for outcomes and the alignment of incentives. Love it. The hard part is just, like, what are the outcomes? And I think, m- you know, support ticket closed makes a lot of sense. Actually, to that, maybe differentiate outcome and output as I understand it. In support, the ticket closed is an output. The outcome is actually, like, my Sonos now works.

   16. POPatrick O'Shaughnessy15:18

       Hmm.

   17. SPSpeaker15:18

       Right? But even, like, the ticket closed, that is relatively unobjectionable. I think a lot of companies, Vanta included, are trying to figure out what's that, like, neat unit of work that we can all agree on? And you can say it's, "Oh, it's a document drafted. It's an alert closed. It's an account off-boarded." And you can kind of do that, but then there's just so much cognitive overhead 'cause you're like, I just named three things. I could name another 47, and then our user has to be like, "Oh, well, if I do this with the agent, I pay this. But if I do it on my..." You know? And you're just like, "No one, no one wants that." I think everyone I talk to wants to get to outcome output pricing, but it's really not clear how you get there. I think token, charging tokens themselves really puts you up against Claude. So then people try to obscure that by charging credits and having some, like, credit token exchange ratey thing, which I think, again, user are smart, and they're like, "I see what you're doing, and I see you've obscured it. Fine."

   18. POPatrick O'Shaughnessy16:14

       Are you similarly far along in,

4. 16:17 – 22:43

   Rebuilding Software for AI

   1. POPatrick O'Shaughnessy16:17

      if you compared yourself to the, just as you did just now, to companies in how you're building product and the business using these tools? Like, how would you grade yourself on-

   2. SPSpeaker16:24

      Yeah

   3. POPatrick O'Shaughnessy16:24

      ... like, what are you doing that's interesting there?

   4. SPSpeaker16:26

      I think, okay, so we, in the vein of, like, eight-year-old company and eight-year-old code base, it is so much easier to throw the coding agents at a small code base than a large one, and that's like a token input thing, and they're getting better and better. But one thing we've spent a lot of time also investing in in the last year, and I know Notion has spent a bunch, bunch of time in, and they were like nine months ahead of us on, is modularizing parts of the code base so that the agent can just understand smaller parts of it and understand it fully and then be really effective. Whereas if you chuck it at, again, eight-year code base, sight unseen, it just, like, doesn't have the context window to understand everything and will do silly things. And so you, then you need a high-context engineer to babysit it, which is helpful, but, like, sort of invalidates some of the point. Um, companies have always had this problem. They've just talked about it as like, "Oh, when we onboard a new engineer, it takes them a while to figure out the code base." It's just agents have made it like, well, great, now we wanna onboard 9,000 new engineers tomorrow. Um, and so it's just, like, heightened that problem. So I, I give ourselves a lower grade on that just 'cause we've had... We are, like, in the process of using agents and people to make the code base easier to understand too.

   5. POPatrick O'Shaughnessy17:38

      If you had to grade yourself one through 10 about, like, wow, this changes everything, building this company from this point forward is gonna be totally different, is it 10?

   6. SPSpeaker17:45

      Oh, yeah. Like, nine. Yeah.

   7. POPatrick O'Shaughnessy17:47

      You are like a nine.

   8. SPSpeaker17:48

      Eight, nine. I mean, I think the, like, principles are still the same. Like, everything is hard. People matter. You know, like, all the tropes are still the tropes. But the way you do stuff, it should be quite different.

   9. POPatrick O'Shaughnessy17:57

      Do you feel like there's a separation happening... Again, if I took your cohort of the successful, you know, eight year ago era companies, like, do you feel there, there's a bifurcation where some have gotten the memo and are, are doing really well-

   10. SPSpeaker18:10

       Yes

   11. POPatrick O'Shaughnessy18:10

       ... and some are just, like, going to-

   12. SPSpeaker18:11

       Yeah

   13. POPatrick O'Shaughnessy18:11

       ... Bendings spoons? [laughs]

   14. SPSpeaker18:12

       Kind of. Yeah, yeah. I think there are just structural parts of some markets, and I think Bendings spoons' very good at, you know, identifying these, where- You can put any entrepreneur in the world on, in that structure. This is kind of like the, like does market or founder win Andreessen Horowitz thing, and you're like, "Market wins." I think that is still true, and I think, you know, this AI technology shift has made what some markets that used to look really good look really bad. And the best person in the world can run into that and will still run into a brick wall. And I think there is a, like, founder motivation piece, where it's like you've got to be in it and, like, push in this era. And if you don't want to do that, totally fine, but, like, the rest of the company will not, you know, self-organize to do so.

   15. POPatrick O'Shaughnessy18:55

       So given that you've been at the edge, w- like, what's the, you know, adopting AI 101 if you're back to being a professor? What have been the most important things that have been hard to do but have proven fruitful?

   16. SPSpeaker19:08

       Just getting people to use it, which I think there's, like, a... And then, okay, so which sounds obvious, but it's like definitely use it yourself. Builds for your company, personally, does not matter. Just, like, understand where the models are, where they're good, where they're bad, what harness means. Like, you just, like... And, like, kind of do that at least every two weeks because it just changes so quickly. And I do think you have to have a, like, visceral understanding of what works and what doesn't, so that when somebody comes and they say, "We're gonna fire all of our SDRs because I built one agent," and you can kind of be like, "Did you now?" You know, or like, "Where, where is that true and where is that false?" Anyway, so there's like a be in the muck. And then I think it's like, yeah, you want to get as many other people in that as possible. Broadly generalized, it's very black and white. But it's like, yeah, and some people just go do that, and some people don't. If you'd asked me a year ago, you'd have been like, oh, well, there's, like, some, you know, intrinsic motivation and, you know, kind of the people who aren't separate problems, go deal with them. I think I'm slightly more empathetic now in that we have seen... I can't give a specific example, but, like, very strong people kind of not go dive in, and you have to n- like nudge them more, but, like, try to figure out what's blocking them. And something can be blocking them, and you can get people into the, like, into the muck, even if they don't dive in initially.

   17. POPatrick O'Shaughnessy20:30

       Mm.

   18. SPSpeaker20:31

       So if you're a small company starting out on Vanta, great. We've got this, like, set of controls for you. You just, you adopt them. You maybe mess with them on the edges, but you're, like, off to the races. If you're a larger company, you clearly run a security and compliance program, and you come to Vanta because you want that visualized. You want the automation, and you want the monitoring. You want the real-time dashboards. You don't want the, like, Jira ticket thing. Fine. Well, the hard part, hard part is you've got to get all that existing stuff, the controls, the risks, the data, the policies, the procedure, all that stuff into Vanta. Classically, the way you would do that, SaaS company, is you're like, "Oh, we're going to make an onboarding wizard. It has four steps and a progress bar. And we will, like, give you confetti." You know, you have like, you're going to do that whole thing. We were setting out to build better, better onboarding this year. And the first couple product reviews, the team kept bringing onboarding wizards. Kept being like, "Stop with the onboarding." Like, no. You know, go use an LLM. Stop. But they kept bringing onboarding wizards, and this was, like, a motivated team, talented people. They cared, and they kept bringing onboarding wizards. And we finally got them. Anyway, the experience now, which they shipped and it's working, is it's basically Claude. It's like big canvas, drag all your messy files in, drag in all your screenshots. We will, like, make sense of it, ask you questions, and then you are set up and off to the races.

   19. POPatrick O'Shaughnessy21:49

       Mm.

   20. SPSpeaker21:49

       And it works really well. So what, like, why were these smart, motivated people bringing onboarding wizards? So you go out, like, finally, and the thing was they were like, "Well, we don't know if we can get the, like, drag your files thing to work. It might not work. And we know the onboarding wizard will work because we've built those before."

   21. POPatrick O'Shaughnessy22:09

       Mm.

   22. SPSpeaker22:09

       "And, like, we basically don't think we're allowed to fail on this project." And you go in and you're like, "Oh, that's the thing? Great. Well, like, we're just gonna, like, bet that the on, the LLM flow is gonna work, and we'll make it work, and we'll hill climb all we need to, but, like, burn the boats and just make this thing work."

   23. POPatrick O'Shaughnessy22:30

       Mm.

   24. SPSpeaker22:31

       And then they were like, "Oh, okay, great. You know, do you want a next product review tomorrow?" But it was this, like, funny thing where you're like, I would not have guessed that that was their blocker.

   25. POPatrick O'Shaughnessy22:39

       Mm.

   26. SPSpeaker22:39

       And you like solved that, and they were, like, going.

   27. POPatrick O'Shaughnessy22:42

       You mentioned the

5. 22:43 – 31:57

   Silicon Valley's Talent Wars

   1. POPatrick O'Shaughnessy22:43

      Talent War thing before. There's this big trend, you know, the low, low margin, high growth thing, where, like, from an investor's perspective, [laughs] the, the funny example you gave of a lab or a tractor, like everyone wants something that can be that thing. And so, like, tell me about how you're going to be a $100 billion business-

   2. SPSpeaker22:58

      Yeah

   3. POPatrick O'Shaughnessy22:58

      ... or a trillion-dollar business.

   4. SPSpeaker23:00

      Yeah.

   5. POPatrick O'Shaughnessy23:00

      Somehow now every business needs to be that big.

   6. SPSpeaker23:02

      Yep.

   7. POPatrick O'Shaughnessy23:03

      Um, what's that like to face down, where-

   8. SPSpeaker23:05

      Oh, it's so bizarre

   9. POPatrick O'Shaughnessy23:05

      ... you may not be building a business that should be a $100 billion business? There's like 100 of those in the world. Like, there's not that many.

   10. SPSpeaker23:10

       Yeah, and it's not to say Vanta won't be. [clears throat] But I do think the... It's funny, it's like a, uh... I think for me it's like, oh, should I adjust the pitch and be like, "Well, inevitably, you know, the baseline here is Vanta's 50 billion. The real question you should be considering, you know, is, like, if you join, can you take us on a journey to, like, 250 billion?" And you're like, should I just start saying that? [laughs] You know? Like, again, like prob- like the answer is, like, probably not, but the answer is not-

   11. POPatrick O'Shaughnessy23:38

       You've thought about it

   12. SPSpeaker23:39

       ... definitely not. Totally, because you're like, well, that is, like, that is the pitch that people who work at Vanta are getting from other companies, you know? And then, and then you're just kind of like, "Okay, well, do you..." And I try not to, like, counter by, you know, being like, "Well, they suck and..." But it's just this, like the market now is saying that so much. And so if you don't, you do seem unambitious.

   13. POPatrick O'Shaughnessy24:03

       So what do you do?

   14. SPSpeaker24:04

       There's, like, a Vanta principle, value, but principle of, like, do what it says on the tin, which is kind of like do what you say you're gonna do. And look, you can put ambitious things on a tin. It's not that. But, like, don't overpromise and under-deliver. And so kind of what we do is, like, give some of that, like, here's what we do as a company. Good, bad, indifferent, but there's, like, here's the context. Now, like, let me talk to you about the business metrics, and we'll generally just show it's candidate to, like, show everybody everything. It's fine. They're good. It's like if... They don't... We don't really want them to leak, but if they leak, it's not the worst. [inhales] And then walk them through that, and what we're doing, and how that grows over a time. And, like, try to root it in all of the facts and all of the data. And so in some ways it's, like, counter the vibes with, like, data and trustworthy vibes [laughs] versus YOLO vibes-

   15. POPatrick O'Shaughnessy24:54

       Hmm

   16. SPSpeaker24:54

       ... I guess.

   17. POPatrick O'Shaughnessy24:55

       And, and so what is it like in those talent wars? Like, if, if the most talented people are being told, you know, this thing's gonna go to a trillion-

   18. SPSpeaker25:02

       Yeah

   19. POPatrick O'Shaughnessy25:02

       ... by basically every other company that's trying to hire them.

   20. SPSpeaker25:05

       Well, the better one is, [laughs] uh... Well, we're 6 billion today, but, like, Sequoia's gonna do a $10 billion check in a month, and then, like, somebody's gonna write it up to 25 next year, but we can get you in at six today.

   21. POPatrick O'Shaughnessy25:16

       Yeah.

   22. SPSpeaker25:16

       That's a good one.

   23. POPatrick O'Shaughnessy25:17

       Yeah.

   24. SPSpeaker25:17

       That one's tough. [laughs]

   25. POPatrick O'Shaughnessy25:19

       So you're faced with that. Like, what do you do? Do you maybe, like, not want those people? Like, maybe it's a filter that...

   26. SPSpeaker25:25

       Sometimes. I, like... No magic playbook here. I think if you go to the person and be like, "What are you optimizing for?" Right? And like, "Why are you..." Kind of like, "Why did you entertain this?" But not in a pokey way, just in a, like, "What's annoying you at Vanta?" Right? Uh, and actually one of these in specific, very strong leader, still at Vanta. But, like, it was basically this person felt like they couldn't make decisions that would put Vanta on a similar trajectory, and that would be their preference. But they're like, "Oh, but this new place is promising me, like, full decision-making authority on this trajectory." And you're like, "Totally fair feedback. What do you need to feel like you can make these decis- like, just go make these decisions. Go." Like, there's a money part and a FOMO part for sure. We've definitely gone up on comp and, you know, comp bands are, like, people at Vanta are gonna hate that I said, but, like, comp bands are kind of a joke now, where like the comp band is whatever data you have is wrong. It is, like, what is being offered to these people in the market.

   27. POPatrick O'Shaughnessy26:25

       How much more do you pay the top person at Vanta than you did, like, as a multiple versus, like-

   28. SPSpeaker26:30

       Oh, I think we should have way more comp distortion than we do.

   29. POPatrick O'Shaughnessy26:32

       So how... But, but even r- so that's interesting, but if I go five years back-

   30. SPSpeaker26:36

       Yeah
6. 31:57 – 38:39

   What's Overhyped in AI

   1. SPSpeaker31:57

      four years ago.

   2. POPatrick O'Shaughnessy31:57

      What about overhyped? Anything that you feel like is getting-

   3. SPSpeaker32:00

      Token-based pricing. [laughs] Low margins for the sake of having low margins. Um, custom training models for the marketing value.

   4. POPatrick O'Shaughnessy32:09

      To be able to say, we post-trained a model on our stuff.

   5. SPSpeaker32:11

      Exactly. Yeah.

   6. POPatrick O'Shaughnessy32:11

      Why-

   7. SPSpeaker32:12

      Exactly

   8. POPatrick O'Shaughnessy32:12

      ... explain why that's overrated.

   9. SPSpeaker32:13

      Uh, I think if you g- go talk to the in- the inference providers, and sometimes give them, de- depending on the provider, give them true CRM. They will say, like, "Look, the reason to post-train a model is cost." And you might... And then some businesses have that need, but there is not a quality reason to do it. There's, like, kind of a marketing reason to do it right now in this environment, and I think there's a lot of post-training for marketing reasons, for investors and for customers. Mostly for investors, actually.

   10. POPatrick O'Shaughnessy32:39

       If one of those people were pitching the, the, the other side of this, of, like, the value of post-training, what, what, what is the pitch to you? Like, some-

   11. SPSpeaker32:46

       Yes

   12. POPatrick O'Shaughnessy32:46

       ... one of these companies comes to you and is like, "We'll do X, Y, Z for you," what are they saying and what do they say the benefits are?

   13. SPSpeaker32:50

       You're putting a stake in the ground of being a real AI company that customer... Investors, but, like, customers will notice. I think that's the primary one. I do think there's a secondary one in some use cases of, like, a form factor thing, and I think especially with large enterprises where it's like you wanna deploy this piece of software wall to wall that r- you know, requires integrations and 17 people to sign off, and, like, oof. That's a whole thing. Like, why don't you just give them a, like, model specific to them for this use case? I think there's, like, form... I think that's a semi-reasonable pitch.

   14. POPatrick O'Shaughnessy33:23

       So, so if I was one of these people and I came into Vanta, what, what do they... What does post-training literally mean? Like, what would it mean in your context? Like, what are you doing? What are the steps that you would go through with them?

   15. SPSpeaker33:32

       Yeah. So we would need a bunch of data from that specific customer, and then go write a bunch of evals and change model weights for, based on that customer's specific data.

   16. POPatrick O'Shaughnessy33:43

       The process would be they're trying to achieve something. They've got some data. You tune a model to achieve the thing to im- im-

   17. SPSpeaker33:50

       Exact- Yeah

   18. POPatrick O'Shaughnessy33:50

       ... increase the eval.

   19. SPSpeaker33:51

       Yeah.

   20. POPatrick O'Shaughnessy33:51

       Basically.

   21. SPSpeaker33:52

       Exactly.

   22. POPatrick O'Shaughnessy33:52

       And then-

   23. SPSpeaker33:53

       Yep

   24. POPatrick O'Shaughnessy33:53

       ... sell them that.

   25. SPSpeaker33:53

       Exactly. Yes.

   26. POPatrick O'Shaughnessy33:54

       On an ongoing basis.

   27. SPSpeaker33:55

       Yep.

   28. POPatrick O'Shaughnessy33:56

       And, and your point is that that's overrated because it doesn't actually improve their-

   29. SPSpeaker34:00

       It can. I think I'm a skeptical on a couple of... Like, do, does everyone really wanna be handed a model? Or there's so much around that from user experience perspective, from a deployment perspective, form factor. Like, it feels a little, like... You know in the social media with, like, our mobile apps when we're like, we hadn't figured out pull to refresh yet.

   30. POPatrick O'Shaughnessy34:18

       Mm.
7. 38:39 – 47:16

   Security at Machine Speed

   1. POPatrick O'Shaughnessy38:39

      So what's the direction of security? Like, this, this is of course an incredibly interesting topic. Like early internet, everything broke.

   2. SPSpeaker38:45

      Yeah.

   3. POPatrick O'Shaughnessy38:45

      Everything got hacked. This'll probably be that times 10 or-

   4. SPSpeaker38:48

      Mm-hmm

   5. POPatrick O'Shaughnessy38:48

      ... times 100. Um, does security mean you compete with CrowdStrike and places like that? Like, what does security mean and what's its trajectory in this crazy era?

   6. SPSpeaker38:57

      These models just are, like, so much more persistent than people actually, and so they will just, like, try nine quadrillion things the way a person would sort of give up after, I don't know, 9,000, right? And then in the course of that, they find things and chain things together. And so I think there is a little bit... Like, a lot of the discourse is around zero days, and there's definitely some of that these models are finding that we didn't find before or didn't publicly find before. I think actually though, what's more so happening is these models are able to chain, like, 17 benign-ish or benign on their own things together and then, like, really find something. And, like, if you watch the, the OpenAI talk at RSA about Hugging Face, it's basically that. It's just, like, persistence and putting together things that on their own people would've been like, "That's low severity. I'll fix it in 90 days," right? Anyway, that... Anyway, but that update, which I think is tough and we have to fight with machines 'cause it takes what was like, "Oh, that's important, but low severity and again, 90 days, and, like, I'm gonna fix this other stuff first." Like, it just turns the prioritization on its head. And saying it makes everything critical isn't helpful 'cause you're like, "Well, what do you do then," right? But I think what that ends up looking like is you've just gotta fix stuff as fast as you find it, and some of the prioritization does need to go out the window.

   7. POPatrick O'Shaughnessy40:24

      Mm.

   8. SPSpeaker40:25

      But if you're fixing... You know, again, if you're fixing things at machine speed, you sort of don't have to prioritize. So that's where I think we're gonna get to, but I think it'll, it'll be rocky as we get there.

   9. POPatrick O'Shaughnessy40:35

      So as I visualize that-

   10. SPSpeaker40:36

       Yeah

   11. POPatrick O'Shaughnessy40:36

       ... what that feels like to me is a constant penetration test-

   12. SPSpeaker40:40

       Yes. Yeah

   13. POPatrick O'Shaughnessy40:41

       ... where an agent is trying to break in like a white hack, white hat-

   14. SPSpeaker40:44

       Constant

   15. POPatrick O'Shaughnessy40:44

       ... hacker agent all the time.

   16. SPSpeaker40:46

       Yep, yep.

   17. POPatrick O'Shaughnessy40:46

       And then every time it finds something, it's got a buddy agent that's a patcher.

   18. SPSpeaker40:48

       Goes fix it. Yeah. Yep.

   19. POPatrick O'Shaughnessy40:50

       Um, is that, like, the ultimate product vision then?

   20. SPSpeaker40:54

       For some parts of Vanta, yes. Yes. I think we can do that in very compelling ways. For the bulk of our customers, I think CrowdStrike will do it better for an enterprise, right? I think this is where choosing where you play and, like, what market segment is most important there.

   21. POPatrick O'Shaughnessy41:09

       Is there a firm that's doing something now that you start to encroach on? Like, of the traditional security firms?

   22. SPSpeaker41:13

       I think it's a different, different market segment. I mean, take a, like... Okay, your, um, ongoing, like, penetration tester and, you know, remediator fixer, right? We think we can do that for the cloud providers, like an AWS, any Azure, like misconfigurations there.

   23. POPatrick O'Shaughnessy41:29

       Mm.

   24. SPSpeaker41:29

       Classically, like, right, Wiz does that. Wiz will do it for its customers. Wiz's customer base starts at a multi-thousand person company, and their price point count starts at a multi-thousand person company. And so we're more thinking about the platform as where are we already embedded with customers? Where are they unlikely to go pay $150,000 for Wiz, but very well could pay 40 or 50 for something suited to them? And so kind of thinking through where are we already strong and where are the, the competitors focused, probably more elsewhere, but probably on a more upmarket segment.

   25. POPatrick O'Shaughnessy42:02

       How has your personal motivation changed? Like, you set out to build this thing. I remember talking to you the first time about this, uh, very charming way you built the original product, like building it in Excel first, and it seems very old school, you know, looking back-

   26. SPSpeaker42:14

       [laughs] I know. It's... [laughs]

   27. POPatrick O'Shaughnessy42:14

       ... looking back on it.

   28. SPSpeaker42:16

       Yeah.

   29. POPatrick O'Shaughnessy42:16

       And it, it's always, like, the dog that caught the car thing, where like-

   30. SPSpeaker42:18

       Yep
8. 47:16 – 55:37

   Reinventing Software

   1. SPSpeaker47:17

      that just comes off.

   2. POPatrick O'Shaughnessy47:18

      What are the big trade-offs that you struggle with right now? Like, you can't do everything.

   3. SPSpeaker47:23

      Yeah.

   4. POPatrick O'Shaughnessy47:23

      You've gotta make decisions. The stakes are higher than ever. It's easier to build than ever. It seems like a cool time to be doing what you're doing.

   5. SPSpeaker47:30

      Yeah.

   6. POPatrick O'Shaughnessy47:30

      But there must be big trade-offs that you struggle with. What, what are those for Vanta?

   7. SPSpeaker47:33

      Yeah. I mean, one conversation we ha- have had and have is we have tried over the last year to build in such an agent-forward way. Can talk through some of, like, what that's looked like.

   8. POPatrick O'Shaughnessy47:45

      What does agent mean?

   9. SPSpeaker47:46

      [laughs]

   10. POPatrick O'Shaughnessy47:48

       Like, why is that not just AI? Like, w- why... what does that word mean?

   11. SPSpeaker47:52

       Uh, it's cooler. I don't know. You get 2X revenue multiple if you say agent.

   12. POPatrick O'Shaughnessy47:54

       [laughs]

   13. SPSpeaker47:55

       It's like 3X if you say harness. [laughs] You have to... You can say harness more.

   14. POPatrick O'Shaughnessy47:58

       [laughs]

   15. SPSpeaker47:59

       Prompt file, like, minus 3X, you know? [laughs]

   16. POPatrick O'Shaughnessy48:04

       [laughs] So is it lit- the, the agent just means AI, right?

   17. SPSpeaker48:06

       This is what happens when you live in San Francisco. Sorry. [laughs]

   18. POPatrick O'Shaughnessy48:09

       [laughs] I, I'm s- Everyone's saying agent so much, I don't even know what that means. It just means AI, right?

   19. SPSpeaker48:14

       Yes.

   20. POPatrick O'Shaughnessy48:14

       Okay.

   21. SPSpeaker48:14

       Yes.

   22. POPatrick O'Shaughnessy48:15

       So keep going. Sorry.

   23. SPSpeaker48:16

       Yes. We've tried to build such a great harness. [laughs]

   24. POPatrick O'Shaughnessy48:18

       [laughs]

   25. SPSpeaker48:18

       Can't do it two ways. We've tried to build [laughs] such a great harness for our customers, but actually, and not build a bunch of SaaS UI. You know, and it's like, oh, you want reporting? We will have our agent go make charts for you on demand based on all of our data. We're not gonna, like, put Tableau inside of Vanta, which is probably what we would've done in 2022, 2021 if we had been building it then. And we believe in this in, like, a short-term customer outcome sense, but also in a, like, medium to long term, like, this is what software will look like, and no one is gonna be putting Tableau inside their products. More joking than serious, although some people actually put Tableau inside their products.

   26. POPatrick O'Shaughnessy48:57

       So there's an aspect of, like, the, the, this diffusion thing is just scary because maybe the tractor takes 10 years. Tractor company-

   27. SPSpeaker49:04

       Yeah

   28. POPatrick O'Shaughnessy49:04

       ... takes 10 years.

   29. SPSpeaker49:05

       Right.

   30. POPatrick O'Shaughnessy49:05

       And in the meantime, you were right but early and-
9. 55:37 – 1:00:38

   The Billboard War

   1. POPatrick O'Shaughnessy55:37

      amazing Silicon Valley microcosm, can you tell like the most detailed version of the billboard war story that you've ever told?

   2. SPSpeaker55:44

      I was always very much a billboard skeptic 'cause it seemed like they didn't actually... Or like who knows if they work? The tracking is terrible, but like founder, it's like founder ego is why someone would do a billboard. It's like, "'Cause I feel cool 'cause my company has a billboard." So I was always very anti-billboard. Mid-summer 2021, SaaStr [laughs] Conference, which felt like a big deal at the time, like thank God we've almost beyond that. We decided, or our marketing team decided to try out of home. I was like super skeptical, but it was like, "Fine. Whatever. I... Try it," you know? And we were gonna put something on the billboard. And Sarah, who was our PMM at the time, came up with compliance that doesn't suck too much, and pitched it to our head of marketing, who didn't like it 'cause he thought we were like negging our users, and was basically like, "No, don't. Think harder." And much nicer, but like think harder. And Sarah kind of believed in it, and so she went to me, which she usually does not like go... She is not a like go around her boss person, but like really believed in compliance that doesn't suck too much, and so took it to me. And I read it, it doesn't suck, and I like immediately laughed. Actually, immediately texted Andrew Reid, our investor, as like, "What do you think? You have good, um, internet meme taste." [laughs] He loved it, and so you're like, "Okay. Let's try it. Let's run it." So I'm like, "What's the worst that's gonna happen? People will think we're obnoxious and then probably forget in six months." It actually seems like relatively... Anyway, so we stand the billboard up somewhere like near Birmingham. It goes over so well. We tweeted, the tweet goes viral. The tweet then and so the next couple months, but like ends up on r/accounting, ends up on all these... Like right, you're like, "Oh, this is a gem." And I think it, it really worked 'cause like... And it's our, it's our brand at our best and our marketing at its best, which our, our attribute is with a wink. But it's like, you know, we take our work seriously, but we don't always take ourselves seriously. And so I think there was something to that that resonated. And then I think there was something to like, it was a little obscure, but it wasn't so obsc- but it was like sufficiently obscure where if you got it, you felt like you got a secret. Anyway, and so like compliance that doesn't suck too much just worked. Okay, '22, market crashes. Turns out there's a lot of billboard inventory available on 101. So we get this great spot, right, where like 101 and 280 sort of intersect and it's on this... Anyway, great spot. For like not that much, especially in retrospect. And we're like, and we joke and we're like, "Oh yeah, we've like locked it up for years." Like, "Blah, whatever." And so we were known for this billboard in this spot. I think even on podcasts I said the contract was locked up for years. It was not locked up for years. [laughs] But that billboard got famous, and so we... People would contact us and Sarah all the time and be like, "How do you do billboard? How do you do your billboard?" And we're like, "Oh, we work with this agency. We work with this guy." And so we referred this guy all of this business. So we'd just be like, "It's him, it's him, it's him." All, like millions of dollars of business. Great. Okay. Turns out in the background, we did not have a multi-year contract, which I should've known, certainly if I was gonna say that on a podcast, not really do it a service in tin. And the contract was basically like, "You've put the billboard up. That's it." Like this, this was like not a contract at all. Multiple years go by. Sarah's at like seeing one of her friends for dinner, works at a startup, and her friend was like, "Oh, it's so sad you guys like gave up that billboard spot. Like, why'd you do that?" And Sarah was like, "Pardon?" And they were like, "Oh yeah, we just signed for your spot." And Sarah was like, "What?" We go back. We're like, "Contract, contract." It's contract written in crayon. There is no contract, basically. [laughs] It's a placement order. Called the guy, and he's like, "Yeah, you know, it was a placement order. They, they paid more." So he like swapped it out underneath us. I go to founder of said company and be like, "Hello. Can I... Like, how much can I pay you?" And I am like an extremely inelastic buyer here. [laughs] Like, "What can I pay you for this spot?" And he's like, "Nothing." And I'm like, "How about I double?" I think he was paying like a million and a half, and you're like, "How about I give you three?" [laughs] Like, "Just to get the spot." And he's like, "We're actually cash flow positive, so like literally there is no... Like I'm an inelastic, you know, seller." And so we lost the spot. Things that made me think where I was like, "Oh, no, Vanta's screwed." Honestly, losing that billboard, I was like, "We did probably just lose a billion of market cap."

   3. POPatrick O'Shaughnessy1:00:25

      Bad, bad, bad omen.

   4. SPSpeaker1:00:26

      Yeah, yeah, yeah. Yeah, both bad omen and like there is some market cap. You know, like vibesy market cap decrease that just happened here. Yes. [laughs]

   5. POPatrick O'Shaughnessy1:00:36

      So is there anything I've missed that

10. 1:00:38 – 1:04:55

    Rebuilding Trust in Technology

    1. POPatrick O'Shaughnessy1:00:38

       has your curiosity, your attention, that you think is really important right now?

    2. SPSpeaker1:00:44

       You see it in the data center conversations, to some extent in the personal agent stuff. It's like we just don't trust software companies, tech companies the way we used to, and that is like getting worse year over year. And it's kinda hard to imagine that inflecting back up and getting to the like youthful optimism of 15 years ago.

    3. POPatrick O'Shaughnessy1:01:05

       Yeah.

    4. SPSpeaker1:01:05

       And so I think in that, companies showing that they are trustworthy and industrial grade and secure through lots of metrics and actual definitions is like more important than ever and will just get more and more important.

    5. POPatrick O'Shaughnessy1:01:19

       Mm.

    6. SPSpeaker1:01:19

       And again, to a host of customers, regulators, lawmakers, auditors, et cetera, Vanta at 250 billion is like in the center of all of those transactions. Helping companies meet those high bars or wherever those bars are set, and then conveying that, like helping them go convey that and accelerate their businesses

    7. POPatrick O'Shaughnessy1:01:40

       Is another way of saying that, like AI has ushered in this extremely high excitement but low trust-

    8. SPSpeaker1:01:46

       Yeah, that's good

    9. POPatrick O'Shaughnessy1:01:46

       ... era?

    10. SPSpeaker1:01:47

        Yes.

    11. POPatrick O'Shaughnessy1:01:48

        And Vanta's job is preserve-

    12. SPSpeaker1:01:50

        Rebuild some of that trust

    13. POPatrick O'Shaughnessy1:01:50

        ... preserve the excitement, but increase-

    14. SPSpeaker1:01:52

        Yeah, increase the trust, and like on legitimately so, not just on vibes.

    15. POPatrick O'Shaughnessy1:01:55

        Yeah.

    16. SPSpeaker1:01:55

        On like... Yeah, yeah.

    17. POPatrick O'Shaughnessy1:01:56

        What will satisfy the market to trust again?

    18. SPSpeaker1:02:01

        I think in a B2B context, like businesses, I do think there's a bit of... Like there's the vibes piece, but there's a very real data piece, and it's like, and I would like to see specific things or specific improvement curves or ma- have big promises with maybe contracts behind them, right? I think that one's a much more, quote-unquote, "logical, rational," the way like enterprise markets often are. I think on the consumer side it is vibes, and I don't... That one seems very hard to turn. I do not envy that.

    19. POPatrick O'Shaughnessy1:02:31

        Do you trust them? Use instinct, et cetera?

    20. SPSpeaker1:02:36

        Big companies? No.

    21. POPatrick O'Shaughnessy1:02:38

        Why not?

    22. SPSpeaker1:02:39

        It's not that there's anything particularly interesting in my, you know, email or, you know, chats or whatever. Like it's not, my life's not that interesting. But I would rather, you know, just Google or like, or just Apple or just insert company here have that information.

    23. POPatrick O'Shaughnessy1:02:53

        Hmm. What's security like five years from now? Like if you just wrap it up with like, okay, here's, here's we're going. We wanna be the person at the center of this.

    24. SPSpeaker1:03:01

        Yeah.

    25. POPatrick O'Shaughnessy1:03:01

        Describe that state for us.

    26. SPSpeaker1:03:02

        Security from five years from now is faster, even more intense, more offensive hopefully in that like, yes, we'll have more attacks, but I think you need more like white hat pushing back on all of that and just to get a speed that we haven't had. And I think you've gotta get humans to get to that speed. You've gotta get a lot of, some amount of the human decision-making out, where humans are like architecting systems and writing rules, but not making every single decision.

    27. POPatrick O'Shaughnessy1:03:30

        Yeah.

    28. SPSpeaker1:03:30

        It's like falling from that.

    29. POPatrick O'Shaughnessy1:03:31

        Yeah.

    30. SPSpeaker1:03:32

        Writing evals. Maybe that's all we're doing in the future.

Episode duration: 1:04:56