Oct 20, 2026 · 59 min
Vanta bets security software can execute, not merely monitor
Christina Cacioppo - Building an Enduring Software Company in the Age of AI - [Invest Like the Best, EP.496]
The episode examines how AI agents could reshape software economics, cybersecurity, hiring, and the path to building an enduring company.
- 1Vanta is shifting from compliance monitoring toward agents that execute security work with user permission.
- 2Outcome-based pricing sounds compelling, but defining genuine outcomes becomes harder as AI changes software delivery.
- 3Continuous AI-driven defense could expand cybersecurity while forcing companies to rethink talent, margins, interfaces, and trust.
Don't miss
Cacioppo envisions persistent AI systems discovering and chaining vulnerabilities at unusual scale, then automatically remediating them.
The brief
Christina Cacioppo explains how Vanta won a new security and compliance category through execution and continuous shipping, then confronts the pressure created by collapsing SaaS valuations.
Vanta is moving beyond passive alerts: its agents monitor work, take permitted actions such as employee offboarding, and push the product toward outcome-based pricing.
The conversation tests AI’s business reality, from modular codebases and task-specific evaluations to lower margins, compensation pressure, and the difficulty of separating genuine outcomes from outputs.
Cacioppo argues that company and customer knowledge are underappreciated advantages, while criticizing token-based pricing, marketing-driven model training, and hype about replacing entire teams.
The standout vision is continuous defense: AI systems discover and chain vulnerabilities beyond human scale, then pair penetration testing with automated remediation.
Cacioppo’s ambition is an expansive, enduring security platform built on Vanta’s customer and data foundation, even as trust in technology declines.
What was said on this episode
25 statements · 15 positive · 8 negative · 2 neutral
Vanta serves approximately 16,000 global customers across five products.
“Today, we're about 16,000 customers global with about five products.”
Listen at 3:02
Software companies’ competitiveness depends heavily on their latest shipped product.
“You're really only as good as the last thing you shipped.”
Listen at 3:37
Software companies should continuously ship products and features to maintain differentiation.
“you've just got to constantly be shipping new products, new features that make the experience better for customers running on that differentiation.”
Listen at 3:47
Vanta’s data foundation enables faster development of new products.
“that data foundation has let us build new things faster”
Listen at 4:31
Over sufficient time, an 80%-growth, 80%-margin business can outperform a 160%-growth, 30%-margin business.
“a 80% growth business with 80% margins will actually be better than over the same time period, run it out long enough, a 160% growth business with 30% margins.”
Listen at 5:52
SaaS valuation and business-model tensions will eventually resolve over time.
“I think this will. all sort itself out and you have to live for the fullness of time.”
Listen at 7:08
Software companies broadly want to adopt outcome-based pricing.
“I think everyone wants to get to outcome pricing.”
Listen at 12:32
Coding agents are more effective on small codebases than large codebases.
“It is so much easier to throw the coding agents at a small code base than a large one.”
Listen at 14:08
Modularizing codebases improves coding agents’ effectiveness.
“modularizing parts of the code base so that the agent can just understand smaller parts of it and understand it fully and then be really effective.”
Listen at 14:24
AI has transformed company building approximately nine out of ten.
“Oh, yeah. Like nine.”
Listen at 15:16
Company and customer context are currently undervalued in building AI agents.
“the company context piece, the customer context piece is probably being relatively undervalued.”
Listen at 28:39
Standalone sales ability is slightly less valuable today than four years ago.
“you are a good salesperson. It's a less valuable skill slightly today than it was four years ago.”
Listen at 28:46
Customers generally do not want to receive a standalone model.
“I don't think anyone actually wants to be handed a model.”
Listen at 30:56
FDE roles are an overhyped or misguided product model.
“I kind of think FDEs are crazy.”
Listen at 31:15
The current FDE role model probably will not persist.
“I think this FDE wrapping around it is probably not going to stay.”
Listen at 31:48
FDE economics for smaller contracts are likely unsustainable.
“those economics probably are upside down. We're in, again, era of 30% growth margin better. And so that sort of works. That doesn't feel sustainable.”
Listen at 32:09
AI models can persistently search for vulnerabilities far beyond human attackers.
“These models just are so much more persistent than people.”
Listen at 35:08
AI security models can discover vulnerabilities by chaining individually benign weaknesses.
“they find things and chain things together.”
Listen at 35:22
Machine-speed remediation could eliminate the need to prioritize security fixes.
“if you're fixing things at machine speed, you don't have to prioritize.”
Listen at 36:23
Vanta can compellingly provide continuous penetration testing and automated remediation for most customers.
“For some parts of Vanta, yes. I think we can do that in very compelling ways for the bulk of our customers.”
Listen at 36:48
CrowdStrike will provide continuous security testing and remediation better for enterprises.
“I think CrowdStrike will do it better for an enterprise.”
Listen at 36:55
Wiz targets companies with several thousand employees and corresponding high price points.
“Wiz's customer base starts at a multi-thousand person company and their price point starts at a multi-thousand person company.”
Listen at 37:23
Future software will rely on agents rather than embedding Tableau-like interfaces.
“this is what software will look like. And no one is going to be putting Tableau inside their products.”
Listen at 43:36
Vanta will not build an off switch for its AI features.
“we're not going to build this off switch”
Listen at 44:27
Vanta currently has product-market fit.
“It has product market fit.”
Listen at 49:24
Statements are attributed to the speaker as said on the episode and reflect their view at the time, not PodLume's. They are not advice.
Weekly email
State of the Pod, every Monday
The week's most-discussed names and stories from podcasts, with the moments behind them. Free, five minutes, unsubscribe in one click.