Vanta’s Founder on Learning to Code, Finding Customers, and Building Trust Software

概览

This episode follows Vanta founder and CEO Christina through her path from Stanford and Union Square Ventures to teaching herself to code, joining Dropbox, and eventually building Vanta around security and compliance automation.

A central thread is that startup paths are not linear. Christina describes seeing many kinds of founders at USV, realizing she did not need to match a single stereotype, and then deliberately building the skills and confidence she felt she needed before starting a software company.

The Vanta story emerges from a concrete pain point at Dropbox: SOC 2 and compliance work were important, but the workflow involved audits, screenshots, policies, and heavy engineering distraction. Christina later validated the idea by talking to founders, starting with spreadsheets, and only building software once the customer problem was clear.

分段落总结

[00:00] Vanta and trust management

[事实] The hosts introduce Christina as the founder and CEO of Vanta, described as a trust management platform.

[事实] Christina explains Vanta as helping companies build security programs and then get credit for that work with customers through audits, questionnaires, or status pages.

[事实] The hosts frame the company in simpler terms as cybersecurity, compliance automation, and securing customer data.

[01:31] From Ohio and Stanford to Silicon Valley

[事实] Christina says she was from Ohio, studied at Stanford, and did an extra year for a bachelor’s and master’s program.

[事实] She describes arriving in Northern California as someone from the Midwest and remembering details like the blue sky, hills, and palm trees.

[推测] The conversation uses this background to show that her path into startups was shaped by exposure and curiosity rather than by growing up inside Silicon Valley.

[03:04] Getting hired by Union Square Ventures

[事实] Christina says she got her USV job through Fred Wilson’s blog post asking applicants to send links to their web presence.

[事实] She submitted four links shortly before the application form closed, including Flickr, Twitter, and a Berlin design blog or Tumblr.

[事实] She says USV truly hired off the internet, even though she later realized she knew people at Stanford who knew the firm.

[05:02] Early YC Demo Day memories

[事实] Christina recalls attending early YC Demo Days for USV when batches were around 40 companies and pitches were several minutes long.

[事实] She would take notes, identify companies that fit USV’s interest in large networks of engaged users, and later email summaries with the companies she found interesting.

[事实] She remembers Paul Graham telling investors there was an Airbnb in the batch and that their job was to find it.

[事实] She also recalls trying to be one of the last investors in the room so she could keep talking with founders after the pitches.

[09:55] What USV taught her about founders

[事实] Christina says one of her biggest USV lessons was that there are many ways to be a founder and many ways to start a company.

[事实] Before USV, she had a narrower model of founders as people who started programming very young, studied computer science briefly, dropped out, and built huge products.

[事实] She says meeting roughly five founders a week for two years helped her understand that people reach founding through many different paths.

[推测] This experience appears to have lowered the psychological barrier between observing startups and believing she could start one herself.

[11:40] The job of a young VC

[事实] Christina says founders did not really want to talk to a junior person at a VC firm because they wanted the partners who could write checks.

[事实] She eventually defined her role as understanding founders, translating their companies into USV’s language, and routing them to the right partner.

[事实] She describes preparing both sides of a meeting so the founder and partner could understand each other better.

[推测] The lesson she draws is that influence in a junior role can come from being a useful conduit rather than pretending to have senior authority.

[14:01] Teaching herself to code

[事实] Christina says she wanted to start a software company but felt blocked because she could not build software herself.

[事实] She says Fred Wilson told her she was not a “fake it till you make it” person and should not try to operate that way.

[事实] She quit USV, lived off her bonus for about a year and a half, and treated learning to code like a job.

[事实] She started with Steve Huffman’s Udacity course on making a blog in Python, then built a bookshelf web app as an early project.

[19:24] Learning as daily work

[事实] Christina says she went to an office across from USV, got dressed, showed up daily, and coded from roughly morning to evening.

[事实] She stayed in New York partly because leaving her social circle felt difficult after already changing so much else in her life.

[事实] She compares that period to grad school because she was living cheaply and limiting expenses.

[推测] Her approach suggests that self-teaching worked partly because she created external structure around an otherwise self-directed project.

[21:11] Explaining work without a job

[事实] The host reads from Christina’s writing about leaving a job to make things and needing to explain that choice to parents.

[事实] The quoted advice says people may assume someone without a job is not working, and that they may be confused rather than malicious.

[事实] Christina says she can hear herself giving both advice and a pep talk in that writing.

[推测] The segment presents self-directed building as emotionally difficult because outsiders may not recognize it as real work.

[23:05] The messy middle before Dropbox

[事实] Christina says she built many things that no one used.

[事实] She says startup stories are often told as linear narratives, but the real middle is messy rather than a straight line.

[事实] After about two years, she felt she could build things well enough to get ideas onto a screen for feedback.

[事实] She joined Dropbox as a product manager after feeling she needed to understand what a company was and work inside one.

[26:42] Networks, Dropbox, and personal support

[事实] Christina joined the Hackpad team at Dropbox and worked with the Hackpad founders Igor and Alex.

[事实] She says the host had introduced her to Harj at YC Demo Day, and that connection later contributed to Patrick Collison emailing her about pitching USV.

[事实] She says Patrick’s superpower is believing in people more than they believe in themselves, and that she benefited from that.

[推测] The conversation frames networks as important, but not as a replacement for Christina’s own skill-building and persistence.

[31:04] Dropbox Paper and the compliance wall

[事实] Christina says Dropbox was in a period of building or buying adjacent apps, including Carousel, Mailbox, and Hackpad, which became Paper.

[事实] The Paper team was separate from the rest of Dropbox and saw itself as building the new thing.

[事实] She says Paper was widely used inside Dropbox but had almost no external users, joking that its best users were AJ’s mom and an engineering manager’s girlfriend.

[事实] When Paper planned to launch to Dropbox customers, a lawyer said it could not because customer contracts required security and compliance commitments.

[36:16] What SOC 2 involved

[事实] Christina describes SOC 2 as an audit of a software company’s IT and security practices and policies.

[事实] She says the company defines what it is supposed to be doing, and an auditor asks for proof that it is doing those things.

[事实] She gives two-factor email requirements as an example, where a company might need to show an admin console screenshot as evidence.

[事实] She says the result is a report that customers can rely on for confidence in the company’s practices.

[推测] The painful manual process she describes became part of the insight that compliance work could be improved with software.

[40:27] Finding the Vanta idea

[事实] After leaving Dropbox, Christina initially built several things that no one wanted.

[事实] She then made a rule that she and her collaborator were not allowed to build anything else and had to talk to people until they found a real problem.

[事实] Security conversations led her back to SOC 2 compliance, which she remembered as painful from Dropbox.

[事实] The first Vanta-like product was a spreadsheet gap assessment showing what a company needed for SOC 2, what it already did, and what gaps remained.

[43:55] From spreadsheet to product

[事实] Christina says they first made the spreadsheet for Segment, then adapted it for Front by replacing Segment-specific references.

[事实] When another potential customer asked for the spreadsheet, they decided that customer would get a web app instead.

[事实] She says skeptics believed every company was too unique for this to become a product, but her thesis was that best practices could get small startups very far.

[推测] The early spreadsheet functioned as both product prototype and customer discovery tool.

[44:31] What compliance checks covered

[事实] Christina lists infrastructure controls such as AWS setup, encryption at rest, encryption in transit, machine access, and permissions.

[事实] She also describes people-process controls such as hiring process, role clarity, responsibilities, and checking whether people are doing what they are supposed to do.

[事实] She says SOC 2 does not simply require performance reviews, but companies need a baseline reasonable structure for how they operate.

[事实] She learned by talking with the Dropbox security team and others, reading available online material, and comparing SOC 2 reports from companies like AWS, Slack, Google, Salesforce, and Zendesk.

[47:10] Choosing startup founders as users

[事实] Christina says it helps product development if founders like their users because they will spend more time with them and build better products.

[事实] She preferred spending time with startup founders, especially at the beginning, over selling primarily to Fortune 500 governance, risk, and compliance professionals.

[事实] She connects Vanta to the broader pattern of companies outsourcing software they previously built internally, such as recruiting tools replacing custom internal systems.

[推测] This explains why Vanta’s early target market was startups rather than large enterprises.

[49:23] Why Vanta joined YC

[事实] Vanta went through YC in Winter 2018.

[事实] Christina says they talked to founders who had done YC twice to understand why they returned.

[事实] The reasons she heard included cohort value, community, and the usefulness of YC if the business sells to startups.

[事实] She says she did not know how to sell and wanted a supportive environment where she could learn with startup customers.

[50:42] YC as accountability

[事实] Christina describes YC as pushing founders to get likes early, pick a metric, set a three-month target, and report progress regularly.

[事实] She says Vanta’s batch mates were too small to need SOC 2, but older YC companies with around 50 employees were a better fit.

[事实] She says YC companies were unusually willing to reply, take calls, or forward requests from other YC founders.

[事实] Vanta set a target based on selling two $10,000 contracts per week and reached about $180,000 by the end of YC.

[53:37] Seed fundraising after Demo Day

[事实] Christina says Vanta effectively closed its seed round five or six days after YC.

[事实] She intentionally spoke with seed investors rather than investors who would write Series A checks because she wanted a fast, simple process.

[事实] She says the advice she received was to meet later-stage investors the week after Demo Day, while she was already in pitch mode and could say the seed round had closed quickly.

[推测] Her prior experience as a VC likely helped her manage investor sequencing more deliberately.

[55:07] Choosing customers over investors

[事实] The host says she read that Vanta did not raise a proper Series A until it had $10 million ARR.

[事实] Christina says the business was working and that she could often turn founder conversations into customers.

[事实] She reasoned that spending two hours getting a customer was more useful than spending that time walking to and from investor coffee meetings.

[事实] She says investors would rather invest in companies with more revenue, so additional customers made Vanta more compelling rather than less.

[58:04] Burn, hiring, and upfront annual payments

[事实] Christina says Vanta controlled burn partly because the team was bad at hiring outside engineering and made overly complicated interview processes.

[事实] She says a more intentional choice was charging customers annually upfront.

[事实] She learned from Peter Reinhardt’s writing about startup finance that annual upfront payment was better for cash flow than quarterly or monthly payment.

[事实] Vanta used new business revenue from a month to pay people, keeping the bank balance relatively steady.

[60:00] Pricing and early sales

[事实] Vanta initially charged about $10,000.

[事实] Christina tested pricing by asking founders what would be reasonable, expensive, and prohibitively expensive; $10,000 came back as expensive but acceptable.

[事实] She tried walking the price up when customers did not react strongly, but later a salesperson found that $10,000 closed much faster.

[事实] Christina personally did the first $500,000 of sales and says selling like a product manager helped her learn what customers understood and what the company should build.

[63:03] Female founder visibility

[事实] The host says Christina is high on YC’s leaderboard for successful startups with a female founder.

[事实] Christina says she mostly tries not to think about that because she has not found an obviously useful way to channel it.

[事实] She says she wishes there were more women starting enterprise software companies so it would be less notable.

[推测] The segment treats her visibility as meaningful, while Christina herself focuses more on continuing to build the company.

[64:26] What comes after Vanta

[事实] When asked whether she thinks about the next thing after Vanta, Christina says it is too early.

[事实] She says some days she thinks she would be much better at starting another company, and other days she thinks about making art somewhere.

[事实] She does not give a clear answer about what she would do next.

[推测] Her answer suggests she is still primarily focused on Vanta rather than planning a public next act.

[65:53] Hosts’ closing takeaways

[事实] After Christina leaves, the hosts say they found her story fascinating because it is a different entry into the startup world than many other interviews.

[事实] They emphasize that she taught herself to code in her 20s.

[事实] They interpret Fred Wilson’s comment that she was not a “fake it till you make it” person as a compliment about being genuine and legitimate.

[事实] They say Christina did many founder things the right way, including choosing customers and product progress over investor meetings.

播客点评/总结

[推测] The episode is valuable for founders because it makes the startup path feel concrete rather than mythic: learn the missing skill, talk to users, start with a manual product, charge money, and keep choosing customers over status meetings.

[推测] Its strongest section is the Vanta origin story, where an abstract compliance category becomes understandable through the Dropbox Paper launch problem, SOC 2 audit mechanics, and the first spreadsheet gap assessment.

[推测] The main limitation is that the discussion is more founder-journey focused than product-depth focused; listeners looking for a detailed technical breakdown of Vanta’s platform or compliance frameworks will only get the high-level version.

[推测] This episode is especially suited to startup founders, aspiring founders, product managers, and people considering whether they need to build technical skills before starting a software company.