The question that started Vanta was not a market thesis. It was disbelief.
Christina Cacioppo was a product manager at Dropbox, trying to ship Dropbox Paper, and she kept running into the company’s compliance process. “The way, as an industry, we think about the security of products, is through accountants looking at screenshots? Seriously?” she told Forbes, recalling the moment. “Prior to Vanta, the way security and compliance was done was entirely with spreadsheets and screenshots of information that were collected in folders and shown to [CPAs].”
Ten years later, the company she left Dropbox to build announced it had crossed $300 million in annual recurring revenue — and that its growth rate had gone up, not down, in each of the four preceding quarters.
The unlikely résumé
Cacioppo did not arrive at this from a security background. She studied economics at Stanford and took a master’s in management science and engineering there. From 2010 to 2012 she worked on the investment team at Union Square Ventures, on the other side of the table from the founders she’d eventually join. She taught herself to code somewhere in the middle of all that, and co-founded a software development shop before Dropbox.
That combination — an investor’s eye for market timing, a builder’s willingness to just make the thing — is most of the explanation for what happened next. Vanta was founded in 2016 with Erik Goldman, a software engineer and product designer who is no longer involved with the company. The early exploration was genuinely open-ended; Forbes reported that the ideas considered included, at one point, “an app that was like Amazon’s Alexa for biologists.”
The first product was a spreadsheet
What Vanta actually shipped first was not software in any recognizable sense.
Speaking to First Round Review about the company’s route to product-market fit, Cacioppo described a first customer engagement that was almost entirely manual: “We made them a gap assessment in a spreadsheet that was very custom to them.” She wrote the compliance reports herself. When the software was too slow to generate one live, the team told the customer the truth and sent it the following day. For the first audit, Cacioppo flew to Colorado, sat in the auditor’s WeWork, and pulled the information out of the database by hand.
The insight that made it a business came from interviewing an infrastructure engineer at Figma, who walked through the dozen or so tools and practices Figma had assembled to satisfy a large customer’s security questionnaire. Security had become the top priority the moment it stood between the company and a deal. That was the wedge: not “security is important,” which everyone already agreed with and nobody paid for, but “you cannot close this contract without a SOC 2.”
Word of mouth did the rest. A former Dropbox colleague heard what she was doing and asked, in Cacioppo’s retelling, “Hey, I hear you’ve become SOC 2 consultants… can you come get a SOC 2 for my company as well?” Soon the team was fielding two or three of those emails a week. Her own test for whether the thing was working was blunt: the customers were finding them even though the company had made it exceedingly difficult to be found.
Ten million to three hundred million
The compounding, once it started, is the part that is hard to argue with.
Vanta went through Y Combinator and raised a $50 million Series A in May 2021, then $110 million in June 2022 at a $1.6 billion valuation, with roughly 5,000 customers and an estimated $80 million in ARR at the time. In July 2025 it raised a $150 million Series D led by Wellington Management at a $4.15 billion valuation, with ARR at $220 million and around 12,000 customers — bringing total funding to about $500 million.
The stretch since is faster than the stretch before. It took Vanta two years to go from $10 million to $100 million in ARR. Fifteen months to reach $200 million. Nine months to reach $300 million, which the company announced on April 29, 2026, alongside a customer count above 16,000 that now includes Snowflake, Atlassian, Duolingo, Ramp, Cursor, and Harvey.
“Just nine months later, we’ve crossed $300M,” Cacioppo said in the announcement. “Our growth rate’s increased each of the past four quarters.”
Why the curve bent upward
Cacioppo’s own explanation for the acceleration is not about sales execution. It is about a gap that AI adoption opened underneath her customers.
Vanta’s data, published with the milestone, found that 70% of companies now have “shadow AI” — models and tools in use that never went through a formal security review. Large language models are 52% more likely than traditional SaaS to be flagged high-risk in Vanta. And revocation does not stick: the company reported that at an average customer, employees reinstall AI tools roughly a thousand times a year after they have been removed, with Claude, ChatGPT, and Cursor the most-reinstalled.
“There’s this push-pull going on at an actually really broad scale,” Cacioppo told Fortune. “AI is exciting, but also scary and risky.” Her read on why the business is compounding faster now than it was at a tenth the size: “It’s that combination of new, quickly growing AI hyperscalers with more risk and more scrutiny that is letting Vanta’s growth rate actually increase year over year.”
The founder who raised money she did not need
The most revealing decision in Vanta’s history may be the Series D, because on the numbers there was no reason to take it. Cacioppo told Forbes the company had not yet spent the $150 million from its previous round, nor the majority of its 2023 funding. She raised anyway.
“The last five years of Vanta has taught me that these market openings… are opportunities that don’t last forever,” she said. “Part of why we took [the funding] was that it feels like there is so much opportunity, and we are in a very good position so long as we execute towards it.”
The same instinct shows up in how she talks about an IPO, which the numbers now plainly permit and which she is in no hurry to schedule. “The goal is the long-term sustainable company versus the day of confetti,” she told Fortune.
It is a consistent posture from someone whose first product was a spreadsheet she filled in by hand: the milestone is not the point, and the confetti is definitely not the point. The thing that mattered in 2016 — that a real problem was being solved with screenshots and goodwill — is the same thing that matters at $300 million.
Related founders
- Anton Osika Built Lovable to a $13.3B Valuation From Sweden — another founder who ignored the default advice about where and how to build, and whose company is now one of Vanta’s own named customers.
- Six Months, $80 Million: How Maor Shlomo Built Base44 Alone — the opposite structural choice: no co-founder, no outside capital, and an $80 million exit inside two years.
- Lily Clifford Left Stanford to Build Rime’s Voice AI — another Stanford founder who left an established track to build infrastructure the incumbents had not bothered to build properly.
Cacioppo’s education, her time at Union Square Ventures and Dropbox, the origin of the Vanta idea, her quotes about accountants and screenshots, Erik Goldman’s role, the early funding history and the June 2022 $1.6 billion valuation are per Forbes (Phoebe Liu, June 25, 2023). The account of Vanta’s first customers — the custom gap-assessment spreadsheet, hand-written reports, the trip to the auditor’s WeWork in Colorado, the Figma interview and the word-of-mouth emails — and all quotes in that section are per First Round Review (“Vanta’s Path to Product-Market Fit”). The July 2025 $150 million Series D led by Wellington Management at a $4.15 billion valuation, the $220 million ARR and ~12,000 customer figures, and Cacioppo’s quotes about raising money the company did not need are per Forbes (Phoebe Liu, July 23, 2025). The April 29, 2026 $300 million ARR milestone, the $10M→$100M→$200M→$300M timeline, the 16,000-customer figure, the named customers, the shadow-AI statistics, and Cacioppo’s quotes on the growth rate and on an IPO are per Vanta’s own announcement (vanta.com) and Fortune’s exclusive report of the same date.
