Christina Cacioppo - Building an Enduring Software Company in the Age of AI - [Invest Like the Best, EP.496]
Christina Cacioppo - Building an Enduring Software Company in the Age of AI - [Invest Like the Best, EP.496]
Podcast57 min 29 sec
Listen to Episode
Note: AI-generated summary based on third-party content. Not financial advice. Read more.
Quick Insights
  • Consider cybersecurity as a long-term growth theme: AI may accelerate attacks and increase demand for faster detection and remediation, though no specific stock or entry price is recommended.
  • Compare security providers by customer segment and economics: CrowdStrike (CRWD) is discussed in enterprise use cases, while Vanta targets a broader set of customers but remains private.
  • Evaluate AI software companies for sustained customer adoption, workflow value, and durable data or integration advantages—not AI branding alone; the insights provide no specific public-market buy, price target, or timeframe.
Detailed Analysis

Vanta (Private)

  • Vanta is described as a fast-growing, high-margin software business with about 16,000 customers. The guest says its foundation of integrations and security data helps it build new products and AI agents.
  • Its agents can take actions such as removing access when employees leave, with user permission. About 25% of customers were using this agent-oriented flow; the company wants to expand adoption.
  • The company is broadening from compliance into additional security products. The guest sees demand rising for businesses to prove their software is secure and reliable to customers, regulators, and other stakeholders.
  • The discussion also highlights pressure on established software companies: the market is valuing some high-growth, high-margin software businesses at much lower multiples than before, while AI-focused firms attract capital and talent.
  • Vanta is private, so the transcript provides no public-market valuation or investable ticker. The joking reference to $250 billion is not presented as a formal valuation target.

Takeaways

  • For private-market or sector research, assess whether Vanta’s data and integrations create durable advantages, and whether customers adopt its agents enough to support retention and future product expansion.
  • Treat strong growth and margins as only part of the picture: the conversation emphasizes that software valuations can compress and that AI competition may change which business models investors favor.
  • Monitor the trade-off between investing in AI features now and protecting margins. Vanta says it is currently absorbing token costs rather than charging customers directly for them.

Cybersecurity and Security Software (Theme)

  • The guest expects AI to increase the pace and sophistication of attacks. She says models can persistently test systems and combine individually minor weaknesses into more serious vulnerabilities.
  • Her view is that security teams may need to fix issues faster and rely less on human-by-human prioritization. Over time, agents could continuously test systems and help remediate problems.
  • Vanta sees potential in offering security products to customers already using its platform, particularly businesses that may not buy higher-priced enterprise tools.
  • CrowdStrike (CRWD) and Wiz are mentioned as better-positioned for some enterprise use cases; the guest does not present them as investment recommendations.
  • The guest also sees security and cyber startups as an area where founders are actively building companies.

Takeaways

  • The discussion supports investigating cybersecurity as a potential beneficiary of AI-driven security needs, while distinguishing between enterprise-focused providers and platforms serving smaller or mid-sized businesses.
  • Consider whether a company can turn AI-driven threat detection into reliable remediation, not just more alerts. The transcript flags the operational challenge of responding quickly as attack activity accelerates.
  • No stock price targets, explicit buy or sell recommendations, or specific investment timelines are given.

AI Labs and Inference Providers (Theme)

  • The guest says investors are strongly focused on AI labs and inference providers, but describes valuations and entry prices as high and the surrounding discussion as susceptible to FOMO.
  • She questions whether investment opportunities around open-source model providers are as developed as the ecosystems around major labs, even though many people expect open-source models to matter.
  • The conversation also notes that depending on a single model provider can create business-continuity risk. Some French software companies reportedly shifted toward Chinese models after concerns that access to American models could be restricted.

Takeaways

  • Compare AI companies on adoption, distribution, and ecosystem development—not only on model capability or market excitement.
  • For software businesses using AI, provider diversification and continuity planning may matter alongside model quality and cost.
  • The transcript expresses interest in open-source AI ecosystems but does not name a specific provider as a recommended investment.

AI-Enabled Software and Pricing Models (Theme)

  • Vanta is building agent-based features into its existing software and is prioritizing customer usage, even while absorbing the associated token costs.
  • The guest says charging customers directly based on tokens can invite comparisons with model providers and may make software applications look like marked-up access to a model.
  • She describes outcome-based pricing as attractive in theory but difficult to implement because customers and vendors may disagree on what counts as a measurable outcome.
  • She argues that company-specific data, customer knowledge, and integrations may be undervalued relative to general technical skills.
  • The guest is skeptical of post-training custom models when the main purpose is marketing. She says it can make sense in some cases, but presents cost reduction or a specific enterprise deployment need—not a general quality advantage—as the more plausible rationale.

Takeaways

  • When evaluating AI software companies, look for sustained customer use and clear workflow value rather than token consumption, AI branding, or claims of custom models alone.
  • Scrutinize pricing: unclear credits or token markups may create customer resistance, while outcome pricing can be difficult to define and administer.
  • Assess whether a company’s proprietary data and customer context give it a practical advantage that a general-purpose model cannot easily replicate.

RevTech and Robotics (Themes)

  • The guest identifies go-to-market technology (RevTech) as an area where new AI companies are being formed, while suggesting some established providers may be focused more on efficiency-oriented or acquisition strategies.
  • She describes robotics as relatively underweighted compared with software, while noting that AI models are improving for robotics applications.

Takeaways

  • RevTech and robotics are areas the guest sees as potential sources of new AI-driven businesses, but the transcript does not identify specific companies or make an investment recommendation.
  • For RevTech, examine whether AI meaningfully improves sales and customer workflows, rather than simply automating isolated tasks.
  • For robotics, the discussion points to improving AI capabilities but provides no details on deployment timelines, economics, or adoption.

Government and Enterprise Modernization (Theme)

  • The guest says AI has increased urgency around modernization among government agencies and large enterprises.
  • She reports that security leaders are seeking budget for broader enterprise-risk programs because AI agents introduce new risks and make existing processes feel inadequate.
  • She also describes government officials as showing more interest in modernization than before.

Takeaways

  • Businesses selling software into government and enterprise may benefit if AI-related concerns unlock budgets for modernization, security, or risk management.
  • The transcript also notes that enterprise procurement can be a hurdle: one prospective customer wanted AI features disabled initially because non-AI software could be easier to approve.

Palantir (PLTR)

  • Palantir is cited as a company that may successfully use forward-deployed engineers (FDEs) and that has eight-figure contracts.
  • The guest questions whether the same labor-intensive approach works for companies with smaller, five- or six-figure contracts, where the economics may be less favorable.

Takeaways

  • The discussion highlights an important diligence question for software companies using FDEs: whether contract value is large enough to support the cost of customized, hands-on deployment.
  • Palantir is used as an example of a potentially different economic model, not as an explicit stock recommendation.

CrowdStrike (CRWD) and Wiz

  • These security providers are mentioned in a discussion of market positioning. The guest says CrowdStrike may be better suited to certain enterprise security needs and notes that Wiz’s customer base and pricing are oriented toward larger companies.
  • Vanta sees an opportunity to serve customers that may not purchase a higher-priced enterprise security product.

Takeaways

  • The transcript suggests comparing security companies by customer segment, product scope, and price point rather than assuming all providers compete for the same buyers.
  • No explicit view on either company’s stock valuation or future returns is stated.

Snowflake (SNOW)

  • Snowflake is mentioned as one of Vanta’s customers in a sponsor message, without further discussion of its business or investment outlook.

Takeaways

  • The transcript provides no substantive investment thesis, price target, or recommendation for Snowflake.

Amazon (AMZN)

  • AWS is mentioned as an example of a cloud provider whose customers may need help identifying and fixing security misconfigurations.
  • The guest frames this as a potential product area for security vendors, not as a view on Amazon’s investment prospects.

Takeaways

  • The discussion points to cloud security needs as a potential opportunity for specialized software providers, but gives no investment recommendation or valuation commentary on Amazon.
Ask about this postAnswers are grounded in this post's content.
Episode Description
My guest today is Christina Cacioppo, founder and CEO of Vanta, which helps more than 16,000 companies manage security and compliance.  Five years after our first conversation, we discuss how Vanta became a category leader, what it takes to reinvent a successful software business in the age of AI, and why Christina is betting on agents to do the work rather than simply assist users.  We also explore the changing economics of software, the war for exceptional talent, AI's impact on cybersecurity, and what it takes to build an enduring company in Silicon Valley's rapidly changing environment.  Please enjoy my conversation with Christina Cacioppo. For the full show notes, transcript, and links to mentioned content, check out the episode page here. ----- Become a Colossus member to get our quarterly print magazine and private audio experience, including exclusive profiles and early access to select episodes. Subscribe at ⁠colossus.com/subscribe⁠. ----- ⁠Ramp’s⁠ mission is to help companies manage their spend in a way that reduces expenses and frees up time for teams to work on more valuable projects. Go to⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ ⁠ramp.com/invest⁠⁠ to sign up for free and get a $250 welcome bonus. ----- Trusted by thousands of businesses, ⁠Vanta⁠ continuously monitors your security posture and streamlines audits so you can win enterprise deals and build customer trust without the traditional overhead. Invest Like the Best listeners get a special offer of $1,000 off Vanta when you go to ⁠vanta.com/invest⁠.  ----- WorkOS⁠ is the infrastructure B2B and AI-native companies use to sell to enterprise. It covers everything enterprise security requires: SSO, SCIM, RBAC, Audit Logs, AI governance, and more. Trusted by 2,000+ fast-growing companies, including OpenAI, Anthropic, Cursor, and Vercel. ----- Rogo is the AI platform for finance. They're building agents for Wall Street that are trained to understand how bankers and investors actually do work: from diligence and modeling, to turning analysis into deliverables. To learn more, visit rogo.ai/invest. ----- ⁠Ridgeline⁠ has built a complete, real-time, modern operating system for investment managers. It handles trading, portfolio management, compliance, customer reporting, and much more through an all-in-one real-time cloud platform. Visit⁠ ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ridgeline.ai⁠. ----- Editing and post-production work for this episode was provided by The Podcast Consultant. Timestamps: (00:00:00) How Vanta Won a Crowded Category (00:03:12) Living Through the Software Selloff (00:05:41) Building an Agent-First Product (00:07:39) Why Vanta Eats the Cost of AI (00:10:35) The Search for Outcome Pricing (00:14:31) Getting People to Actually Use AI (00:17:46) Why Comp for Top People Is Up 10X (00:22:13) Valuations, Tenders, and the Endgame (00:24:20) What’s Overhyped and Underhyped (00:27:54) The Problem With FDEs (00:29:34) Why French Startups Use Chinese Models (00:30:22) Vanta as a Security Company (00:36:57) What Makes a Great Talk (00:40:14) Where She Would Invest Today (00:45:19) The Billboard War (00:49:35) The AI Trust Crisis (00:51:39) Security Five Years From Now
About Invest Like the Best with Patrick O'Shaughnessy
Invest Like the Best with Patrick O'Shaughnessy

Invest Like the Best with Patrick O'Shaughnessy

By Colossus | Investing & Business Podcasts

Conversations with the best investors and business leaders in the world. We explore their ideas, methods, and stories to help you better invest your time and money. Hear stock market and boardroom insights you can't find anywhere else. If you're a professional investor, CEO, entrepreneur, or business strategist, this is for you. Explore all our episodes and learn more at https://www.joincolossus.com