Cacioppo didn’t always realize she wanted to be a startup founder. But she knew she liked building things starting at age 11, when she ran a solo eBay Beanie Baby business.
Katie Thompson
On Wednesday, security and compliance software company Vanta announced a new $150 million fundraise that values the company at $4.15 billion, up from $2.45 billion when it last raised money a year ago. The new round brings Vanta’s total funding raised to around $500 million. Vanta cofounder and CEO Christina Cacioppo, who is on Forbes’ list of America’s Richest Self-Made Women, has a stake now worth around $830 million, up from $550 million previously.
New investor Wellington Management led the round, with participation from existing investors including Sequoia, Craft Ventures, Y Combinator, Goldman Sachs and JP Morgan. Vanta pulled in the funding despite not explicitly setting out to raise more—and hasn’t yet touched the $150 million it raised a year ago or the vast majority of its prior round in 2023, according to Matt Witheiler, head of Wellington’s late-stage growth investing.
“ The last five years of Vanta has taught me that these market openings … are opportunities that don’t last forever,” Cacioppo, 38, says. “ Part of why we took [the funding] was that it feels like there is so much opportunity, and we are in a very good position so long as we execute towards it. It felt like the capital would help us do that.”
Cacioppo and Witheiler first met more than a decade ago, when both were venture capitalists in New York and often got together for coffee at Manhattan’s now-shuttered City Bakery. Witheiler says Cacioppo struck him as highly strategic, energetic, thoughtful and “10 out of 10 on the smartness scale.” They reconnected around four years ago, when someone recommended that he look at Vanta as a potential investment. He walked away from the meeting thinking they should work together sometime. Then earlier this year the pair had an informal conversation led to the funding round, including just Wellington and Vanta’s earlier investors. The company didn’t even make an official fundraising deck, according to Cacioppo and Witheiler.
“I think if you take a step back and think about what key drivers compliance, security and regulation are in the business world, that’s only accelerating, and we see it out of the public side too,” Witheiler says. “Regulatory tailwinds that are not abating. They’re accelerating. I think Vanta is really uniquely positioned to capitalize on that over the next decade-plus.”
Cacioppo and cofounder Erik Goldman, who is no longer involved with the company, started Vanta in 2018 to change the security and compliance industry from a manual process that happened largely via spreadsheets and screenshots collected in folders shown to accountants and auditors. The company’s goal remains unchanged: to save its clients time and money by automating businesses’ security compliance processes, now through both continuous monitoring and real-time reports with the help of AI. (For example, AI now takes the first pass on security reviews, although a human is still always in the loop.) After helping a company make sure it is secure and compiling all the relevant documentation, auditors then go through the data and can more easily certify the company as compliant with an array of industry standards, including SOC 2, ISO 27001, HIPAA, GDPR and more.
Vanta, a member of Forbes’ 2024 Cloud 100 list of best private cloud computing companies, has an estimated $220 million in annual recurring revenue (ARR), up from $100 million in January 2024 and $10 million in 2021. Its 12,000 customers include Mistral AI, Omni Hotels, Duolingo and fintech firm Ramp. The remote-first company has also grown to more than 1,000 employees across the U.S., U.K. and Australia. Vanta’s biggest startup rival, Drata, is significantly smaller, having announced it crossed $100 million in annual recurring revenue earlier this year. Witheiler claims the distance between Vanta and the other companies in the category has gotten larger over the past 12 to 24 months, in part because Vanta has been able to grow with “very efficient” sales and marketing spend.
“Most customers don’t care if you created the space—they care if you have the best product for them today,” Cacioppo, an Ohio native, says.
With the additional funding, Vanta has plans to expand further into government partnerships, invest more heavily into AI and eye more acquisitions. Around two years ago, Vanta started expanding into compliance with government standards like FedRAMP, for which Vanta is currently in a pilot program to make it easier for federal agencies to use cloud-based software products. Now, Vanta has a handful of public-sector customers that work with government data, along with several other private sector customers that in turn contract with the government. Its goal is to “ make it even easier for a broad range of companies to be able to sell to the government and, if they’re already selling to the government, to be able to easily keep continuously compliant,” says Jeremy Epling, Vanta’s chief product officer.
As for AI, Cacioppo’s goal is to make sure the technology is actually helping customers solve problems, rather than, as she says, just “rubbing a little AI across the entire product.” Last month, Vanta released an autonomous AI agent that handles companies’ security and compliance workflow from beginning to end with little human intervention—with a goal of “getting to that zero-touch security review” for both buyers and sellers, per Epling. But with AI of course also comes risks of hallucination (when an AI model generates incorrect information), so for now, all AI-generated recommendations or questionnaire answers still need to be reviewed by a human. Vanta also claims not to train on customer data, instead using a combination of pre-existing large language models; high-quality, human-labeled data; and synthetic data to refine its AI capabilities. Even without AI, managing troves of customer data still comes with some inherent risk: a product bug in May briefly exposed a few hundred Vanta customers’ data to other customers. (Cacioppo wrote on LinkedIn that the issue is fully resolved, and that “we believe in sharing what happened, why it happened, and how we’re preventing it from happening again.”)
Earlier this month, Vanta also acquired Israel-based startup Riskey for an undisclosed sum to help with continuous, AI-driven risk monitoring (rather than taking snapshots of a company’s compliance status at static points in time). Cacioppo says Vanta wants to acquire companies with adjacent products that add to Vanta’s existing offerings, and that the new funding will allow it to make more acquisitions if the right opportunities arise. “In a long view of technology history, the most sustainable companies are multi-product earlier in their journey,” Cacioppo says. “There is often a core product or use case, but there are just many useful things around it. That’s how we think about it as well.”
Vanta’s long-term goal, says Cacioppo, is to become an “enduring sustainable company,” and pretty much all of those “become public companies at some point.” It’s part of why Wellington—a $1 trillion asset manager with some 3,000 people focused solely on public markets, per Witheiler—led Vanta’s latest funding round. “Our strategy is to find the next generation of public companies in the private market, and then partner with those companies to help them become great public companies,” Witheiler says. “Definitionally everything in our portfolio, including Vanta, are companies that we believe can and will be long-term public companies.”
