Invest Like the Best with Patrick O'Shaughnessy
00:31:12 · Patrick O'Shaughnessy, Christina Cacioppo
[00:31:12] S0: Is there anything else like in the popular discourse that you think is crazy? FTEs? [00:31:15] S1: I kind of think FTEs are crazy. I think it's a great talent arbitrage, the same way like chief of staff is. What FTE often is, is professional services. But I think if you call it a professional services role, that's a very different talent profile than FTE in the current discourse. And I think you're not going to get the Harvard CS grad who's high agency and wants to go do things and learn how to build a business to go sign up to be like, pro serve person number four or number 12 at a company. I think there's a real job there. But I think this FDE wrapping around it is probably not going to stay. The company that we all think does as well is Palantir, which I think they probably do. They have 8 figure contracts. There are some companies that have 8 figure contracts. I think we're using a FDE. It's in a place where there's like 5 and 6 figure contracts. And those economics probably are upside down. We're in an, again, era of 30% growth margin better and so that sort of works. That doesn't feel sustainable. [00:32:17] S0: When you're at like a dinner in San Francisco with other founders, what are you talking about? Are you talking about models and which ones to use? What are the actual topics of conversation between founders right now?
00:32:17 · Patrick O'Shaughnessy, Christina Cacioppo
[00:32:17] S0: When you're at like a dinner in San Francisco with other founders, what are you talking about? Are you talking about models and which ones to use? What are the actual topics of conversation between founders right now? [00:32:29] S1: There's definitely like talent war pieces. There is a time, this is more nine months ago, but it was the joy to go around the table and complain about cursor. They're taking of everyone. There's definitely that piece. There is a bit of an... I'll take F to E's of do you actually do this? Is it working? Where are you on this? Right now, personal agents. Which ones do you have? What are actually useful? [00:32:51] S0: When you think about the open source stuff, Chinese models, this, that and the other, what have you learned talking to people around the world that are grappling with these same questions? [00:33:02] S1: I was with our customers in France a couple weeks ago, which was lovely. One of the things that was very thirsty, a lot of the French software companies in Paris are using Chinese models predominantly. I initially thought it was nationalism, maybe anti America, you know, just something there. And stupidly suggested that. And someone very quickly corrected me and said, absolutely not. We basically all switched to Chinese models when Trump closed Fable off to non Americans. And we just kind of realized there's a huge business continuity risk. We can't trust that if we build a business on one of these American models, they'll always be available. So we stopped doing that.
00:33:02 · Christina Cacioppo, Patrick O'Shaughnessy
[00:33:02] S1: I was with our customers in France a couple weeks ago, which was lovely. One of the things that was very thirsty, a lot of the French software companies in Paris are using Chinese models predominantly. I initially thought it was nationalism, maybe anti America, you know, just something there. And stupidly suggested that. And someone very quickly corrected me and said, absolutely not. We basically all switched to Chinese models when Trump closed Fable off to non Americans. And we just kind of realized there's a huge business continuity risk. We can't trust that if we build a business on one of these American models, they'll always be available. So we stopped doing that. [00:33:39] S0: If you dream the most about where the business could go over the next several years, what's the version of Vanta that could look like that?
00:33:39 · Patrick O'Shaughnessy, Christina Cacioppo
[00:33:39] S0: If you dream the most about where the business could go over the next several years, what's the version of Vanta that could look like that? [00:33:48] S1: We think of Vanta as a security company. Started with compliance. The best version of compliance is proving the security you have. You've got to have good security. We think we can and are moving into a bunch of security domains. It's sort of a platform pitch of like, look, we've already got the data. We've already got the intelligence via the agent. We can start stacking products on top of that. And more security focused products. As we understand the security of all these companies, the pressure on them to go prove they're legitimate and industrial grade is just going to go up. That's one of the founding thesis of anti- or to go. But it feels even more true now. Whether they're working with enterprises, governments, regulators, lawmakers. You just have to prove your software is industrial grade in lots of ways. And that will happen more and more and more and more ways in the future. And Vanta is the thing that connects both sides of that marketplace. [00:34:51] S0: So what's the direction of security? This is, of course, an incredibly interesting topic. Early internet, everything broke, everything got hacked. This will probably be that times 10 or times a 100. Does security mean you compete with CrowdStrike and places like that? What does security mean and what's its trajectory in this crazy era?
00:35:09 · Christina Cacioppo
[00:35:09] S1: These models just are so much more persistent than people. They will just try nine quadrillion things the way a person would give up after, I don't know, 9,000. And then in the course of that, they find things and chain things together. A lot of the discourse is around zero days. And there's definitely some of that these models are finding that we didn't find or didn't publicly find before. I think what's more so happening is these models are able to chain 17 benign ish or benign on their own things together. And then really find something. If you watch the OpenAI talk at RSA about hugging face, it's basically that. Persistence, putting together things that on their own, people would have been like, that's low severity. I'll fix it in ninety days. But that update, which I think is tough and we have to fight with machines because it takes what was, oh, that's important but low severity and again, ninety days. And like, I'm going fix this other stuff first. It just turns a prioritization on its head. And saying it makes everything critical isn't helpful because you're like, well, what do you do then? But I think what that ends up looking like is you've just got to fix stuff as fast as you find it. And some of the prioritization does need to go out the window. But if you're fixing things at machine speed, you don't have to prioritize. So that's what I think we're gonna get to, but I think it'll be rocky as we get there.
00:36:31 · Patrick O'Shaughnessy, Christina Cacioppo
[00:36:31] S0: So as I visualize that, what that feels like to me is a constant penetration test. Yes. Where an agent is trying to break in like a white hack hacker agent all And the then every time they find something, it's got a buddy agent that's a patch of... [00:36:44] S1: Let's fix it. Yeah. [00:36:45] S0: Is that like the ultimate product vision then? [00:36:48] S1: For some parts of Vanta, yes. I think we can do that in very compelling ways for the bulk of our customers. I think CrowdStrike will do it better for an enterprise. This is where choosing where you play and what market segment is most important there. [00:37:03] S0: Is there a firm that's doing something now that you start to encroach on? Like of the traditional security... In [00:37:08] S1: different markets... Mean, a ongoing penetration tester and remediator fixer. We think we can do that for the cloud providers, like in AWS and Azure, like misconfigurations there. Classically, Wizz does that. Wizz will do it for its customers. Wizz's customer base starts at a multi thousand person company. And their price point count starts at a multi thousand person company. We're more thinking about the platform as where are we already embedded with customers? Where are they unlikely to go pay $150,000 for a whiz, but very well could pay 40 or 50 for something suited to them. Thinking through where are we already strong and where are the competitors focused elsewhere, but probably on a more upmarket segment. How has your