How AI Is Repricing Every Software Company
In a Nutshell
Vanta's CEO argues that AI is fundamentally breaking traditional SaaS pricing models, as token-based pricing forces companies into direct competition with models like Claude, and customers can easily compare costs across providers. The company is absorbing AI token costs rather than passing them to users to prioritize agent usability, while betting their massive security data lake will let them build superior security/compliance agents that do the work autonomously instead of just monitoring and alerting. The biggest structural challenge is talent competition from AI labs and companies offering massive valuations, requiring Vanta to focus on authentic mission-driven culture and realistic compensation discussions rather than promising unrealistic outcomes.
These notes were generated by AI and may contain inaccuracies.
Customers are quick to compare token pricing across providers, stating "You've raised the price of a Cloud token to X. Are you as good against X as Claude?" Token pricing creates competitive positioning against the models themselves. If companies try to raise prices, users are very savvy and will lose in that comparison.
Christina founded Vanta eight years ago with the premise of helping companies build and earn trust through security and compliance programs. The company started by helping businesses implement security solutions for audits including SOC 2, ISO 27001, and HIPAA. Initially focused on compliance and auditing, the core idea was building a security company by helping businesses implement security solutions because that's what their customers were asking for. The company became known for SOC 2 certification and has since expanded into different security areas.
Today, Vanta has around 16,000 customers worldwide and about five products.
Vanta emerged as a major winner in a new field where many companies were attempting similar approaches. The success is attributed to execution. Software is much more visible now than it was five years ago, with companies measured by their most recent product launch. Since anyone can program a product in a weekend, companies must constantly launch new products and features that improve customer experience.
The most important investment was in integration, connecting Vanta to 400 tools to extract massive amounts of data. This data powers automation, agents, and AI through what they call the Trust Scheme - a security data lake that is bigger and more comprehensive than any other provider, covering areas other security providers don't cover. This database has allowed them to build new things faster.
Product marketing includes creating good ads that went viral on r/accounting, including tax-compliant content that members liked. The real-world experience requires pushing harder than what feels like going as fast as possible.
Vanta is a fast-growing company with very high profit margins - considered the best business model four years ago. Growth is even faster now with still very high profit margins. However, the market has decided that the price-to-earnings ratio is a third or a quarter of what it used to be.
This creates cognitive dissonance - over time, a company with 80% growth and 80% profit margin will generate more cash flow than a company with 160% growth and 30% profit margin, yet the latter is valued at three, four, or ten times more. There's a sense that everyone is acting irrationally.
Investors are AI enthusiasts, with some talking about investing in labs or tractors in Iowa, but nothing in between. From a talent perspective, ambitious people want to get things done and will change course if they feel they're not in the right place. There's pressure to avoid being just a "bent spoon" - nobody wants to be left behind.
Vanta is positioned as a leader in security and compliance agents. The company compares their agent products to AI applications and hasn't found anyone ahead of them yet. The agents do most of the work, are conversation-based, and work for extended periods. An agent automatically creates the user interface during operation, building the UI and allowing users to return to the interaction path.
The agent acts as a watchdog constantly monitoring security compliance programs. Instead of just monitoring and alerting, the Vanta product experience presents users with completed actions: "Hi, I did this for you. Are you happy with it?" For example, when someone leaves a company without revoking access, the agent writes a custom program to handle it, asking "Do you want me to activate it?" and "Do you want it to be running all the time?"
Vanta is covering the cost of tokens and taking a smaller profit margin rather than passing costs to users. They focus on usability because the agent experience is considered a much better user experience. Currently, approximately 25% of customers use this type of flow. If this percentage could reach 75%, they would achieve better net retention rates and customer experience.
Vanta started focusing on evaluations at the beginning, including task-specific or agent-specific evaluations. Behind the scenes, there are hundreds of agents, each with specific tasks. At the beginning of the year, they invested in using specialist experts who have run security and compliance programs to write email frameworks.
When switching models, quality is prioritized over cost. Vanta doesn't use as many tokens as programming agents, focusing on decision-making and actions rather than programming, allowing focus on quality rather than cost.
Everyone wants to achieve results pricing where incentives are aligned, but determining results is difficult. There's a distinction between result and output - closing a support ticket is an output, while the result is the Sonos device working. Many companies including Anthropic are trying to find clear, agreed-upon units of work like draft documents, alerts being closed, or accounts being canceled. Token pricing puts companies in competition with Claude, and users are smart enough to see through hidden token-based systems.
Vanta has an 8-year-old database, making it easier to use programming agents with smaller databases. They've invested time in splitting the database into units so agents can understand smaller parts. Without this, agents lack context and do illogical things, requiring experienced engineers to monitor, which defeats some benefits.
On a scale of 1-10 for how much AI will affect company structure, the rating is 9. The basic principles remain the same - everything is difficult, people are important, methods are still methods - but the way of working should be completely different.
There's a split between companies that have gotten the message about AI and are performing well versus those on the verge of bankruptcy. Markets have structural parts, and this AI technology shift has made some markets that looked very good look very bad. Even the best person in the world might run into a solid wall in certain markets.
The most important thing to implement is getting people to use AI themselves - not just building it for the company. Understanding model positions, strengths, weaknesses, and what "hedging" means requires updates at least every two weeks since things change rapidly. Involving as many people as possible is crucial.
The perspective on talent has become more empathetic. Strong people don't rush things, requiring more encouragement and understanding of what hinders them. People may find themselves in trouble even if they didn't delve deeply at first.
For small businesses, Vanta has controls suitable for adoption with minor adjustments. For larger companies running compliance programs, the value comes from seeing data, automation, monitoring, and instant dashboards without Jira ticketing.
The traditional SaaS approach uses setup wizards with four steps and progress bars. After resistance to change, they implemented a learning management system approach similar to a big whiteboard where users drag in messy files and screenshots, the system sorts them out, asks questions, and gets users ready to go.
The obstacle was that teams didn't believe the LLM flow would work and defaulted to familiar setup wizards. They were told to bet that the LLM flow would work and do anything to make it work.
When discussing offers with candidates, the question of whether to mention a minimum of fifty billion dollars for Fanta comes up. The real question should be whether joining can take the company to two hundred fifty billion dollars. The answer is probably no, but definitely not no. Other companies offer that valuation to Fanta employees. Rather than contradicting candidates by calling competitors bad, the market itself is saying that valuation. If you don't aim high, you look unambitious.
Fanta's fundamental principle is keeping promises—doing what you say you will do. You can put the ambitious logo on the box, but that's not the case. Don't promise too much and don't deliver on your promises. The approach is to explain some of what the company does, good, bad, and average, and also provide context. Key performance indicators are shared with candidates, showing everything. If candidates don't reveal information, it's not wanted, but if they do, it's not so bad. Through this process, the company's development over time is linked to facts and data. It's more like balancing negative emotions with reliable data and feelings.
When the most talented person is told the company will be worth a trillion dollars, almost all other companies try to hire them. The best offer from competitors might be: "We're worth six billion today, but Sequoia will write a ten billion dollar check in a month, and then someone will raise the valuation to twenty-five billion next year, but we can hire you today for six billion." When faced with this situation, the approach is to go up to the person and ask what they're trying to achieve and why they thought of this, but not in an adversarial way. Instead, ask what bothers them about Fanta.
A strong leader at Vanta felt they could not make decisions that would put Vanta on the preferred path, but a new place promised complete authority to make decisions about that path. The response was that these are perfectly logical observations. The question becomes what is needed to feel capable of making these decisions. They simply made those decisions.
Five years ago, a person was earning a certain amount, and now the multiplier of that amount they're earning is ten times in total compensation. The philosophy is to pay top employees enough, and always maintain that clarity. There will never be perfection. There's a group of people paid far more than their contribution warrants.
Top employees have the ability to get things done very efficiently, which might sound trivial but is worth millions of dollars. They have deep understanding of the company, customers, and industry, and generally make sensible decisions. Sometimes bad experiences, then improving and moving on, are very important.
The rate at which the most valuable people increase in value is accelerating. The other side of the coin is when investors will start worrying about equity dilution and stock-based compensation. They weren't concerned about it for the last decade or the late last decade. A broader discussion about stock-based compensation in the industry started in 2022 and 2023. Without pressure about dilution, people would be paid higher and higher, which is probably what they should be paid.
Historically, valuation hasn't been cared about. Things have been done that show not caring about it, and that's been both good and bad. Recurring annual revenue and its growth are cared about and paid a lot of attention to. Through many valuation environments like 2010, 2021, and 2022, sharp swings in these metrics weren't paid much attention to before. What really interests is how people at Fanta feel—whether they feel they're in a company that's constantly growing, growing overall, and growing relative to their other opportunities in the market.
There's a segment of the market raising money every six months at five times the previous valuation, and that's real competition for talent. Tenders haven't been done historically, but it's the game if making a bid every time. The opinion is that this is unhealthy, but opinions on buyouts aren't being taken into account. Buyouts have become normalized, and people expect them as part of their compensation, and if not given, something else must be given to compensate.
This doesn't have bearing on exit ambitions like going public, selling the company, or achieving Fanta's ultimate goal. It's what's known as the founder's privilege statement, but it's primarily about the ultimate goal—how long can this continue. Ninety-nine percent of large independent software companies in the US are publicly traded, so an IPO in that sense isn't on the wish list. It's more of a means to an end. A lot of people join companies with that goal in mind, so the founder's privilege statement has to be considered. The goal is to build a large, independent company.
Too much attention is given to the company and customers compared to knowing the skills. It's still difficult to train, recruit, onboard, and prepare employees to become effective people who join the company. The company is trying to improve and streamline that process, to make information more accessible, but there's still significant value in someone who has worked for a company, knows how to operate it, and knows customers. A few years ago, people valued these skills and proficiency in them more than specialized skills like being good at sales or customer service. A salesperson who was less proficient in sales but knew the basics of Fanta would be accepted. Especially with so many fast-growing AI labs and companies building marketing teams, they're evaluating candidates as good salespeople, which is a miscalculation.
When thinking about building agents, company context and customer context are probably undervalued, and it's simply said that someone is a good salesperson. That skill is less valued today than it was four years ago. Token-based pricing and low profit margins just for the sake of low profit margins are over-promoted. Custom-trained models for marketing value—to be able to say a model was pre-trained on products—has no reason to be over-promoted. If talking to ultimate inference providers with the serum of truth, they'd say the reason for training the model later on is cost, and some companies might need it, but there's no intrinsic reason to do it. There's a marketing reason to do it now under these circumstances. There's a huge benefit to post-training for marketing reasons, for investors and customers. In fact, it's the most important thing for investors.
If companies offer post-training value, they'd say you prove yourself as a real AI company, and that's something customers and investors will notice. That's the main reason. A secondary reason in some use cases is form factor, especially true for large organizations where deploying software at scale requires integrations and approvals from seventeen people, which is very complicated. Offering a customized model for their situation is presented as an alternative.
After training specifically means needing a large amount of data from this particular client, writing a set of evaluation models, and then adjusting the model weights based on their data. The process is that they're trying to achieve a goal, have some data, so the model is adjusted to achieve that goal to increase the evaluation. Then it's sold to them on an ongoing basis. This is overkill because it doesn't actually improve their performance. It might improve it, but there's skepticism about whether everyone really wants a ready-made model. There are a lot of things involved from a user experience perspective, from a publishing perspective, and in terms of appearance. It's like what happened with social media or mobile apps when the pull-to-refresh mechanism hadn't been figured out yet. There's a version of that here. Modeling isn't the right and sensible iteration, but it's not the ideal solution either.
Full-time employees are kind of crazy. It's more like exploiting talent differences. Just like with the chief of staff, full-time employees are often professional services. Calling that role professional services is very different from the concept of full-time employee in the current mainstream discourse. A Harvard computer science graduate, highly skilled and wanting to build a business, wouldn't join a company as a professional services employee, even if they're number four or twelve. There are real job opportunities in that space, but the concept of full-time employee isn't going to last. Palantir has multi-million dollar contracts, and other companies have multi-million dollar contracts, but full-time employees are used. Complete in a business environment that relies on multi-million dollar contracts. Perhaps that equation is economically unfair. We're in an era of thirty percent growth, which is working, but it doesn't seem sustainable.
At dinners in San Francisco with other founders, heated discussions about talent occur. About nine months ago, it was fun to sit around the table and complain about Cursor and how it was poaching everyone. That's definitely the current topic of discussion with Cursor. Questions include whether you're really doing this, is it working, what's your current position in that regard. Personal recruiters are discussed—which ones are had, which ones are really useful.
When talking to people around the world having the same questions about open-source software and Chinese models, clients in France were met with a couple of weeks ago. Many French software companies in Paris rely mainly on Chinese models. At first, it was thought to be some kind of nationalism or anti-Americanism, but that was naively suggested and quickly corrected. Absolutely not. Almost all turned to Chinese models when Trump shut down the Fable platform to non-Americans. There was a significant risk to the continuity of the business realized. Building a business on one of these American models cannot guarantee its continuity, so that stopped.
If imagining the company's future over the next few years and forced to answer a question worth one hundred billion or two hundred fifty billion dollars, Vanta would be considered a security company. It started with compliance, but the best form of compliance is demonstrating the level of security. Up-to-date security has to be had. Vanta can do that and is already moving into many areas of security. It's more like a platform that presents itself as having the data and intelligence through this program, and additional products can start being built on top of them. More security-focused products are being developed. As the security of these companies is understood, the pressure on them to prove their legitimacy and industrial competence will increase. This was one of Vanta's core assumptions eight years ago, but it's even more apparent now. Whether working with corporations, governments, regulators, or legislators, they have to prove their software is of industrial quality in many ways, and this will only become more important in the future. Vanta bridges these two sides, or what might be called the marketplace.
The direction of security is a very interesting topic. Just like the internet in its early days, everything has been hacked, maybe ten times or a hundred times more. Security means competing with companies like CrowdStrike. These models are more persistent than humans. They try an enormous number of times, just as a human gives up after about nine thousand attempts. In the process, these models discover vulnerabilities and piece them together. A big part of the discussion revolves around zero-day vulnerabilities. There are indeed some vulnerabilities these models uncover that haven't been discovered or even announced before. More importantly, these models are capable of linking seventeen seemingly benign vulnerabilities together and then uncovering genuine ones. As seen in OpenAI's presentation at the RSA conference about Hugging Face, it's very similar. It's like persevering and accumulating things that people would otherwise say on their own: this is a minor issue, I'll fix it in ninety days. Anyway, this update, which is difficult, has to be competed with machines because it takes away what used to be said about this being an important but minor problem. And again, ninety days, and these other things will be fixed first. It simply turns priorities upside down. Saying that it makes everything critical isn't helpful, because then the question is what to do then. The bottom line is that things have to be fixed as quickly as possible. Some priorities have to be let go. But if fixing things at machine speed, prioritization isn't needed. That's where it will end up, but it's going to be bumpy. When imagining it, it feels like a continuous penetration test, where a customer is constantly trying to break into the system, just like an ethical hacker. And every time they discover a vulnerability, they have a helper customer to fix it. That is the end-user vision for the product for some aspects of Vanta. It can be done in very efficient ways. But for most customers, CrowdStrike will be a better service for enterprises. Choosing the right business space and market segment is the most important thing here.
There's a company currently operating in a space being looked to compete with. Traditional security companies are marketing penetration testing and vulnerability fixing services. Vanta thinks it can do that for cloud providers like AWS and Azure, like addressing their misconfigurations. Wiz does that for its customers. Wiz's customer base starts with companies that have thousands of employees, and its pricing starts with companies that have thousands of employees. More about the platform is thought in terms of current presence with customers. Where are they unlikely to pay one hundred fifty thousand dollars for Wiz, but are likely to pay forty or fifty dollars for something that suits them. Current strengths are thought about, and where competitors are focusing on other areas, but perhaps on a higher-end market segment.
Personal motivation has changed since starting to build this thing. First talking about that magical way the original product was built, like building Excel first, and it seems so old when looking back on it now. There's always something like the story of the dog that grabbed the car. Building such a huge software company is amazing. Motivations have evolved over all of this. Why keep going? It's interesting and challenging, and it's constantly changing. Really loving the job. Sometimes feeling good at it, and often feeling bad at it. That's okay, it's not what matters. But it changes and varies, and when feeling like getting good at it, something usually happens that makes the feeling change, and then feeling bad at it again, and liking that dynamic. At the beginning, there was a greater sense that people thought it couldn't be done, and thinking it could be done, and going to prove it to them. Still feeling that way, even when they say don't think Fanta will be worth two hundred fifty billion, let me prove it to you. Still holding onto it, but the dark side of it has softened. There's still some dark side, but it's less obvious. It's more like saying wow, we have arrived here. Now we will see how far we can go in a way that looks more fun and joyful. It was done. It's not always fun, but it seems that way. It's like saying wow, let's see how far we can go with this. And thinking we can go further. Whereas at the beginning, it was saying don't you think I can start from the starting line, let me show you.
How surprised would be if eight years old about a particular skill developed in the way described. The one skill mastered now that would have been completely rejected if that age. Market entry strategy is liked even more than expected. It's about talking to friendly, kind people all the time. Being a terrible public speaker. Getting very nervous in front of the team because caring too much about what they thought. Saying oh my God, I represent you. Wanting to perform this job to the best of ability. Exposure therapy has been helpful in this regard. One might say just do it and you'll get better at it. But the idea of being at a corporate opening or general meeting in front of a thousand people on a stage would make saying oh my God, I'm going to be terrible at that. And thinking the people around would say yes, you're going to be terrible at that. Perhaps how much training can be gotten. It's like anything else. If working hard at a skill, getting better at it. Just have to put in the effort. But very interested in one particular skill. It always seems to have a huge impact. What matters is that hundreds of these things have been delivered. What makes someone good? Like the old saying nobody remembers what you say, but they remember how you feel. It's so annoying, but it's absolutely true. For at least, having to believe in the content, and if just standing up and saying just content, it feels like it has no substance. Feeling it, and it'll be obvious to everyone. So having to come up with your own version of it. Personally trying to add real content, and then keeping in mind that nobody is going to remember any of that factual stuff. So the heart is more important than the head, or something like that. The key to a good heart is believing in it yourself. Authenticity. Face to face, on a stage, people are great at reading each other. And when sensing that the person being talked to is just reciting mechanically, or doesn't really feel it, or is misleading, then maybe he's also fooling himself. People can tell. They can't quite put their minds to it, but something feels off. Unlike someone who's genuinely immersed in it. Even if it feels strange, it feels obvious.
The biggest challenges being faced right now. Can't do everything, have to make decisions, the stakes are higher than ever, and building is easier than ever. It sounds like a great time to be doing what is being done, but there must be some big challenges. One of the conversations had and still having is that
Over the last year, the company has been building in an agent-centric way. The word "agent" simply means AI, though there's marketing value in using the term. They tried to build a great system for clients without building traditional SaaS user interfaces. For example, instead of including Tableau within Vanta as they would have in 2021-2022, their agent prepares graphs upon request based on all their data.
Large American companies have responded to AI features with requests to "pause them" because it's much easier to get a non-AI tool through purchasing departments. These companies want the tool but want it activated after the deal is completed. The company refuses to build an "off button" for AI features, prioritizing investment in building useful capabilities instead.
The investor role is not enviable due to the fear of missing out on opportunities and returns. There's criticism of the investor side, where venture capitalists evaluate based more on incremental and theoretical returns than on the companies themselves. The discourse around open-source model providers and their surrounding tools seems detached from reality, with less developed ecosystems than those around large labs.
Cybersecurity companies are seeing higher percentages than others, with many starting due to current circumstances. Revenue technologies and market access technologies make sense as focus areas. Older SaaS revenue technology providers should have developed these technologies but are instead following strategies similar to private equity approaches. Robotics is a popular and exciting field that may not receive enough attention, though it's marginalized compared to software despite significant model evolution.
Over the past two years, Vanta has spent more time with governments at federal, state, and local levels both within and outside the United States. There's a desire for modernization that's a declared priority for the current US administration. AI has created greater fear of missed opportunities among government officials, making modernization more urgent than ever.
Cybersecurity-related issues show information security managers' jobs changing because of AI. They're restructuring risk management programs and allocating budgets for AI risks, something that would have been dismissed three years ago with comments about natural language processing. The connection to AI makes budget approval more likely today.
Vanta has 16,000 customers using a product with agents. When products launch, real people use them and provide immediate feedback. The product is suitable for the market, allowing experimentation and testing with rapid development cycles while still being early enough to move.
The founder was skeptical of billboards due to poor tracking and the perception of founder's vanity. At the 2021 SaaStr conference, the marketing team decided to try outdoor advertising. Sarah, the product manager, suggested a compliance solution that wasn't too bad. The head of marketing initially rejected it, but Sarah went directly to the founder who laughed and emailed Andrew and investor Reed, who approved the idea.
The billboard was placed near Burlingame. The tweet went viral and remained popular for two months, becoming part of their social media accounts. The campaign represented the brand at its best - taking work seriously but not taking themselves too seriously. It resonated because it was distinctive with a touch of fun and created a feeling of having a secret.
They got a great spot at the intersection of Highways 101 and 280 for a relatively small amount. The contract was simply "You put up the billboard" - essentially a request for proposals. Sarah learned from a friend that another company had taken their location. When the founder tried to negotiate, offering to double or triple the payment, the other company refused, stating they were achieving positive cash flow.
Losing the billboard felt like a bad omen coinciding with market value decreases. The founder described being an inflexible buyer and seller in the negotiation, ultimately losing the prime location.
There's decreasing trust in software and technology companies year after year, making it difficult to imagine returning to the useful optimism of 15 years ago. Proving companies' trustworthiness, industrial competence, and safety through actual metrics has become more important than ever. Vanta, valued at $250 billion, serves as a central hub helping companies meet high standards and deliver trust messages to accelerate business growth.
In B2B transactions, there's both an emotional aspect and a real data aspect. The preference is for specific improvement curves or promises backed by contracts, which is more logical and rational in institutional markets. Consumer markets are more about feelings, which are harder to change.
In five years, the security situation will be faster, more intense, and more aggressive with more attacks expected. More ethical hackers will be needed to counter threats. The goal is to reach unprecedented speed, helping humans reach this speed while reducing human decision-making. Humans will design systems and write rules but won't make every decision - the role will be reduced to writing reviews.
The word chosen to describe Vanta's next five years is "expansive." With a huge customer base and data, the company will build on this foundation for the next five to eight years, having already accomplished what seemed great five years ago.
Keep Invest Like The Best in your library
Save the videos and channels worth coming back to, and find them again in one place.
