Building to $10M ARR Without Raising a Series A

Hi, I’m Christina Cacioppo, cofounder and CEO of Vanta. Vanta helps startups get secure and then get through compliance audits like SOC 2, HIPAA, and ISO 27001 in weeks, not months.

The idea for Vanta came, like so many do, out of personal experience. Before Vanta, I led the PM team at Dropbox Paper. We were trying to act like a startup: moving fast, breaking things, and getting Paper to market for the very first time. We were really enthusiastic, and we were convinced we were going to be bigger than Dropbox if we could only get the product to market.

Our go-to-market plan was pretty simple: go get all the Dropbox users. We were just about ready to do that when we ran into a really big roadblock.

In our efforts to move fast, we realized we hadn’t actually adhered to Dropbox’s security commitments, and part of that was that we didn’t have a SOC 2. So we had to stop.

It was going to take about a year of our team’s time to fully meet those security commitments and get that SOC 2.

This was all happening around the time of a slew of high-profile data breaches. If you remember back to 2016, there was the election, when everyone’s emails were everywhere, and Equifax, when everyone’s Social Security numbers were everywhere. It was becoming clear that security wasn’t something you could put off until you were a big, high-profile target. It was something you had to do from the start, particularly to go to market.

So in 2018, I cofounded Vanta with the idea that we could get startups to start on security early and build secure products from the beginning. We also realized that if they did, we could help them unlock new deals, move upmarket, and ultimately compete on a more level playing field with big incumbents.

By the end of 2020, we’d almost hit $10 million in ARR and helped over a thousand companies, mostly startups, secure themselves. We hit that milestone without raising a Series A, just on our seed round. We felt a pull from the market and saw a huge opportunity in front of us. What we were doing, and our approach to the market, seemed to be resonating.

So in May 2021, we decided to raise our Series A and first round of institutional funding: a $50 million round from Sequoia.

The decision to wait until we’d passed $10 million in ARR to raise our first venture round didn’t happen by accident. But if I’m being honest, it wasn’t our original plan, either. When Vanta left Y Combinator’s Winter 2018 batch in March 2018, we were going to follow the standard startup plan: a Series A at $1–2 million in revenue, a Series B at $10 million, and so on. We left the batch feeling really good. We’d hit our revenue milestones and raised a seed round, and we were so confident that we paused all sales so we could hire our first engineers.

We kept feeling good for a few months, and we did hire those engineers. But about nine months later, a YC partner pulled me into his office and told me we were way off track. Most of our batchmates had kept building their businesses, somehow recruited at the same time, hit a million dollars in ARR, and were driving up and down Sand Hill Road. We hadn’t. We were nine months out, and we were behind.

I left that partner’s office really freaked out, probably appropriately so. But I was resolute about one thing: I didn’t want to pitch Vanta then, without the full confidence it deserved. We’d stop thinking about fundraising and concentrate on building the business. So that’s what we did.

In particular, instead of building slides…

…I spent my time on three other things. First, talking to customers: trying to explain Vanta in my own words, seeing what they said back to me, and then rinsing and repeating with the next call. Second, selling the product. At the end of some of those conversations, someone would ask me for an order form, and I’d think, oh right, that’s why we’re talking, and send it over. And third, growing my own conviction that we were solving the right problem with the right approach.

About six months later, we did hit that magical million dollars in ARR, and we revisited fundraising. We were back on track and felt good. I went back to that partner, and he said, “Yeah, I kind of knew you’d be fine. I was trying to scare you.” Which was very effective. Thank you, Aaron.

But by the time we revisited fundraising, we were operating at basically cash-flow breakeven. We didn’t need to raise. We felt clear-eyed about the opportunity in front of us, and we figured we could spend that time building a slide deck, or we could keep building the business and see how far it would take us.

I want to pause for a moment and say this isn’t a talk about not raising money, or about how venture is bad. If you walk away thinking Christina hates VCs, that’s not true. I started my career at an early-stage venture firm, Union Square Ventures in New York, which has great partners I respect tremendously. And we now have a really great long-term partner in Sequoia.

But waiting to raise did have a lot of benefits for Vanta.

First, we had to rely on organic word of mouth to acquire customers. We literally didn’t have the bank account to spend on paid marketing, and that ended up being a really good litmus test for product-market fit.

Second, we had to be disciplined about spending and instill that discipline across the company. We put the bank balance in front of everyone every week, just so we all knew how much we had, and that on its own created a lot of discipline.

And third, it forced us to think about whether we had a good business, and whether we liked our business, not whether some VC liked what we were doing.

I’m a huge believer in this approach, and today I’d like to share four lessons I’ve learned over the past few years of building Vanta. I hope they’re helpful whether you’re building an IPO-ready company or a proper cash-flow-positive business.

Lesson number one: the market always wins. Also known as: build something people want.

If you’re starting a startup, or thinking about it, you probably have a pretty good intuition that people want what you’re building. But it’s really helpful to validate that, ideally before you write code or start building.

For me, this was really important, because over the decade before Vanta I wrote a lot of code for products absolutely no one wanted. It felt good at the time, and I felt super productive, but slamming into the reality of no one wanting the thing, over and over again, was not so fun.

For Vanta, the way we validated that we might have something people wanted was, at first, just talking to other founders.

We talked to them about security broadly. It started with questions like, what does security mean to you? What do you do about it at your company? Through those conversations, we realized there are two reasons people buy security products.

The first is to close a customer. Founders were spending a lot of their time answering customer questions, filling out security questionnaires, and getting on the phone to convince bigger companies (which, early on, is definitionally everyone) to buy their product. And if you’re going after a big customer, if you want to sell to Google or Facebook or Slack and they tell you to jump 12 feet in the air, you’ll jump 13. You’ll do anything to get that deal over the line.

The second is that security falls into a low-knowledge, high-anxiety gap that can be really pernicious. People are worried about it, rightfully so, but don’t know what to do. Some of the CEOs and CTOs we talked to spent time and money on expensive security consultants who would write their policies, tell them what to do, and get on the phone with prospects. Sometimes that helped and sometimes it didn’t, but it was always expensive. Many more just didn’t do anything. They lost sleep and worried: Should I be doing something about security? When do I start? What should I do?

These conversations convinced us there was a real market need. The next question was what to do about it. We had more conversations, and we realized SOC 2 was the Common App for security.

If you remember the Common App from applying to college, it was one form every school understood and accepted. SOC 2 worked the same way with enterprises. In theory, if a company could just get a SOC 2, it could apply to all the colleges, which meant selling to anyone. So we figured that if we could make SOC 2 compliance easier and more accessible for small companies, we’d have a lot of very willing users and customers.

But we wanted to make sure we actually understood what a SOC 2 was before we started writing code to automate it, whatever that would end up meaning.

We got lucky again. Friends at Segment were about to start thinking about compliance for the very first time. They didn’t have anyone on the team assigned to it and didn’t really know what to do. It was one of those nebulous “as we go upmarket, we’ll figure out what this means” things.

So they graciously gave us desks in their office for a few weeks. They’d just moved into a new office, and it was comically large: the Segment team was in about 20% of it, and we were in the other 80%, with all the free snacks. We sat there, ate a lot of chocolate-covered pretzels, and read SOC 2 reports. I probably read two dozen of them that first week. Then we talked it through with Segment and worked it out.

What came out of that exercise is literally this spreadsheet. This was Vanta v0: a list of everything we thought Segment needed to do for a SOC 2, a red-yellow-green status for each item, and scores.

We handed it to Segment and asked them three questions. If you’re prototyping something, I’d encourage you to ask them too.

First: What did I give you? What is this thing?

Second: Would you use it?

And third: How much would you pay for it?

Ask your early customers or users these three questions. If they can’t answer them, especially the first two, go back and keep iterating.

At this point our product was just a color-coded spreadsheet, but we felt like we were on the right track. We’d figured out that we could engineer-ify a SOC 2: take a lot of jargon and break it down into component pieces (we called them tests) that could be coded, automated, and checked continuously. People understood it. Segment said, yes, we get it, and we’d use this. And they’d pay for it, because the security and compliance problems they felt were so acute.

So that’s the first lesson: build something people want. No matter how much money you raise, you can’t raise your way into product-market fit.

It’s actually harder. If you’ve raised a little, you have to pivot quickly before you run out of money. If you’ve raised a lot, you have to pivot and then go back to everyone you pitched your grand vision to and say, “Just kidding, here’s vision number two.” Either way, raising doesn’t help.

So as you think about building things, validate your ideas before you start building them, before you write a line of code if possible.

Lesson number two: charging annually up front makes everything better. Once you’ve confirmed you’re building something people want, the next most important thing in scaling is go-to-market: how you find customers, how you sell to them, and what happens after the contract is signed. One lesson I’ve learned at Vanta is that, if you can, charging annually up front makes everything else a little easier.

We didn’t start out this way. When we first started selling Vanta, we offered two options: annual and monthly. Partly, we wanted to give people options. Buy how you want; we don’t even know if our product is that useful, so let’s not make it harder for you to give us money. And partly, honestly, we’d looked at a bunch of other SaaS pricing pages, saw that everyone offered monthly and annual, and figured we should too.

It seemed to work, well enough that I convinced our first AE, our first salesperson, to join. And he immediately stopped offering the month-to-month option. Annual or bust. I was pretty shocked and pretty scared, and I asked him what he was doing. He said, look:

“You’re creating security automation as a category for startups, and you’re convincing them very early, at the founders-on-a-couch stage, that they need to spend money on it. That’s hard enough. Then you’re creating all this other uncertainty about how to buy: which option is right, how do I decide, answer these seven questions.”

We’d built a product meant to relieve anxiety in one domain, and then created a bunch of new anxiety about how to buy it and how to use it.

So we kept quoting only annual pricing. We bit our tongues and sat on our hands to see what would happen. And deals started to close faster. Fewer options, more certainty: people just moved.

In retrospect, this makes more sense to me than it did at the time, because security isn’t…

…something you want to think about on a monthly basis. You’re in or you’re out. By building the product’s go-to-market around an annual subscription, we were teaching our customers that security was something to think about all the time, too.

We also found that customers on annual and monthly contracts used Vanta differently. The annual customers used the product more continuously; it wasn’t just about audit prep. That was a light-bulb moment for me: how we priced the product could change how people thought about us and how they used it.

I said earlier that charging annually makes everything better. Here are a few examples.

First, it was easier to think through a customer’s life cycle, figure out where they were, and ultimately give better support when we knew someone was with us for a year. That made things easier on our success team.

Second, RevOps (Salesforce automation, billing, all of it) got easier with fewer contract options and fewer SKUs.

And third, revenue itself became a lot more predictable. We knew what we had and what was in the bank, which made it less likely we’d have to rush out and raise, probably on very unfavorable terms, to avoid a cash crunch.

I also think annual billing is a good barometer for lesson number one:

Did you build something people really want? It takes a lot of conviction to ask someone to pay for a product a full year up front, nearly sight unseen. But if you can pull it off, and they’re happy with it, that’s a very good sign you’re on to something important. If you’ve built something your customers can truly see the value in, they’ll be fine with annual billing, and it will probably simplify a few things for them, too.

Lesson number three: hire more workhorses, and spend less time looking for unicorns.

At this stage, you’ve hopefully built something people want, and you’re selling it in a way that resonates with them and helps you build your business. Now the challenge every startup faces is hiring. The most valuable advice I can give on recruiting probably doesn’t sound all that great: you just have to do a ton of it. There’s no magic bullet.

There are ways to make it easier on the margin, but you’re doing it constantly. At YC, they told us that half or more of a startup CEO’s time should go to recruiting. That struck me as absurd at the time, but there’s no way around it.

If you’re actually spending half your time recruiting, you’re talking to a lot of people you don’t need to hire in the next four seconds (or, more realistically at a startup, two weeks ago). You’re building a pipeline. That can feel a little luxurious when there’s a job you can’t wait to hand off because you know you’re bad at it, and you want to laser-focus on finding the accountant who can fix the books you’ve been doing wrong for a year and a half. But if you also meet a few smart product marketers along the way, that ends up being really helpful later. There’s no silver bullet, just as much recruiting as you can stand to do.

Once you’re spending more than half your time recruiting, the next piece of advice is a little painful: don’t over-engineer your roles, or look for things that might not actually be there.

I say it’s painful because Vanta very much did this in our early days. We were so convinced Vanta was special (and it is) that we thought normal jobs at a SaaS company, like customer success manager or operations, didn’t apply to us. We had special versions of those jobs, cobbled together from parts of different roles.

At the same time, we were meeting people we thought were really great: smart, motivated, wanting to have a big impact. But they didn’t quite want the standard roles and titles either. They’d say, “I don’t really want to be a customer success manager,” and we’d say, “We don’t know if we have those anyway, and you’re really good, so let’s work out something bespoke.” So we made these unicorn roles, mashing different pieces together.

First, it just didn’t work. And second, on the other person’s side, there was a mismatch in expectations. They expected something very special, and it turned out what the business needed was something more common across SaaS companies.

Taking someone who’s highly specialized in one domain and dropping them somewhere else, as in Ted Lasso, makes for really good TV. But I don’t think it works at a SaaS company, especially a small one.

So when you’re thinking about your early team, especially before a big round and all the buzz that comes with it, it’s important to pitch people on how special your startup is, because, jokes aside, your startup is very special. But it’s also important to keep in mind all the ways your startup isn’t that special. You may well be a fairly standard SaaS company, and one of those ways is the roles…

…and job titles you have. This list is pulled straight from vanta.com/jobs. Two things: first, if you know anyone interested in these, we’d love to chat with them. And second, these are very standard titles. They’re exciting roles and exciting opportunities, but job titles are not where we differentiate.

So I’d recommend saving the time you’d spend on elaborate job descriptions, titles, and Rube Goldberg interview loops (which we very much did) and focusing on meeting the best people you can for the roles you need today, and the roles you think you’ll need in the future.

Lesson number four: know which problems money can and can’t solve.

At this point you’ve got a product people want, you’re selling it in a way that works for your customers, and you’re building a great team. You’ve probably got VCs knocking down your door with term sheets, and that’s fantastic. My final piece of advice before you sign one is to be clear with yourself about which problems money can and can’t solve. Some it can, and some will still be waiting for you after your celebratory glass of champagne.

And, coming back to the beginning: this isn’t a talk about not raising money. There are a lot of really good reasons to raise before you get to $10 million in ARR.

Your competitive or market dynamics are changing. You think something in your industry is about to shift.

You’re hiring really fast. We used to joke that our goal was to hire fast enough to draw down the bank balance quickly enough that we’d need to raise. We never pulled it off, but kudos to you if you can.

Your marketing machine is printing money. If you put $1 into your go-to-market and $5 comes out, you should probably raise.

Those are all good reasons. But remember that fundraising is at least a one-to-two-month process, and even in the Zoom-and-Tiger era, you still have to do a lot: put together your narrative, design a deck, stand up a data room, manage a pipeline of investors, and make a decision with ramifications for you and your business for years. When we raised earlier this year, I cancelled everything on my calendar. Some of that was to do all those tasks, and some of it was to get into a headspace where everything about Vanta was perfect and nothing was unoptimized, so I could answer VCs’ questions truthfully and confidently, without all the nuance of the day-to-day.

And beyond the time it takes, some things, like validating your initial product idea or figuring out your customer pitch and go-to-market, you just can’t solve with more cash.

So, as you’ve seen from our story, there are good reasons to wait before you raise. It helps you test for product-market fit, it instills discipline across the team, and it forces conviction: your own sense of whether you have a good business, not whether a VC likes it.

As companies, as an industry, and honestly at events like SaaStr, we celebrate the big PR moments. It’s really fun to get your team’s photo in Forbes and have your biggest sales week ever because of all the buzz. But that stuff is fleeting, and you and your team are with your business one way or the other. That’s why conviction matters so much. When you take on outside partners, do it because you have conviction in the problem you’re solving and how you’re solving it, in your customers and how you find them, and in the team you’ve assembled. Raise on your terms, not the hype machine’s.

Every startup is different, and they’re all hard whether or not they work, which is part of what makes them so fun. I hope some of these lessons help you have a more rewarding experience with fewer battle scars.

To recap, my four lessons for building to $10 million in ARR before a Series A:

1/ Build something people want.

2/ Charge annually up front, if you can.

3/ Spend lots of time hiring, but don’t over-engineer your org chart.

4/ Know which problems money can and can’t solve.

Thanks!