Vanta

Vanta started with a chore almost every software company dreads: getting a SOC 2. Christina Cacioppo lived through that grind while running Dropbox Paper, decided the whole thing could be automated, and founded Vanta in 2018 in the wake of a string of high-profile breaches. The pitch was that security shouldn't be a point-in-time audit you cram for once a year, it should be monitored continuously and provable on demand.

Eight years later that bet looks right. More than 16,000 companies now run compliance on Vanta, the business crossed $300M in ARR in early 2026, and a $150M Series D in July 2025 valued it at $4.15B. The current chapter is agentic: Vanta rebranded itself the Agentic Trust Platform and is pushing AI agents to actually do the GRC work, not just flag it.

Vanta connects to the tools a company already runs, then continuously checks whether its security controls are actually in place, mapping the evidence to frameworks like SOC 2, ISO 27001, HIPAA, GDPR, and FedRAMP. Its own numbers say the platform spans 400+ integrations and 1,400+ continuous tests, all feeding a shared data layer it calls the Trust Graph.

The difference from the old way is that nothing is frozen. Where a traditional audit is a snapshot you scramble to prepare, Vanta watches controls in real time and surfaces drift the moment a test fails, which is what lets customers keep an audit-ready posture year-round rather than for one week in Q3.

Compliance is expensive because it is manual. Teams chase screenshots for auditors, answer the same security questionnaire fifty times, and run vendor reviews by hand, one at a time. Vanta's whole reason for existing is to automate that busywork so a small security team can cover a lot of ground without adding headcount.

The payoffs customers cite are concrete: Snowflake says it saves 2,000+ hours a year, GitHub automates 93% of its security questionnaires, Perforce cut compliance labor by 75%, and Duolingo claims 12+ hours back per week. The through-line is time, and the deals that stop stalling once a buyer's security review clears fast.

Vanta sells across the whole size curve, but the message changes at each stage. For startups it's speed: get a SOC 2 fast so a big deal doesn't slip. For mid-market security leaders it's leverage: keep scaling without hiring more GRC people. For enterprise CISOs it's consolidation: compliance, risk, and proof in one place instead of a stack of point tools.

The buyer is almost always the person who owns security and compliance, from a scrappy founder wearing the security hat to a director of GRC or a full CISO org, plus the sales teams who lean on Vanta's Trust Center to unblock deals.

Vanta bundles its work into a few pillars that share the same Trust Graph underneath. Compliance automates evidence and monitoring across 35+ frameworks; Risk unifies internal and third-party (vendor) risk in one view; and Proof lets customers share their posture through a Trust Center and auto-answer security questionnaires.

The piece Vanta is betting the brand on is the Vanta AI Agent, which it markets as a 24/7 GRC engineering team. Instead of just summarizing, the agent drafts policies, fills out questionnaires, flags issues, and writes code to fix failing tests, which is the line between an AI feature and an AI coworker that the company is trying to own.

Vanta is subscription software sold in four tiers, Essentials through Enterprise, with pricing gated behind a demo rather than published. Cost scales with how much you need: more frameworks, more automation, risk and TPRM modules, and questionnaire volume all push you up the ladder, and a lot of the advanced capability is sold as add-ons even within a tier.

That structure tells you the ICP. Essentials is the fast path to a single framework for a company that just wants to keep building, while risk management, advanced Trust Center, and custom monitoring live in Professional and Enterprise where the bigger security programs are.

Vanta more or less created the automated-compliance category and now defends the top of it against a deep bench: Drata, Secureframe, Sprinto, Scytale, Scrut, Thoropass, and Hyperproof all chase the same buyers. Reviewers tend to frame it as Vanta and Drata for enterprises wanting rapid audits, Secureframe for first-timers, and Sprinto for lean mid-market teams.

Vanta's edge is breadth plus the agentic push. Forrester named it a Leader in its Q2 2026 GRC Wave on its first inclusion and gave it the top score for continuous controls monitoring, calling its innovation approach unparalleled. The risk is that the underlying automation is now table stakes, so the AI agent has to stay genuinely ahead to justify the premium.

Vanta leans hard on customer outcomes, and the names back it up. Samsara says it influenced $150M+ in revenue while scaling GRC on Vanta, Snowflake saves 2,000+ hours a year, GitHub automates 93% of questionnaires, and Perforce cut compliance labor by 75%. Ramp, Duolingo, Atlassian, ZoomInfo, Ironclad, and Modern Health round out the case-study wall.

The external stamp is the Forrester Wave Leader placement in Q2 2026, plus a spot on the 2026 CNBC Disruptor 50. These are the company's own selected wins, so read them as the best case, but the volume and caliber of logos is real.

The recurring praise is consistent: Vanta is easy to use, the automated evidence collection saves real time, and the integration library plus dashboard make it a genuine one-stop shop for SOC 2, ISO 27001, GDPR, and HIPAA. Teams routinely report getting certified in a couple of months.

The complaints are just as consistent. Price comes up most, with reviewers calling it steep and a poor fit for small businesses, and support draws criticism for being hard to reach. Some users hit flaky integrations during setup, others find the alerting noisy with false positives, and a skeptical thread on Reddit questions whether the auditor network prioritizes speed over rigor.

Vanta has raised about $504M across five rounds, from a $50M Series A in 2021 to a $150M Series D in July 2025 that set the valuation at $4.15B. The Series D was led by Wellington Management alongside Sequoia, Craft Ventures, Y Combinator, J.P. Morgan, Goldman Sachs, Atlassian Ventures, and CrowdStrike Ventures.

The framing at the time, per Forbes, was that CEO Christina Cacioppo raised despite not needing the cash, a flex that lines up with the company crossing $300M in ARR and roughly tripling revenue in two years.

Vanta owns its category and has the revenue, valuation, and logo wall to prove it. The open question is durability: automated evidence collection is now something every rival ships, so the premium has to come from somewhere newer.

The company's answer is to make the AI agent do the actual GRC labor, from writing policies to fixing failing tests, and to keep expanding into risk, privacy, and enterprise-grade programs. If the agent genuinely replaces headcount rather than just assisting it, the moat holds. If it stays a nice-to-have, the field catches up on price.

Vanta is remote-first in the US and hybrid at its international offices, with a leadership bench that has scaled things before: CPO Jeremy Epling ran Actions and Codespaces at GitHub, CRO Stevie Case built enterprise sales at Twilio, and CFO John McCauley was CFO then COO at Calendly. Founder Christina Cacioppo still runs the company.

The culture is codified into principles the company screens hires against, with a heavy tilt toward speed and judgment: bias for action, decide with frameworks, win as one team, lead with resilience, and do what it says on the tin. Engineering roles skew senior and increasingly AI-forward, with JDs openly expecting candidates to work alongside tools like Cursor and Copilot.

Vanta discloses base pay ranges on its US postings, and the spread is wide because it spans levels and functions. Engineering base bands run roughly $116K to $378K, non-engineering and leadership roles reach into the high $400Ks, and sales roles carry lower base with commission on top. Ranges are in USD, with some roles posted in CAD for Canada.

Every role advertises equity in addition to base, so total comp for senior and sales positions is meaningfully more than the base band alone suggests.

The operating entity is Vanta Inc., a Delaware corporation with a place of business at 655 Montgomery Street, Suite 1600, San Francisco, CA 94111. Its privacy policy spells out standard SaaS data handling, drawing a clear line between data Vanta controls (its own website and marketing) and customer data it merely processes on a customer's behalf.

Selling trust means Vanta has to hold the certifications it automates for everyone else, and its own program covers frameworks like SOC 2 and ISO 27001. It offers a free trial and sells through cloud marketplaces (AWS, GCP, Azure) alongside direct order forms.

The last year of Vanta headlines tracks two stories at once: money and AI. The $150M Series D at a $4.15B valuation landed in July 2025, Fortune reported the company crossing $300M ARR in April 2026 as shadow-AI fears drove demand, and a run of 2026 launches pushed agents into risk, privacy, and enterprise workflows.

The recognition piled up alongside it, most notably the first-ever Forrester GRC Wave Leader placement in Q2 2026.