Finding a Novel Idea in a Big Market

Hi Startup School, thanks for having me, and it’s great to be here with you today. My name is Christina Cacioppo, and I’m the CEO and cofounder of Vanta, which helps companies automate compliance, manage risk, and prove trust—continuously.

I want to talk to you today about finding a novel idea in a big market. I hope some of what I say is helpful. I’ll tell you a bit about Vanta, since I’m pretty sure that’s why I’m on stage, but this isn’t really a talk about Vanta; it’s a talk about finding a startup idea.

But – starting with Vanta

The idea for Vanta came, like so many do, out of experiencing the need for the product myself. In 2016, I was leading the Dropbox Paper PM team. We had been advised to act like a startup within Dropbox, so we were moving fast and breaking things, working around the clock to get the product to market quickly.

We thought we were going to be bigger than Dropbox, so we wanted to start by giving Paper to some existing Dropbox customers, but before we even could, we ran into a roadblock: in our efforts to move fast, we hadn’t built Paper to adhere to Dropbox’s security commitments. Then, we learned we had to go back and get the product SOC 2 compliant, a process that could take up to a year and would pretty much consume our entire team to prove it was secure and reliable.

This was all taking place around the time of a slew of high profile data breaches – remember the 2016 election, with everyone’s emails everywhere, and Equifax? – and it was clear to me that “security” was no longer something you could put off until your company or product was an attractive target - it was becoming table stakes for gaining adoption.

So in 2018, I co founded Vanta with the idea that if you can give small companies the tools to start on security early, you can help them unlock deals and level the playing field when selling into the enterprise. And more importantly, we could make the internet more secure in the process.

That’s the public story of coming up with the idea for Vanta, and it’s all true. But there’s also a lot that the story elides, so I’m going to take you back in time for another view of what it was really like.

Let’s go way back to 2012. In 2012, I was sitting in the exact seat you are in – this was my view into Startup School 2012. As I sat there, listening to talks from founders of companies that seemed enormously successful, I desperately wanted to start a startup. I had a job then – a good job that I felt a bit badly I didn’t want to stay in –  and was grappling with the fact that I wanted to leave that good job and learn to build things.

I both felt like I could do it, if only I could make the chance for myself, and it all felt very far away.

One reason it all felt very far away to me was because I didn’t know how to code. I know lots of founders start startups without knowing how to code, and I knew it could work well, but it wasn’t going to work well for me.

So I quit my job, learned to code, and made a lot of stuff you haven’t heard of. When I did all of this, I wasn’t necessarily expecting any of these first projects to be a company. I just wanted to learn how to make a web app. Over time, I shifted from writing 3000 line main.py files to slightly shorter main.py files to making functioning web apps to trying to find a startup idea.

In doing so, I made a lot of stuff you all haven’t heard of and definitely did not use. Those years, more than the process of coming up with the idea for Vanta in some ways, are why I’m excited to talk to you all today.

So while Vanta’s gone $0 to $100mm in five years, I think it’s also emblematic that almost every overnight success really isn’t one – there’s lots of work and effort over years that goes into making anything great.

And when you start a startup, I think you have to hold two conflicting ideas in your head: [1] that very few startups really work, and the odds are atrocious – it is highly unlikely that your startup works; and [2] that your startup will work, and starting a startup is a better idea for you than working somewhere else.

So when someone asks me if I knew Vanta would get to $100mm ARR in under five years, my answer is equally a full-throated yes and a just-as-honest “no way.”

I hope you find that humanizing.

I talk about a big market because I subscribe to Marc Andreessen’s view on product-market fit from his short-lived but excellent blog. His take is all that matters in finding a startup idea is the market. After fighting against this advice for years by building seemingly cool things in nonexistent markets, I now really believe it.

I’m just going to read this out, because I think it’s really important:

In a great market—a market with lots of real potential customers—the market pulls product out of the startup.

Conversely, in a terrible market, you can have the best product in the world and an absolutely killer team, and it doesn’t matter—you’re going to fail.

When a great team meets a lousy market, market wins.

When a lousy team meets a great market, market wins.

When a great team meets a great market, something special happens.

https://pmarchive.com/guide_to_startups_part4.html

So I’m going to talk you through a bunch of stuff I’ve learned about finding an idea in a big market that I hope is helpful – or at least helpful enough that you make different mistakes than me as you find your idea.

I will say that this advice is pointed at someone building something that doesn’t exist today. There is another way to find a successful idea, which is to copy what another company that seems successful is doing. That’s a more straightforward path in some ways and a harder one in other ways – it’s harder to motivate a team to “just copy,” because you’re implicitly telling hires that their ideas aren’t as good as these other people’s; you’re making one of what I think of as the cardinal mistakes, which is not considering your competitors smart; you’re letting someone else dictate the terms of the race and hoping you can outsprint them.

But here’s the secret: if you are successful and identify a market where no one else is, you’re going to get a lot of knockoffs.

Trust me.

Before I dive into a nice framework that will seem clear-cut and buttoned up, I wanted to take a moment to acknowledge the instagram vs reality nature of finding a startup idea.

Here’s what it seems like from the outside, especially given the stylized stories that founders tend to tell.

Here’s what it feels like on the inside, except perhaps even worse, when the marbles are all dropping out of the machine, spilling all over the floor, and causing people to trip.

WIth all that prelude: here’s five tips to find an idea in a big market – and an idea that’s original and valid.

1 / Find your plumbers

2 / Offer painkillers, not vitamins

3 / Assume your competitors are smart and motivated

4 / Delight in being underestimated

5 / Don’t build a SOC 2 factory by accident

I’m going to go through each of these tips, show you what happened when I didn’t follow it, and then show you how it worked with Vanta in the early stages. I’ve got a couple slides from our seed pitch deck, which I hope show what this actually looks like in the moment.

Tip #1: Find your plumbers

“Find your plumbers” was advice we got from another founder when we were just getting started. Here’s the story:

We heard about a founder who made scheduling software for plumbers. Their uncle was a plumber, I think, and they cared a lot about the profession. Most technologists don’t think about plumbers – I know we didn’t.

This founder took their talents to scheduling for plumbers, and they built a very real business out of it. It wasn’t venture backed, but it made tens of millions of dollars a year. It was a proper business. Their customers were very happy, and they had such a headstart that no one was competing with them.

We remarked that building software for plumbers sounded terrible. But this founder loved what they were working on. They legitimately loved plumbers. It’s idiosyncratic, but it’s them. And you know what? They were better than everyone else at it.

My advice to you all: please find your plumbers. They may not be literal plumbers, but you should build for people you are excited to spend time with, because you will build a better product and ultimately a better company for them.

The reason you need to find your plumbers is because if you want to succeed, you will be spending a lot of time with your users. You’ll probably be at your best when you really understand what they’re trying to do and why – i know I am. If you don’t respect these folks, want to do other things beside spend time with them, you will build a worse product. You will have a worse sales motion. You will be beaten in the market by someone who is listening to customers more than you are.

The canonical lesson of YC, for good reason, is build something people want. If you don’t get close enough to your people, you won’t build something they want. When you genuinely like your users, you’ll spend more time with them, and you’ll listen to them a lot.

This may sound milquetoast, but I’ve made this mistake a couple of times.

Not my plumbers: biologists in a lab. I would have guessed I liked biologists in a lab, and I like them as people, but I’m not as curious about their day to day as I am about other people’s day to days. And turns out, I have very little in common with biologists in a lab. I mostly didn’t take high school chemistry, so I’m missing a lot of context. I don’t understand the specifics of what they do. I could learn, but I’d rather learn something else instead.

Anyway, in 2017, before Vanta was anything, we made an Alexa for biologists in a lab. Made a lot of sense on a white board – biology is like cooking, biologists need to do conversions, they often don’t have both hands – but didn’t make sense in practice. We didn't actually understand biologists, we just pontificated about them, and it was all wrong. They did not use the voice assistant that we made for them.

Here are two slides from Vanta’s seed pitch deck from spring 2018, right after we finished YC.

We started building for founders, and we will always build for founders. We just build for security and compliance professionals now, too.

I always enjoyed spending time with founders, and I now really enjoy spending time with security and compliance folks. Not everyone does. I think they’re missing out, but they think I’m wacky, and the answer is probably somewhere in the middle. Point is: I found my plumbers.

Tip #2: Offer painkillers, not vitamins

This advice has been repeated so often as to become a trope, but it’s because the advice is very correct.

Most products are vitamins. Painkillers have a way of getting invented if enough resourceful people apply themselves to the problem space. That is magical and Adam Smith-ian but also means that it’s much harder to find a painkiller than find a vitamin. You often have to look in places others aren’t. “There are no $20 bills on the sidewalk” was our catchphrase internally.

Because it’s so hard to identify a true painkiller, folks tend to mix up the two. Having mixed up vitamins and painkillers more times than I would like to count, all I can say is: painkillers feel different on every dimension. If you don’t know which one you have, you have a vitamin.

Here’s an example of a vitamin I worked on.

I mentioned Dropbox Paper earlier, but I didn’t explain it. It is a collaborative document editor, sort of a more modern Google Docs or a Notion without the sidebar and before Notion was as excellent as it is today. It also started as a YC company – Hackpad was in the Winter 12 batch.

Lots of interactions from Paper are now standards: docs links as tokens; emojis in docs and inside comment threads; and pasting a link on top of the word linking the word, rather than replacing the word with the link

People who used Paper really liked Paper. We couldn’t really explain what it was, and wherever we would try – ”don’t you want emojis in your docs?” – it sounded silly. But there was something there once someone switched.

But why would you switch your entire team from Google Docs to Paper? Why go through all that hassle? It was never clear.

This screenshot is a capture of the homepage when I was PM. You can tell – we didn’t know how to explain the product. I didn’t know how to explain the product. Not great as a PM.

After Paper, I knew I wanted whatever I worked on next to have a clear value proposition. I have so much respect for people who build collaboration software, because I know how hard it is, and that wasn’t for me.

The thing I really wanted was a clear value proposition: “pay me $X, make $10X from your customers”

Here are a couple slides from our 2018 seed deck. What stands out to me now is how clear the problem statement and solution are.

Problem: companies lose time and money to security reviews, vendor questionnaires, and compliance audits.

Solution: Vanta automates compliance, starting with SOC 2, the de facto standard for cloud software

The problem and solution “just makes sense” and honestly, that deep logic has carried me through tough times at Vanta. As frustrated as I can get when something isn’t going well, I know we’ll find a way out, because this idea fundamentally makes sense.

Tip #3: Assume your competitors are smart and motivated

It’s really easy to look at any company from the outside and tear it down – to point out all the things they seem to be missing or doing badly. You can also sound smart in some circles when you do that.

I stand before you to humbly suggest: don’t do that. It’s lazy. The harder – and much more interesting – thing to do is try to figure out “assuming this company is full of smart, motivated people who are working hard, why are they doing what I think is the wrong thing?” Do I really know something they don’t know? Or do they know something I don’t know?

Here’s a time I assumed competitors were lazy:

In 2013, I was building software with a friend, a very good engineer, to see if we liked working together. Long story shortened, we liked working together a lot, and I learned a lot about software engineering from him, but we were terrible at coming up with startup ideas.

One of our ideas was a feedback system for small business owners. Basically, we wanted to encourage customers to text feedback on their local coffeeshop to a number. Then, we’d build an interface for the coffeeshop owner/manager to read, triage, and respond to the feedback.

There were lots of other companies doing this at the time, but none of them were at scale, and we thought our edge was going to be that we would build better flows for customers to report feedback. We basically thought everyone else was bad at building software and we would build great software.

Software quality was not the problem at all. There were two problems:

Here’s the market map we made for Vanta. I know it doesn’t look like we were taking our competitors seriously – after all, we have everyone relegated to the bad quadrants of the 2x2 and we’re all by ourselves in the hero square – but this was just for optics, from the seed deck.

What was actually the case was that we understood everyone on this 2x2 deeply. Most of our competitors rounded to consultants, who went in and rewrote security best practices, or controls, for each company. There are certainly points where this made sense. But it didn’t make sense for small companies that were just getting their programs off the ground – for those companies, standardized best practices got someone really far. But consultants think about the nuances, not about 80/20 solutions built for scale. So it made sense why they didn’t come up with Vanta, even though they understood the problem space.

There was one software company in an adjacent space that helped tackle HIPAA compliance, though it was very policy oriented. I didn’t understand why the company was so oriented around legal documents; yes, HIPAA is a legal standard, but many of the controls were technical, and they were pitching to software engineers. Why hadn’t they come up with Vanta before we did? I spent a couple weeks mulling this over, reading everything I could about the company and team, until it finally clicked: the company had been started by a lawyer. They took a legal approach to the problem. And that was valid, but it was very different from an engineer’s approach to the problem. So eventually I squared the circle, though it took awhile.

Tip #4: Delight in being underestimated

Lots of folks give this advice as “be okay with others thinking you're wrong,” but for me, I found a different edge.

It’s not that people thought I was wrong, it’s that people thought I wasn’t trying to do something big. I mean, I made a web app to keep track of books on my friend’s bookshelves, so I get it, but I also thought Vanta was going to be big.

The problem was the market size. Not that many companies got SOC 2s in 2017. We estimated there were maybe 1000 SOC 2s done in the entire world. What you’re looking at is a slide from the seed deck, where we moved around the numbers a bit to make the market seem better, but the reality was pretty dim.

We didn’t support PCI or HIPAA and we literally added a zero to the SOC 2 number.

We just really believed that dropping the time cost – not the dollar cost as much, but the time to getting an initial compliance certification – would cause a lot more companies to get one.

Anyway, I used to get upset about people thinking I was wrong – I phrased it to myself as “people are underestimating me.” That didn’t serve me very well, and I doubt it was fun to be on the other side of, either.

At some point, I realized that if I was right, it actually meant I had a startup secret, and that was GREAT. Being underestimated meant that I could get an even bigger head start on the race.

I’m not saying this is always fun. You’re looking at emails from a couple investors who have returned billions of dollars from their investing. This wasn’t fun, but as upset as I was when I got these emails, I also knew they were wrong.

So in 2017, no one wanted SOC 2 compliance, and even if they did, you couldn’t build software for it compliance because SOC 2s couldn’t be standardized. Except that was all wrong. We figured that out within a few months – not all the way, but we got pretty confident.

The market was tiny, but we believed it would get bigger quickly.

If the idea was as good as we thought, we knew that word would get out and people would start copying us. We wanted to get a really big head start before all the knock offs arrived.

The knock offs eventually arrived, but I think we got extra months on them by letting ourselves be misunderstood.

Tip #5: don’t build a SOC 2 factory by accident

I want to be very careful about my wording here. This is advice for going really deep into a new market. You might not want to do that. There are points when I haven’t wanted to do that, which I’ll talk you through. But if you really want to do something big, you’ve got to make sure you don’t do something small by accident.

What do i mean?

Well, here‘s a time when I wanted to do something small:

I’ve mentioned Laisin, my book shelving website. I just wanted to learn to make a web app. I didn’t know javascript! This was pre react, all jquery. I never thought I was going to take over Amazon, I just wanted to see the books on my friends’ shelves. That was really it.

That's a time when I wanted to do something small. I’ve also built things I wanted to be very big that ended up being small. Those were not fun times, and I definitely broke some of these rules along the way.

Vanta was not started to be a SOC 2 factory. What we really thought we could do was use SOC 2 compliance as a lever to improve companies’ security. We thought that by tying the hard work of implementing security controls to the go-to-market work of building trust with customers, we could help teams tie security work to revenue. If we could do that, there would be more security work done in the world.

So pretty early on, this became the plan: use compliance to help teams prioritize and complete security work.

As proof, here are a couple slides from our seed deck

And here are a couple slides from our Series A deck from 2021:

Problem: verifying security today is a patchwork of standards, certifications, and bandaids

Our vision is to move the software industry from point-in-time security verification to a continuous and holistic understanding of software security

And we would do that by starting with recognized compliance (like SOC 2) and building the technology and market presence to introduce something that is fundamentally better

I share this because we had this broader vision from Day 1, and honestly, we thought we’d be able to – we thought we’d HAVE to – execute on it even earlier. But SOC 2 ended up being much bigger than we expected. Vanta has over thousands of SOC 2-only customers today. If you’d told me that would have happened in 2018, and I was being honest with you, I would have just laughed in disbelief.

Somewhere along the way, we could have stopped and focused on SOC 2. We probably would have made a better product just for SOC 2. And again, it’s a reasonable business! But we would have made a worse security product, and we would have been worse at using market incentives to change the security behavior of companies. We would be a weaker, less resilient company today. We wouldn’t be able to solve as many problems for our customers.

Make sure you’re happy with what the lights-out success case looks like. We wouldn’t have been happy with only the world’s best SOC 2 factory.

To that point, every startup is different. They’re all hard, whether or not they work, and that’s what makes them so fun. I hope that some of the advice in this talk can help you have more rewarding moments with fewer battle scars.

My five tips for finding an idea in a big market that’s original and valid

1/ Find your plumbers

2/ Offer painkillers, not vitamins

3/ Assume your competitors are smart and motivated

4/ Delight in being underestimated

5/ Don’t build a SOC 2 factory by accident

So that’s my story. I’d love to hear yours – come find me after or reach out. My email is christina at Vanta dot com.

Thanks!