John Collison: evaluation

Transcript context

…SOC 2 is like, "You must log useful events and have a system to look at them. But it is up to you to decide what the heck that means," which sometimes it's helpful. I think for a startup that's never done this, it is unhelpful because it opens up a maze in a way that's just not great. That's where being prescriptive is part of, I think, Vanta's initial product market fit. I think it's actually largely due to that. In a way, that wasn't the plan. But I think it's like figuring out how to take that high-level guidance, bring it down in some places in a way that actually makes sense. Christina and her team at Vanta are helping their users automate compliance, which for many companies is the thing standing between them and being able to sell to enterprises. We're very familiar with this category of products with Stripe, where you have a complex web of rules that businesses need to be able to comply with so they can move on to actually improving their products. Just take tax compliance and our product, Stripe Tax. As you start selling in more states and more countries, you discover there's thousands of rules you need to follow. For example, did you know Chicago actually has a lease tax, which applies to SaaS companies, too, since you're leasing out software? Stripe Tax is built to automate all of this. With one integration, it knows what you're selling, when and where you have to collect transactional taxes, and how to register and file on your behalf. If you want to sell globally without becoming an expert in tax rules, check out Stripe Tax. The joking reference that everyone makes is they talk about competition from Claude Code for software products is, "You're not just going to vibe code your X in a weekend." But obviously, something like SOC 2 is actually the kind of thing that a Lens or coding agents are good at working with because there's just so much training data out there, and it's a codified set of rules. How is AI helping with what you're doing, and what is your plan for… You were describing some of the scale economies you have and having seen other customers, and I'm curious what the defenses are against… A customer could, in theory, say, "Hey, Claude, give me the plan for our SOC 2 compliance, make no mistakes." That is a thing you can contemplate. I think you can do the very defensive thing, but actually, the very defensive thing is like, "Right." But this is a place where you don't want to get stuff wrong. Spending much time on it does not make your beer taste better. Is this really the place? Even if you really want to vibe code a bunch of stuff, is this really what you want to vibe about? Fine, whatever. There's all those rumors. Ignore them all. I think where the LLMs are excellent and a little dangerous in a build versus buy, but then we just need to build better experiences on top of this is like, "Hey, Claude, I'm going to give you a mess of data. You go make sense of it to me and get me ready. I'm just going to give you a bunch of AWS screenshots or API calls. I'm going to give you all my policy documentation. I'm going to give you my existing Jira workflow. Go turn it into a thing." You can go do that today. We are building… This is our onboarding flow or will be our onboarding flow, which is, "Oh, you have an existing program that's already running. Give you all the stuff. We will go map it into the Vanta world." Then in a Claude or an LLM, it's like, "Okay, cool. Now you get files in a folder structure that you then box share that over to EY and call that your audit." Fine. You can do that. In a Vanta world, the outcome is, now, hopefully, we have your program mapped and is observable and monitored and alerted. You have continuous control monitoring. You get your dashboard, you always know what is in place and what is not. Yes, you can go send a share link to your auditor here, too, and they can log in and see everything. We think about it as they have lowered the initial audit prep in a way inside, outside Vanta. Or if they're not inside Vanta, what are we doing? Building that. But the continuous monitoring piece. That you're not going to get out of at least LLM chat. You've got to go vibe code that whole system.…

Stored transcript either side of the excerpt. The highlighted words are the published quote; the surrounding text is unedited source, never generated.