Disclaimer: https://legal.codesolutionsllc.com/si-disclaimer — Notes of a public interview — not Code Solutions LLC views or advice. Speaker claims: Everything below is the speakers' own account, attributed to them, and [unverified]. Figures are as spoken.
Source: https://x.com/patrick_oshag/status/2112514179299258843 (native x.com video, 64:56, posted Tue Oct 20, 2026). Host: Patrick O'Shaughnessy. Guest: Christina Cacioppo, co-founder and CEO of Vanta (per the post). Timed notes on three stretches of the episode; quotes are verbatim, and the rest is close paraphrase of what was said. Sponsor reads and some asides are left out.
- 16:27 Cacioppo says that with an eight-year-old codebase, "it is so much easier to throw the coding agents at a small codebase than a large one. And that's like a token input thing."
- 16:42 Cacioppo says her team has spent a lot of time in the last year "modularizing parts of the codebase. So that the agent can just understand smaller parts of it, understand it fully and then be really effective." She says Notion has worked on the same thing and "they were like nine months ahead of us on" it [unverified].
- 17:01 Cacioppo says an agent given a large codebase "sight unseen" lacks the context window to understand everything "and will do silly things," and then "you need a high-context engineer to babysit it, which is helpful, but sort of invalidates some of the point."
- 17:15 Cacioppo says companies have always had this problem as new-engineer onboarding: "It's just agents have made it like, well great, now we want to onboard 9,000 new engineers tomorrow." [unverified]
- 17:28 Cacioppo gives her own company a lower grade on this and says they are "using agents and people to make the codebase easier to understand too."
- 17:51 Asked to grade the shift from one to ten, Cacioppo says "Eight, nine," adding: "the principles are still the same, like everything is hard, people matter, all the tropes are still the tropes, but the way you do stuff, it should be quite different."
- 18:36 On markets versus founders, Cacioppo says "this AI technology shift has made some markets that used to look really good look really bad," and that even a great founder can "run into a brick wall" there.
- 18:47 Cacioppo says there is "a founder motivation piece: you gotta be in it and push in this era," because otherwise "the rest of the company will not self-organize to do so."
- 19:12 Cacioppo says the hardest and most useful step is "Just getting people to use it," starting with leaders: "definitely use it yourself, build stuff." She says to "Understand where the models are, where they're good, where they're bad, what harness means, and do that at least every two weeks because it just changes so quickly."
- 19:35 Cacioppo says leaders need "a visceral understanding of what works and what doesn't," so that when someone makes a big claim about agents they can ask "where is that true and where is that false."
- 20:12 Cacioppo says she is "slightly more empathetic now": strong people sometimes do not dive in, "and you have to nudge them more and try to figure out what's blocking them."
- 21:13 Cacioppo tells the story of a team that set out to build better onboarding and kept bringing classic onboarding wizards ("Four steps and a progress bar and confetti") to product reviews, even after being told to use an LLM. She calls it "a motivated team, talented people, they cared."
- 22:00 Cacioppo says the team told her they did not know if the LLM approach would work: "we basically don't think we're allowed to fail on this project." Her reaction: "oh, that's the thing." She says the answer was to "bet that the LLM flow is gonna work and we will make it work, we will hill climb all we need to, but burn the boats." She says, "I would not have guessed that was their blocker. You solve that, and they were going."
- 38:34 O'Shaughnessy notes that much of the early internet got hacked and suggests "This will probably be that times 10 or times 100," then asks where security is heading.
- 38:57 Cacioppo says: "These models just are like so much more persistent than people, actually, and so they will just like try nine quadrillion things the way a person would sort of give up after, I don't know, 9,000, right? And then in the course of that they find things and chain things together." [unverified]
- 39:27 Cacioppo says much of the talk is about zero days, but "what's more so happening is these models are able to chain like 17 benign-ish or benign on their own things together and then like really find something." [unverified]
- 39:41 Cacioppo points to an example: "if you watch the the OpenAI talk at RSA about Hugging Face, it's basically that." [unverified; her account of the talk] She says issues people would have called low severity, with a 90-day fix window, now combine, and "It just turns the prioritization on its head."
- 40:10 Cacioppo says calling everything critical isn't helpful: "you've just got to fix stuff as fast as you find it... if you're fixing things at machine speed you sort of don't have to prioritize. So that's where I think we're gonna get to but I think it'll it'll be rocky as we get there."
- 40:35 O'Shaughnessy pictures a constant test: a white-hat agent always trying to break in, with "a buddy agent that's a patcher" fixing each find. Cacioppo: "Yeah. Yep."
- 42:26 On motivation, Cacioppo says her job is "interesting and challenging and it changes all the time... I really like my job," and that when it changes and she feels new at it again, "I really like that dynamic." She says it is now more "let's see how far we can go with this."
- 45:09 Cacioppo says she was once a nervous public speaker and has grown into it: "Exposure therapy is helpful." She adds that if you work hard at a skill, you tend to get better at it.
- 46:14 On what makes a good talk, Cacioppo says: "no one remembers what you say but they remember how you felt. It's so annoying but it is so true." She points to "Believing in it yourself... authenticity," because people can tell when someone is going through the motions.
- 60:42 Cacioppo says: "we just don't trust software companies, tech companies the way we used to. And that is like getting worse year over year," and that it is hard to imagine getting back "to the like useful optimism of 15 years ago."
- 61:05 Cacioppo says "companies showing that they are trustworthy and industrial grade and secure through lots of metrics and actual definitions is like more important than ever and will just get more and more important," to customers, regulators, lawmakers and auditors.
- 61:40 O'Shaughnessy frames the moment as one of very high excitement and low trust. Cacioppo agrees ("Yes.") and says the goal is to raise trust "legitimately so, not just on vibes."
- 62:00 Cacioppo says that in B2B there is a vibes piece "but there's a very real data piece," and she would like to see "specific things or specific improvement curves or have make promises with maybe contracts behind them." She says that "on the consumer side, it is vibes," which "seems very hard to turn."
- 63:02 Cacioppo says: "Security five years from now is faster, even more intense, more offensive hopefully," with more white-hat pushback at new speed. "You've got to get some amount of the human decision-making out. Where humans are like architecting systems and writing rules, but not making every single decision."
- 63:28 Cacioppo says: "Writing evals. Maybe that's all we're doing in the future, we're all writing evals all day long."