Key Takeaways

  • In 2018, the total annual spend by startups on SOC 2 compliance was exactly zero dollars, making it an unviable market on paper.
  • The global market for SOC 2 was roughly $10 million when Vanta was founded, a number that would cause traditional venture investors to pass immediately.
  • Static total addressable market (TAM) numbers measure current friction rather than latent demand unlocked by lowering cost and time.
  • John Collison points out that being "TAM-brained" blinds founders to software opportunities buried inside real enterprise workflows.

The Trap of Current Spend

Every pitch deck template demands a TAM slide with three concentric circles. Founders spend days hunting for industry reports that justify a multi-billion-dollar addressable market before writing a single line of code. Christina Cacioppo thinks the entire exercise is broken.

“I think the second part is market sizing is bullshit,” Cacioppo said. “You can be as academic or whatever, strategy-ish as you want about it. The market size today is only a predictor of the market size today.”

When Cacioppo began working on Vanta in 2018, conventional market research suggested there was no venture-scale business in automated compliance. The global market for SOC 2 reports sat around $10 million total, mostly paid to accounting firms by large legacy enterprises. For early-stage startups, the spend was nonexistent. “The market for startups getting SOC 2 in 2018 was zero dollars,” Cacioppo noted. An investor analyzing historical receipts would have dismissed the idea on day one.

Latent Demand Unlocked by Lower Friction

Calculations based on existing market size assume that customer demand is static. In reality, demand is highly elastic to time and operational friction. Startups in 2018 were not avoiding SOC 2 because they disliked security audits; they avoided them because spending hundreds of manual engineering hours and tens of thousands of dollars on auditors was prohibitive.

“Well, if we can make this thing easier to get and take down the cost of dollars but really time, more people will get them,” Cacioppo explained. “That ended up being deeply true.”

Once software automated the evidence collection and continuous monitoring, SOC 2 transformed from a rare luxury for late-stage companies into a standard requirement for closing any B2B deal. The market expanded by orders of magnitude because the product reduced the transaction cost of getting certified.

John Collison observed that over-analyzing market size early on filters out the best ideas: “Vanta is an example of the company that being too TAM-brained, you would not come up with it.” The real opportunity only becomes clear when you spend years embedded in actual workflow bottlenecks rather than studying top-down industry estimates.

What to Do With This

Look at your current product roadmap and find the feature or market you rejected because third-party industry reports said the existing spend was too small. Ask whether low adoption is caused by lack of interest or by excessive cost, complexity, and friction. If customer demand is artificially suppressed by friction, cut the friction by 90 percent and test whether customers will buy it.