Before I founded Vanta in 2018, very few startups had a SOC 2, the most commonly accepted standard for demonstrating security. That’s because preparing for a SOC 2 was a time-consuming, expensive, and very manual process (think lots of spreadsheets and screenshots). If you were a founder of a growing startup and you had to choose between building new features or implementing a security program, you’d likely go with the former.