Vanta after the audit: compliance becomes recurring

Historical evidence and current assurance part company when the underlying system changes. A record can remain correct about the last audit period while saying little about the new application or the employee’s new access. Someone must notice the change, decide whether it matters and document what was done. Vanta becomes part of operating the company when it helps complete that sequence.

Vanta’s test documentation is more precise than a general promise of continuous trust. It exposes criteria, resource-level evidence, exclusions and the requests used to fetch data. It also says that an overall passing test need not require every in-scope resource to pass. That passing rule makes the scored population and test logic essential to interpreting the status. The customer and auditor still need to understand the population and the test logic.

The AICPA’s illustrative SOC 2 review checklist asks a recipient to examine the covered systems and period, exceptions, carved-out providers and controls the recipient must implement. A report therefore travels with interpretation and responsibilities. Software can make that interpretation cheaper by preserving an intelligible record; it cannot make a favorable status universal evidence about systems outside its scope.

This gives reuse a more demanding meaning. A questionnaire answer is valuable when the next buyer can connect it to current, relevant evidence and a responsible owner. Reusing an answer after the facts change merely moves the verification cost to the recipient. The product becomes harder to replace when it reliably closes that loop, including the awkward cases in which someone has to fix the system rather than improve its description.

I would follow an access or cloud-configuration change through the record. Was the affected resource in scope? When was the source refreshed? Who owned the exception, what action closed it, and what evidence could the recipient inspect? A neat dashboard can survive a stale connector or a narrow population. The investment case needs the process that makes those limitations visible and gets material failures resolved.

Vanta announced a $150 million Series D at $4.15 billion in July 2025, with over 12,000 companies served. It reported ARR above $300 million and 16,000 customers in April 2026. Those are dated company disclosures.

The growth is encouraging, but I would keep the dates attached. Dividing the July financing value by the following April’s ARR gives roughly 13.8 times. That is a comparison across two dates. It is neither the multiple investors paid in the Series D nor an observable price at which I can purchase shares today.

For the model, I start with the disclosed $300 million run-rate and treat $4.15 billion as a hypothetical entry benchmark. I give no credit for unreported growth after the April checkpoint. The five-year clock begins at this modeled starting state; it does not reconstruct the return of investors who entered in July 2025.

$300 million ÷ 16,000 = $18,750. I use that coarse normalization for a buyer budget. The public totals don’t identify paid-cohort pricing or contract mix.

Suppose a customer pays that normalized $18,750 per year and spends another assumed $5,000 implementing the software in year one. I assume it saves eight hours a week across 46 weeks of control and evidence work. It also answers ten questionnaires a month and reduces each from ninety to thirty minutes. The weekly estimate excludes questionnaire work, so the same hours are not counted twice.

That releases 488 hours a year. At an assumed $80 of avoidable labor cost per hour, the full amount is $39,040. But a salaried security employee’s time does not automatically become cash. I therefore test how much of that capacity replaces spending the buyer would have incurred, such as a contractor or an additional hire.

With half the released capacity converted into avoided cash spending, the first year is $4,230 short of payback. Recurring annual benefit is only $770 after the subscription. Full cash capture produces a much stronger result, while 25% capture fails to cover the subscription even after implementation is complete. First-year cash payback requires about 60.8% capture under these assumptions.

A customer can rationally buy below this model’s cash-payback threshold. Better decisions, less uncertainty in a sale or a lower chance of a control failure may justify the fee. Those benefits require their own evidence and valuation; the salary rate does not measure them. The cash model prevents capacity released from being credited simultaneously as avoided payroll, extra sales and risk reduction.

The number of working weeks is another claim to earn. If the eight-hour weekly saving lasts for only sixteen weeks around the audit, while questionnaires still arrive throughout the year, released time falls to 248 hours. At 50% cash capture, the first-year deficit widens to $13,830 and the recurring year loses $8,830. The original 46-week assumption therefore carries part of the recurring-business thesis itself.

A faster questionnaire can remove a bottleneck without creating the contract’s entire value. If the buyer would have signed later, the benefit may be earlier contribution and less review expense. If the review exposes a genuine weakness, a fast answer should not substitute for remediation. I would distinguish deals enabled, decisions accelerated and work avoided. The product has a recurring claim when those jobs keep arriving and its evidence remains useful for them.

I start with $300 million of ARR, lose a share of each money cohort, expand the surviving amount, and add new sales. New cohorts begin expanding the following year. The result is an ending run rate, with recognized revenue and cash outside this calculation.

The base loses $7 from each $100 of opening ARR, then expands the surviving $93 by 15% to add $13.95, giving $106.95 of ending old-cohort ARR because 93% gross retention multiplied by 115% expansion produces 106.95% net retention. I expand only the surviving business. Lost revenue gets no expansion credit.

I then assume new ARR of $100 million, $115 million, $130 million, $145 million, and $160 million over the five years. The scenario requires those new sales. Vanta has not disclosed the cohort retention, acquisition spending, or expansion rates needed to verify this case.

The base ends near $1.155 billion ARR. About $420 million comes from the original cohort, leaving roughly 64% from new cohorts and their expansion. I would put acquisition economics beside renewal when underwriting that growth.

At the coarse $18,750 normalization, $100 million of new ARR is equivalent to about 5,333 customers, and $160 million to about 8,533. I am not forecasting those logo counts. Larger enterprise contracts can reduce the number of customers required, while smaller contracts increase it. The conversion tells me why customer mix, sales effort, and contract size deserve attention alongside the ARR total.

Larger enterprises can bring more frameworks, suppliers and customer commitments into one contract. They can also demand integration work and expert support that a small-company license does not require. I would compare contribution after that work with the cash spent obtaining the account. An apparent move upmarket is economically attractive when the larger relationship earns back the larger acquisition and delivery commitment.

For an equivalent pro-rata investment, a 20% annualized return over five years with 20% future dilution requires exit equity value of $4.15 billion × 1.20⁵ ÷ 0.80, or $12.91 billion. At ten times exit ARR, the company needs about $1.291 billion ARR. At six times, it needs $2.151 billion. At twelve times, it needs $1.076 billion.

The base cohort model is close to the ten-times hurdle, but it does not reach it. That is why I would use about $3.71 billion as the maximum equivalent entry for the 20% target under this case. It is a calculation from assumed operating results, not a claim about a current private share price.

The downside case uses 85% gross retention, 5% expansion of surviving ARR, and new ARR rising from $50 million to $70 million. Net retention falls below 90%. The company still wins new business, but much of it replaces what leaves. Ending ARR is about $417 million, and six times ARR produces a modeled investor loss of 13.6% a year after dilution.

The upside uses 95% gross retention, 22% surviving-ARR expansion, and new ARR rising from $110 million to $210 million. At twelve times ending ARR, the modeled return is 31.1% a year. That case needs strong enterprise expansion and continued acquisition; it is not simply the base with a more generous valuation.

The model assumes equity value is the stated multiple of ARR and does not add an added net-cash adjustment. It also excludes fees, preference waterfalls, distributions, and any secondary-sale premium. Those details can materially change the return on a particular security.

A maintained history can make Vanta useful without making its data impossible to move. The valuable continuity is the relationship between controls, evidence, owners and unresolved commitments. Recreating that living process may be costly even when individual files are portable. That is a workflow advantage whose strength should appear in post-audit use and retention.

It is a different claim from a network effect. More Vanta customers do not automatically improve an existing customer’s controls. Common integrations and repeated assurance processes might lower delivery costs or improve the recipient’s experience, but those benefits need to be shown. Customer count is evidence of distribution, not a measurement of how strongly one participant benefits another.

Drata offers approved-content questionnaires, review, and answer reuse. I’d expect competition around the recurring job. Vanta has to make current evidence and exception resolution easier enough to earn the next renewal.

Vanta’s export documentation permits section-level exports and documents limitations; it has no single export-everything function. That bounds the lock-in argument. It also fits the purpose of assurance: evidence must reach people outside the application. A product that makes the record easier to inspect and carry elsewhere may win more trust while making a competitor easier to adopt. Portability can be good for demand and uncomfortable for pricing power at the same time.

The countercase is that standardized outputs and competing automation let the buyer reproduce enough of the process at a lower price. The response has to be operational: current evidence, fewer unresolved exceptions and less repeated review work. Migration inconvenience can delay a loss, but I would pay a higher multiple for a product the customer keeps because each new review is easier to complete.

A first audit creates urgency and concentrates work in a short period. If subsequent use falls away, new sales can make the company grow while the original customer’s renewal becomes fragile. That pattern is consistent with an effective audit-preparation product; it would support a different valuation from a system that remains indispensable between audits.

The public growth milestone cannot distinguish that pattern from a deeply embedded recurring system. Rapid new sales can conceal weak retention for a time. Expansion by a few large customers can also conceal a weaker long tail. I would want cohorts grouped by customer size, acquisition period, and original use case, including customers that began with an audit and later adopted ongoing assurance work.

Vanta’s March 2026 product notes describe automatic renewals for customers with one to ten employees on selected plans. That is a reminder to pair renewal with active use and delivered value. Product update record.

The April company announcement describes a broader, continuously maintained system. That direction is consistent with the stronger thesis, but it leaves cohort durability unmeasured. I would compare audit-origin customers that adopted ongoing reviews with those still using only the original job. Their contribution after support, concessions and implementation would show whether the broader product changes the economics or mainly the sales presentation.

The best case for Vanta is a maintained process that lets successive reviews build on work already done. That is a credible recurring product: companies change, and their customers keep asking for evidence. Its value is clearest when an exception is found and resolved, rather than when another reassuring status appears on the dashboard.

The valuation nevertheless depends heavily on finding the next customer. Most of the modeled ending ARR comes from new cohorts and their expansion. Even excellent renewal does not make that acquisition free. A larger enterprise contract improves the case only when the added revenue earns more after integration, support and the cash needed to win it.

Portability makes this a fairer and harder commercial test. If exported records and competing automation let customers reproduce enough of the process cheaply, Vanta may solve a valuable problem while keeping little of the surplus. The stronger outcome is voluntary renewal because the next review is easier inside Vanta, even when the customer can leave with its evidence.

Under these assumptions, I would keep the $3.71 billion entry discipline for a 20% return. The $4.15 billion benchmark needs stronger results. Paid expansion that makes the same customer easier to serve would earn a higher view. The recurring problem is convincing, and the price must leave room to solve it profitably.