Vanta after the audit

A company can complete an audit and immediately begin changing the environment the audit described. A new application gets access to customer data. An employee moves to another role. A policy changes. Another buyer asks for proof using a different questionnaire. Keeping the record current is a separate job from assembling it once.

Vanta's product documentation makes that recurring work tangible. Automated tests retain evidence about what was checked and the data retrieved from connected services. Customers can share that evidence with an auditor, who performs the assessment. The software coordinates the work; it does not make the independent audit disappear. Automated test evidence, auditor workflow.

The economic attraction is reuse. Evidence collected for one purpose can support another review if it is current, relevant, and approved for that use. A maintained answer can help the next questionnaire. A documented control can support several obligations. The customer pays once for a system that helps manage repeated work rather than starting a new evidence-gathering exercise each time.

The most valuable recurring process would connect a failed test to a responsible person, a correction, and a new piece of evidence. A dashboard that displays the failure is easier to replace than a process that reliably gets the correction completed. I would look for the latter in customer usage and renewal, because the display alone can become a feature in someone else's product.

Vanta announced a $150 million Series D at a $4.15 billion valuation in July 2025, when it reported serving more than 12,000 companies. In April 2026, it announced that ARR had crossed $300 million and thanked 16,000 customers. Those are company-reported checkpoints, not audited financial statements available in this analysis. Series D announcement, April ARR milestone.

The growth is encouraging, but I would keep the dates attached. Dividing the July financing value by the following April's ARR gives roughly 13.8 times. That is a comparison across two dates. It is neither the multiple investors paid in the Series D nor an observable price at which I can purchase shares today.

For the model, I start with the disclosed $300 million run-rate and treat $4.15 billion as a hypothetical entry benchmark. I give no credit for unreported growth after the April checkpoint. The five-year clock begins at this modeled starting state; it does not reconstruct the return of investors who entered in July 2025.

The ratio of $300 million ARR to 16,000 customers is $18,750. I use it below to make an illustrative buyer budget concrete. It is not disclosed list pricing, verified average contract value for a paid cohort, or evidence that every customer pays that amount. The public measures do not provide the segmentation needed to make those claims.

Suppose a customer pays that normalized $18,750 per year and spends another assumed $5,000 implementing the software in year one. I assume it saves eight hours a week across 46 weeks of control and evidence work. Separately, it answers ten questionnaires a month and reduces each from ninety to thirty minutes. The weekly estimate excludes questionnaire work, so the same hours are not counted twice.

That releases 488 hours a year. At an assumed $80 of avoidable labor cost per hour, the full amount is $39,040. But a salaried security employee's time does not automatically become cash. I therefore test how much of that capacity replaces spending the buyer would actually have incurred, such as a contractor or an additional hire.

With half the released capacity converted into avoided cash spending, the first year is $4,230 short of payback. Recurring annual benefit is only $770 after the subscription. Full cash capture produces a much stronger result, while 25% capture fails to cover the subscription even after implementation is complete. First-year cash payback requires about 60.8% capture under these assumptions.

The customer might still buy at lower cash capture. More work can get completed with the existing team; control failures can be addressed sooner; buyers can receive better evidence. Those are plausible benefits that the narrow cash model omits. I would establish them separately rather than use theoretical salary savings to imply that payroll falls.

The number of working weeks is another claim to earn. If the eight-hour weekly saving lasts for only sixteen weeks around the audit, while questionnaires still arrive throughout the year, released time falls to 248 hours. At 50% cash capture, the first-year deficit widens to $13,830 and the recurring year loses $8,830. The original 46-week assumption therefore carries part of the recurring-business thesis itself.

I am equally careful with the sales argument. Finishing a questionnaire sooner can help a deal move. It does not make the whole contract incremental revenue. The relevant counterfactual is whether the company would otherwise lose the deal, win it later, or spend more to complete the review. A buyer that uses Vanta for every enterprise sale has a more credible recurring job than one that used it intensively for a single audit and then stopped.

The company-level model begins with $300 million of ARR and tracks money cohorts. I retain a share of each cohort, expand the retained amount, and then add that year's new ARR. The added cohort gets no expansion until the following year. These are ending run-rates, not recognized revenue, cash receipts, or profits.

In the base, gross ARR retention is 93%. The retained amount expands by 15%, producing net ARR retention of 106.95%: 0.93 × 1.15. Starting with $100 of ARR, $7 is lost and $13.95 of expansion is added to the surviving $93. The old cohort ends at $106.95. Expansion is measured after losses, so the model does not apply it to the revenue that disappeared.

I then assume new ARR of $100 million, $115 million, $130 million, $145 million, and $160 million over the five years. These are authored acquisition requirements. Vanta has not disclosed the cohort retention, acquisition spending, or expansion rates needed to verify this case.

The base reaches about $1.155 billion ARR. The original $300 million cohort grows to roughly $420 million; the remainder comes from new cohorts and their later expansion. This makes the burden of the pitch visible. Moderately positive retention and expansion help, but they do not do most of the work. The company still has to add substantial new business year after year.

At the coarse $18,750 normalization, $100 million of new ARR is equivalent to about 5,333 customers, and $160 million to about 8,533. I am not forecasting those logo counts. Larger enterprise contracts can reduce the number of customers required, while smaller contracts increase it. The conversion tells me why customer mix, sales effort, and contract size deserve attention alongside the ARR total.

Moving upmarket can support larger contracts and more use cases. It can also bring longer sales cycles, implementation demands, and procurement work. I would need the incremental gross profit and acquisition payback of that motion. A larger average contract does not automatically make growth more efficient.

For an equivalent pro-rata investment, a 20% annualized return over five years with 20% future dilution requires exit equity value of $4.15 billion × 1.20⁵ ÷ 0.80, or $12.91 billion. At ten times exit ARR, the company needs about $1.291 billion ARR. At six times, it needs $2.151 billion. At twelve times, it needs $1.076 billion.

The base cohort model is close to the ten-times hurdle, but it does not reach it. That is why I would use about $3.71 billion as the maximum equivalent entry for the 20% target under this case. It is a calculation from assumed operating results, not a claim about a current private share price.

The downside case uses 85% gross retention, 5% expansion of retained ARR, and new ARR rising from $50 million to $70 million. Net retention falls below 90%. The company still wins new business, but much of it replaces what leaves. Ending ARR is about $417 million, and six times ARR produces a modeled investor loss of 13.6% a year after dilution.

The upside uses 95% gross retention, 22% retained-ARR expansion, and new ARR rising from $110 million to $210 million. At twelve times ending ARR, the modeled return is 31.1% a year. That case needs strong enterprise expansion and continued acquisition; it is not simply the base with a more generous valuation.

The exit multiples and dilution are assumptions. I do not have audited margin, cash-burn, balance-sheet, or security-rights information in this evidence set. The model assumes equity value is the stated multiple of ARR and does not add a separate net-cash adjustment. It also excludes fees, preference waterfalls, distributions, and any secondary-sale premium. Those details can materially change the return on an actual investment.

Vanta has a plausible compounding advantage if it becomes the maintained record of controls, evidence, vendors, and customer commitments. More repeated work can improve the product's usefulness: the next review begins with an existing record and known owners rather than a blank spreadsheet. The customer can become more reluctant to replace that operating process as it grows.

I would not call that a network effect simply because Vanta has many customers. Another customer joining does not necessarily make an existing customer's controls more useful. A stronger claim would need evidence that common workflows, integrations, or reusable assurance processes improve the service for participants in a way a competitor cannot cheaply reproduce.

The competition is already pointed at the same job. Drata offers questionnaires generated from approved trust content, review workflows, and reusable answers. Vanta cannot rely on owning the idea of automating a questionnaire. Drata's assurance product.

Data portability also limits a simple lock-in argument. Vanta documents exports for controls, evidence, vendors, risks, and questionnaires, with specific limitations and no single export-everything function. Moving a live process can remain costly, but I would distinguish the cost of recreating a functioning workflow from the mere presence of stored documents. Export documentation.

The advantage I would pay for is a customer that stays because the next month's work is easier and better. If the reason for staying is chiefly migration friction or the timing of the next audit, a competitor can attack the renewal with assistance and a lower price.

A young company can use Vanta heavily while preparing its first audit and much less afterward. If that pattern dominates, the product may have an urgent initial sale and a weak recurring claim. Retention can deteriorate as startup budgets tighten, companies close, or a larger customer consolidates tools.

The public growth milestone cannot distinguish that pattern from a deeply embedded recurring system. Rapid new sales can conceal weak retention for a time. Expansion by a few large customers can also conceal a weaker long tail. I would want cohorts separated by customer size, acquisition period, and original use case, including customers that began with an audit and later adopted ongoing assurance work.

Vanta's March 2026 product notes describe automatic renewals for customers with one to ten employees on selected plans. That is a reminder to pair renewal with active use and delivered value. A continuing contract can be a useful signal without proving that the customer has a recurring job for the product. Product update record.

The current company's direction is consistent with the stronger thesis. Its April announcement describes continuously updated evidence and broader risk workflows. I treat that as product direction. The investment evidence would be post-audit use, renewal without large concessions, and expansion that earns attractive gross profit after implementation and support.

Of these two private-company pitches, Vanta gives me a clearer bridge from recurring work to a recurring budget and a less demanding headline entry benchmark. Its disclosed ARR checkpoint also lets me start a cohort model with an identified quantity rather than normalize an unknown current revenue base.

I would advance it if audit-origin customers keep using the system between audits, if retention and expansion approach the base assumptions, and if new ARR is acquired without consuming an unreasonable share of future gross profit. I would also verify whether the subscription helps complete work the buyer values enough to fund, rather than rely on a wage-based time-savings calculation.

I would stop advancing the pitch if renewals mostly depend on discounts around audit dates, if usage falls after the report, or if enterprise expansion brings costs that erase the benefit of larger contracts. The company can remain useful while producing an unattractive investor outcome.

At equivalent entry economics below about $3.71 billion, the modeled base clears my 20% hurdle. At the disclosed $4.15 billion benchmark, I would need stronger evidence or stronger results. The business I would want to own is the work that continues after the audit: keeping evidence current, resolving exceptions, and helping the next buyer make a decision. The return depends on how reliably Vanta turns that work into retained, profitable revenue.