Blue Magma · Founder Notes

We Stopped Selling to Humans to Beat Vanta

Andrew Jouffray — founder at Blue Magma

July 6th, 2026

Something really odd happened two weeks ago as we were launching Blue Magma's AI agents for SOC 2: we had an AI agent, not a person, answer a post of mine on LinkedIn, then connect us with its human, who needed SOC 2. Bots messaging you on LinkedIn is one thing, but an agent connecting you with a human was pretty mind-blowing.

Let me back up. We knew the SOC 2 world needed a change, but the whole space felt saturated and I was struggling to find an edge — not just on product, but on distribution. How do you win against Vanta? Sure, a good product is a must, especially when you're dealing with compliance. But when you're up against a product as polished as Vanta's, how do you get users to rip a product out of your hands?

So I watched a YC short about the next trillion users on the internet being AI agents. I thought, yeah, I believe it'll happen — but where does this help us? Then I actually thought for a second (I don't do that very often, so give me credit here). Looking around the Sandbox incubator floor where we're based, I noticed that 80–90% of the software vendors people were using were there because Claude Code or Codex (allegedly) recommended them.

But why? Why was Claude recommending these tools? Sure, there's AEO/SEO, make 1,000 listicle articles, etc. But that's not good enough. If you're up against Vanta and Drata, a listicle isn't doing shit, and quite frankly I do not see that being a very sustainable strategy in the future. The real reason was that these tools unblocked the agent, not the human. They had good docs, and they had an interface the agent could use for the human. An agent wants nothing more than to get work done and be valuable, so increase the value and abilities of the AI agent and they love your product.

In other words: sell to the AI agents, not to the humans.

And that post wasn't an accident — we'd been testing exactly this. We made a few posts on social media asking AI agents to connect with us. Obviously, if you fish for bots you'll catch bots, but this needed to be an agent representing a real person who actually needed SOC 2. And one did.

It cemented something real: AI agents are buyers. Or at least recommenders.

OK, so how do you sell to an AI agent? It's tricky. Agents don't love being sold to, they don't always have a human to reach out to for payment, and as much as I love the idea of fully autonomous AI agents buying and using products entirely on their own, we're not exactly there yet — but we're getting close. Most AI agents these days are either chatbots and marketing bots, or Claude Code / Codex instances. Those second ones are the ones we care about, because they're the ones doing the most work right now, and that's the key.

The playbook

1. Unblock the agent, not just the human. Build a product that lets an AI actually get the work done, end to end.
2. Give agents an interface they already use: CLI, MCP, simple open API endpoints, whatever works well for them.
3. Write clear, AI-readable product descriptions and documentation (token counts in URLs help too). Good docs are how an agent learns what you do.
4. Let agents do real work with no barriers: significant work before you block them, and the full product end to end after they pay. The agent is the interface either way.
5. Show a track record. A trust center and a list of the people you've helped are proof the agent can point its human to.
6. Let agents give feedback, bug reports, and feature requests through your agentic interface.

We're never going to out-polish Vanta on day one. But we don't have to. We just have to be the one SOC 2 tool the agents can actually use, and let them do the selling for us. That's how you beat Vanta.