Comp AI Raises $34M for Continuous AI Compliance

The startup Comp AI secures $34 million in Series A funding to accelerate a security and compliance platform based on AI agents. Its founders advocate for a continuous monitoring approach, complemented by human oversight and without replacing independent audits.

Comp AI aims for continuous monitoring in the face of new agent risks

Lewis Carhart asserts that the rapid adoption of AI creates a need for continuous, even autonomous, security and compliance platforms. He cites the scenario where, after a SOC 2 audit, a company deploys an agent capable of accessing customer data, modifying internal permissions, or introducing a vulnerability through code. According to him, the audit does not become invalid, but it is not designed to reflect real-time changes that occur afterward. Mariano Fuentes adds that companies must be able to trace what an agent has accessed, what it attempted to execute, and whether it stayed within the established limits. He indicates that Comp AI addresses this issue primarily through permissions and accountability, and they are building a security layer intended to monitor and validate these risks more continuously as systems evolve. The company states that its platform is already continuously monitoring compliance control adherence.

$34M raised in Series A, led by Roo Capital and Grand Ventures

Comp AI announced a $34 million Series A funding round on Thursday, led by Roo Capital and Grand Ventures. To date, the startup has raised a total of $37.5 million in funding. The team hopes this capital will be used for product expansion.

Automation of SOC 2 tasks, AI-powered penetration testing, and maintained human role

Specializing in cybersecurity and compliance, Comp AI claims to be building an agent-based platform that automates tasks such as policy writing and audit evidence collection, and offers AI-powered penetration testing targeting codebases and infrastructures. Lewis Carhart argues that for many software companies, security and compliance are tied to revenue, as a client may require a SOC 2 report before signing, and that the solution automates a large part of the traditional work surrounding this process. However, the co-founders emphasize that the software does not replace independent audit reviews or human intervention. People continue to be involved to integrate AI, ensure controls, and maintain agent functionality; an agent can generate a policy, but human validation remains essential. According to Carhart, when agents perform more significant actions, the level of guarantees and approvals should then be increased.

A project born from the lessons of LeapAI and the burdens of SOC 2

Comp AI was founded in January by Lewis Carhart (CEO), Claudio Fuentes (COO), and Mariano Fuentes (CTO). Claudio and Mariano had built startups together for nearly a decade before inviting Carhart to join them at LeapAI, a workflow platform where Claudio was CEO and co-founder, Carhart was in charge of growth, and Mariano was a senior full-stack engineer. LeapAI operated for about two years and surpassed one million users, but its founders chose to shut it down due to a lack of a sufficiently strong use case to continue investment. They say they learned the mastery of LLMs and the necessity of a precise usage scope, as well as the difficulty of the SOC 2 process, which was deemed cumbersome, especially when transitioning to larger clients. Claudio Fuentes specifies that this process took them several months manually and diverted attention from product building.