Comp AI raises $34M to monitor the controls between SOC 2 audits
The startup's agents draft security policies and gather audit evidence, and its founders say a person still approves each policy while an independent auditor still signs the report.
The Product Desk
What happened
- Comp AI said on Thursday that it had raised a $34 million Series A round led by Roo Capital and Grand Ventures.
- Lewis Carhart, Claudio Fuentes and Mariano Fuentes founded the company last January, with Carhart taking the CEO seat because the idea was his.
- The platform's agents help write company security policies and collect evidence for security audits, and it continuously monitors whether a company is meeting its compliance controls.
- Carhart said the software helps companies meet and maintain those security requirements but does not replace actual independent audit review.
- Comp AI also sells AI-powered penetration testing that Carhart said proactively tests codebases and infrastructures for vulnerabilities.
Why it matters
- What it limits constraint Automating the evidence work shortens the scramble, but the deal still waits on an independent auditor's report, so a team hoping this moves the date a customer gets its letter will be disappointed.
- Who has to decide decision Finance has to price this as a second line beside the audit fee and the reviewer's time, because the founders say people still onboard the AI and keep the workflow running.
- Who's exposed exposure The state a buyer is paying to see is the fortnight after sign-off, when an agent gets permission to touch customer data and the last audit was not built to report on it.
- What doesn't add up contradiction Carhart argues the need is for continuous and perhaps autonomous compliance, while the company's own account of the product keeps a human approval step on every policy an agent drafts.
Next story · Invest · 3d ago
US bank regulators ask whether humans can still pull the plug on AIConfirmed2 publishers
The buying moment is a procurement email late in a sales cycle. "For a lot of software companies, security and compliance are directly tied to revenue," Carhart told TechCrunch, giving the example of a customer that asks a startup for a SOC 2 report before closing a deal [17]. Claudio Fuentes has been on the receiving end of that request. "It took us a couple of months of doing things by hand, and the whole time it meant taking our eyes off building the product," he said of the SOC 2 process at their previous startup [6][5].
What the platform watches is the state of the systems after the auditor leaves. "Imagine a company completes its SOC 2 audit," Carhart said, "and two weeks later deploys a new AI agent that can access customer data, change permissions across an internal system, or introduce a new vulnerability through code deployment" [12]. "The audit didn't become invalid; it simply wasn't designed to tell you in real time what changed afterward" [13]. Mariano Fuentes said companies adopting AI need to show what an agent accessed, what it tried to do and whether it stayed inside the boundaries it was given. Comp AI is starting with permissions and accountability, he said [20].
Comp AI has raised $37.5 million to date [18]. Subtract the Series A and roughly $3.5 million came before it [19]. TechCrunch's report does not include pricing, a customer count, or results from any customer's audit [16], and Vanta and Drata are already selling into the same buyer [15]. The company that feels the gap hardest is the one whose next enterprise contract is waiting on a report it cannot produce. Carhart's pitch is that "What Comp AI automates is much of the work companies traditionally have to do around that process" [7].
What matters for budgeting is whether someone outside your company has to sign the artifact, and how often the underlying state changes. Policies and evidence packets get signed and change once or twice a year. An agent can draft them, and "An agent might draft a policy, for example, but a person still reviews and approves it," Carhart said [10]. Permissions and code deployments change in the weeks after an audit closes, and no auditor is looking at them then. That second box is where continuous monitoring adds something new. It also lands as a new line beside the audit fee, since human workers still onboard the AI and maintain the agentic workflow [9]. "As agents take on more consequential actions over time, we believe the level of safeguards and human approval should increase accordingly," Carhart said [11].
What to watch
- Whether Comp AI publishes pricing or customer numbers that let a buyer compare it with Vanta or Drata.
- Whether any audit firm accepts agent-collected continuous evidence in place of point-in-time sampling.
- Whether the AI penetration testing product produces findings a customer or a third party will describe on the record.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence45
- Adoption52
- Hype gap+18
- Incentives74
- Confidence58
Perspective Coverage
3 publishers- Builder
- Builder 35%
- Operator
- Operator 35%
- Investor
- Investor 30%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Comp AI, a cybersecurity and compliance startup, announced on Thursday that it raised a $34 million Series A round led by Roo Capital and Grand Ventures.
- [2]
Comp AI says it is building an agentic platform in which AI agents help write company security policies and collect evidence for security audits, and the platform also continuously monitors whether a company is meeting compliance controls.
- [3]
Comp AI was founded last January by Lewis Carhart (CEO), Claudio Fuentes (COO) and his brother Mariano Fuentes (CTO); the trio said Carhart took the lead as CEO this time because the idea was his.
- [4]
The founders' previous startup, LeapAI, a workflow platform, ran for about two years and grew to more than a million users before they shut it down after not finding a "sticky enough use case to warrant continued investment."
- [5]
The founders learned how tedious the SOC 2 compliance process was as they tried to scale LeapAI to work with bigger enterprise clients.
- [6]
Claudio Fuentes said: "It took us a couple of months of doing things by hand, and the whole time it meant taking our eyes off building the product."
- [7]
Carhart said: "What Comp AI automates is much of the work companies traditionally have to do around that process."
- [8]
Carhart said the software helps companies meet and maintain security requirements but does not replace actual independent audit review.
- [9]
The founders said the platform does not replace humans: human workers help onboard the AI, support controls, and maintain the agentic workflow.
- [10]
Carhart said: "An agent might draft a policy, for example, but a person still reviews and approves it."
- [11]
Carhart said: "As agents take on more consequential actions over time, we believe the level of safeguards and human approval should increase accordingly."
- [12]
Carhart said: "Imagine a company completes its SOC 2 audit and two weeks later deploys a new AI agent that can access customer data, change permissions across an internal system, or introduce a new vulnerability through code deployment."
- [13]
Carhart said: "The audit didn't become invalid; it simply wasn't designed to tell you in real time what changed afterward."
- [14]
Comp AI also offers AI-powered penetration testing, which Carhart described as "where the platform proactively tests codebases and infrastructures for vulnerabilities."
- [15]
TechCrunch described Vanta and Drata as part of a wave of AI security and compliance companies.
- [16]
The TechCrunch report does not state Comp AI's pricing, its customer count, or results from any customer's audit.
- [17]
Carhart told TechCrunch: "For a lot of software companies, security and compliance are directly tied to revenue," citing as an example how a customer might ask a startup for a SOC 2 report before closing a deal.
- [18]
Comp AI has raised $37.5 million in funding to date.
- [19]
About $3.5 million of Comp AI's funding was raised before this Series A.
- [20]
Mariano Fuentes said that as companies adopt more AI they need to show what an agent accessed, what it tried to do, and whether it stayed within the boundaries given, and that Comp AI is tackling this by starting with permissions and accountability.
- [21]
Mariano Fuentes said: "We're building toward a security layer that can monitor and validate those kinds of risk more continuously as these systems evolve."
- [22]
Carhart said the rapid adoption and experimentation companies are doing with AI is creating a need for continuous, and perhaps autonomous, security and compliance platforms.
Sources
3 independent publishers whose own reporting we read for this story.
- siliconangle.comCompliance automation startup Comp AI raises $34M to push into security
2 articles · September 17, 2026
- techcrunch.comComp AI sets eyes on a continuously agentic future for security and compliance
2 articles · September 17, 2026
- thenextweb.comComp AI raises $34m to turn compliance into continuous monitoring
1 article · September 17, 2026