Comp AI, a company specializing in cybersecurity and compliance, announced that it had raised $34 million in a Series A funding round led by Roo Capital and Grand Ventures. The company intends to use the funding to expand its platform, which employs AI agents for tasks that typically required evidence collection, documentation preparation, and manual monitoring of security controls.
Comp AI says its platform can help write security policies, compile the evidence required for audits, and continuously monitor a company’s adherence to compliance controls. It also offers AI-powered penetration testing to proactively examine software codebases and infrastructure for vulnerabilities. According to the company, the total funding it has raised to date is $37.5 million.
From the LeapAI Experience to Compliance Automation
Comp AI was founded in January of last year by Lewis Carhart as chief executive officer, alongside brothers Claudio Fuentes and Mariano Fuentes, who serve as chief operating officer and chief technology officer, respectively. The founders had previously worked together at LeapAI, a workflow platform that surpassed one million users in roughly two years, before it was shut down because they could not find a sufficiently sticky use case to justify continued investment.
The founders explained that the LeapAI experience also revealed to them the complexity and time required to prepare for SOC 2, particularly when attempting to serve larger enterprise customers. According to Claudio Fuentes, carrying out the process took months of manual work, diverting the team from product development.
What Changes in Practice?
Comp AI connects security and compliance with software companies’ ability to close new deals, as a customer may request a SOC 2 report before entering into a contract. The company’s idea is to turn part of this work into a continuous process instead of treating compliance as a separate procedure reviewed at a single point in time.
This idea is based on a practical problem highlighted by Carhart: a company may complete a SOC 2 audit and then, two weeks later, deploy a new AI agent capable of accessing customer data, changing internal permissions, or introducing a vulnerability through a software deployment. This does not mean the previous audit has become invalid, but it does not necessarily show what changed after it was conducted.
Automation Does Not Eliminate Human Review
The company says its platform does not replace independent audits or the employees responsible for compliance. Employees participate in configuring agents, supporting controls, and managing workflows, while an agent can, for example, prepare a draft policy that a person then reviews and approves.
Comp AI believes that the level of safeguards and human approval should increase as agents take on more consequential actions. At its current stage, the company is also focusing on permissions and accountability, including knowing what the agent accessed, what it attempted to do, and whether it remained within its defined boundaries.
certi.news reading: The importance of the round is not limited to the size of the funding; it lies in addressing a gap between periodic audits and continuous change in AI environments. However, the model’s success remains tied to the company’s ability to provide reliable monitoring without turning the agents themselves into a new source of risk, and to how responsibility is divided among the platform, employees, and independent auditors. The source provides no details about the markets Comp AI is targeting or the compliance certifications supported by the platform outside SOC 2.