Comp AI raises $34M Series A to automate security compliance

Comp AI, a cybersecurity and compliance startup, has raised a $34 million Series A round led by Roo Capital and Grand Ventures, bringing its total funding to $37.5 million. The company is building an agentic platform where AI agents help write company security policies, collect evidence for security audits, and continuously monitor whether a company is meeting its compliance controls. It also offers AI-powered penetration testing, in which the platform proactively tests codebases and infrastructure for vulnerabilities.

The startup was founded last January by CEO Lewis Carhart, COO Claudio Fuentes, and CTO Mariano Fuentes, Claudio’s brother. Claudio and Mariano had been building startups together for nearly a decade before meeting Carhart a few years ago and inviting him to join LeapAI, a workflow platform they were building — with Claudio as CEO, Carhart heading growth, and Mariano working as a senior full-stack engineer. LeapAI ran for about two years and grew to more than a million users, but the trio eventually shut it down after failing to find, as they put it, a “sticky enough use case to warrant continued investment.” The experience taught them how to build with large language models, and also how tedious SOC 2 compliance became as they tried to scale the platform for bigger enterprise clients — Claudio described it as “a very obscure process” that took months of manual work and pulled focus away from the product. This time, Carhart took the CEO role, since the idea was his.

Carhart said security and compliance are directly tied to revenue for many software companies, since a customer might require a SOC 2 report before closing a deal, and that Comp AI automates much of that traditionally manual work. He was careful to note the platform doesn’t replace independent audit review or human oversight — an agent might draft a policy, but a person still reviews and approves it, and the company believes safeguards and human approval should scale alongside how much autonomy its agents are given.

Comp AI is part of a fresh wave of AI security and compliance startups, alongside companies like Vanta and Drata, responding to the risks that agentic AI introduces. Carhart argued that a SOC 2 audit can go stale the moment a company deploys a new AI agent with access to customer data or system permissions: “The audit didn’t become invalid; it simply wasn’t designed to tell you in real time what changed afterward.” Mariano Fuentes said the company’s approach starts with tracking agent permissions and accountability, aiming to build a security layer that can monitor and validate that kind of risk continuously as the underlying systems evolve.

Why it matters

As companies deploy AI agents faster than compliance frameworks can track them, the gap between point-in-time audits and continuous risk is drawing a crowd of well-funded challengers betting on the same fix.