Comp AI has raised $34 million in Series A funding to expand its security and compliance platform, as the company looks beyond automating audits toward continuously monitoring the systems and AI agents operating inside an organisation.
The round was led by Roo Capital and Grand Ventures and brings Comp AI’s total funding to $37.5 million. The company was founded in 2025 by Lewis Carhart, Claudio Fuentes and Mariano Fuentes, who had previously worked together on LeapAI, a workflow software company that grew to more than one million users before being shut down.
The founders encountered the problem that would eventually lead to Comp AI while trying to sell their previous product to larger companies. Enterprise customers required security reviews and evidence of controls such as SOC 2 before deals could proceed. Preparing for those reviews involved writing policies, collecting evidence from different systems and spending weeks on work that had little to do with improving the product itself.
Comp AI was built to automate much of that process. Its software uses AI agents to collect audit evidence, prepare security policies, assess vendors and monitor whether compliance controls continue to be followed. The company supports frameworks including SOC 2, ISO 27001, HIPAA and GDPR, and has also added automated penetration testing for identifying vulnerabilities in code and infrastructure.
The company does not replace the independent auditor responsible for formally examining a company’s controls. Instead, it operates around the audit process, collecting and organising the information required to demonstrate that those controls are working. Comp AI says its agents can continue performing this work after an audit has finished rather than requiring companies to assemble the same information manually when the next review begins.
AI agents create a new compliance problem
Continuous monitoring becomes more important as companies begin giving AI agents access to internal systems. An agent used for software development, for example, may be able to read source code, execute tests and create pull requests. Other agents may eventually receive permission to query customer information, call internal APIs, modify infrastructure or change access settings.
These activities are not fundamentally new security problems. Companies already have systems for managing identities, permissions and audit logs. What changes with AI agents is the number of actions that software can initiate without a person explicitly performing each step.
A company might complete a SOC 2 audit and shortly afterward deploy an agent with access to customer data or administrative permissions. The audit remains valid for what it examined, but the operational environment has changed. A compliance system therefore needs some way of determining whether the controls established during the audit continue to hold as new software, permissions and automated processes are introduced.
Comp AI is positioning continuous monitoring as part of the answer. The system can check whether expected controls remain in place and maintain evidence of changes over time. As agents become more capable, the company also expects businesses to need records showing what an agent accessed, what actions it attempted and whether those actions remained within the permissions it had been given.
Monitoring an agent is not the same as controlling it
This creates a distinction between compliance monitoring and runtime enforcement. A monitoring system can identify that an agent changed a cloud permission and alert the security team after the change. An enforcement system would examine the request before it was executed and decide whether the agent had permission to make it.
The latter becomes difficult at scale. Requiring human approval for every action would remove much of the benefit of autonomous agents, while allowing every action to proceed automatically would create obvious security risks. Organisations are more likely to apply different controls according to the potential consequence of an action. Editing documentation, for example, may require little supervision, while changing production permissions or accessing customer records may require additional verification or explicit approval.
This also means that agent security will depend heavily on identity. If several agents operate using the same service account, reconstructing which one performed a particular action becomes difficult. Giving agents separate identities and narrowly defined permissions would make it easier to determine what each system was allowed to do and what it actually did.
That brings compliance software closer to identity management, observability and runtime security. Comp AI’s present product is primarily concerned with automating compliance and security work, but the company is already describing compliance as the starting point for a broader system of continuous, AI-driven security. Its existing platform collects evidence and monitors controls; the longer-term opportunity is to apply similar mechanisms to increasingly autonomous software.
The $34 million round comes as the distinction between human users, traditional applications and autonomous agents is becoming less clear inside enterprise systems. Companies will still need periodic audits, but audits alone cannot describe every change that takes place afterward. As more software receives credentials and permission to act, security teams will increasingly need a record not only of which controls exist, but of which machines used them and what those machines were allowed to do.