Comp AIa cybersecurity and compliance startup, announced it raised a $34 million Series A round on Thursday. The round was led by Roo Capital and Grand Ventures.
The company was founded last January by Lewis Carhart (CEO), Claudio Fuentes (COO) and his brother, Mariano Fuentes (CTO). Claudio and Mariano had been building startups together for almost a decade, meeting Carhart a few years ago and inviting him to join LeapAI, a workflow platform they were building. Claudio was the CEO and co-founder, while Carhart served as head of growth and Mariano was a senior full-stack engineer. The startup ran for about two years and grew to over a million users, but they ultimately decided to shut it down after failing to find a “use case compelling enough to justify continued investment.”
However, they remembered that that experience taught them a lot. On the one hand, they learned how to build with LLM and the importance of finding a specific use case for a product. They also learned how tedious the SOC 2 compliance process was, especially when trying to scale the platform to work with larger enterprise customers.
“It’s a very dark process,” Claudio said. “It took us a couple of months to do things by hand, and all that time meant taking our eyes off the construction of the product.”
Unfortunately, a startup idea was born. This time, Carhart would take the lead as CEO because it was his idea, the trio said. Comp AI says it is building an agent platform to tackle the tedious work of security and compliance; That means having AI agents help draft company security policies or collect evidence for security audits. The platform also continually monitors whether a company is meeting compliance controls. Comp AI is part of the next generation of cybersecurity startups emerging to help businesses function more efficiently in the age of agency.
“For many software companies, security and compliance are directly tied to revenue,” Carhart told TechCrunch, citing, for example, how a client might ask a startup for a SOC 2 report before closing a deal. “What Comp AI automates is a lot of the work that companies traditionally have to do around that process.”
The software helps companies meet and maintain those security requirements, he continued, but it is not a substitute for actual independent audit review. Nor does it replace humans, the trio said. Human workers help incorporate AI, support controls, and maintain agent workflow.
“An agent can write a policy, for example, but a person still reviews and approves it,” Carhart said. “As officers take more significant actions over time, we believe the level of safeguards and human approval should increase accordingly.”
The company also offers AI-powered penetration testing, “where the platform proactively tests code bases and infrastructure for vulnerabilities,” Carhart said. The team hopes this Series A capital will help with product expansion. To date it has raised $37.5 million in funding.
There’s been a lot of talk about the new wave of security risks in the agent era (and with it, a wave of AI security and compliance companies like Vanta and Drata). Carhart said the rapid adoption and experimentation companies are doing with AI is creating the need for continuous, and perhaps autonomous, security and compliance platforms.
“Imagine a company completes its SOC 2 audit and two weeks later deploys a new AI agent that can access customer data, change permissions on an internal system, or introduce a new vulnerability through code deployment,” he said. “The audit did not become invalid; it simply was not designed to report in real time what changed next.”
As companies adopt more AI, Mariano said, they also need to show what an agent accessed, what they tried to do and whether they stayed within established limits. Comp AI is addressing this starting with permissions and accountability, he continued. “We’re building a security layer that can monitor and validate those types of risks more continuously as these systems evolve.”
When you purchase through links in our articles, we may earn a small commission. This does not affect our editorial independence.