Comp AI Raises $34M to Automate Compliance With AI Agents

Comp AI has closed a $34 million Series A led by Roo Capital and Grand Ventures. TechCrunch

The financing was disclosed on Sept. 17, 2026, and brings total funding to $37.5 million. The company was founded by Lewis Carhart, Claudio Fuentes and Mariano Fuentes, who serve as chief executive, chief operating officer and chief technology officer respectively.

Comp AI is a cybersecurity and compliance startup building an agentic platform for security work. Its AI agents write security policies and collect evidence for security audits, two functions that normally pull engineering time away from product work and load governance, risk and compliance teams with manual follow-up.

The platform also continuously monitors whether a company is meeting compliance controls. In parallel, Comp AI offers AI-powered penetration testing that proactively tests codebases and infrastructure for vulnerabilities.

The broader context here is a shift from compliance as periodic preparation to compliance as a persistent runtime property. Earlier tooling centralized documents, assigned owners to controls and pulled API data for evidence. The agentic approach tries to close the loop inside that system, drafting language, retrieving proof, detecting drift and triggering validation without a human opening a ticket.

In my view, the interesting test is not whether agents can generate policies. Generation is cheap. Maintenance is hard. Policies decay as infrastructure changes, vendors turn over and access patterns evolve. Evidence goes stale between audit windows. A design that pairs initial drafting with continuous control monitoring addresses the correct failure mode, provided the monitoring reflects actual enforcement state rather than dashboard state.

Looking at what this means for practitioners, the effects divide between toil reduction and assurance burden. For security and platform engineers, automated evidence collection and proactive testing could turn audit readiness from a quarterly scramble into background operation. For CISOs, auditors and customers reviewing reports, machine-generated artifacts still need versioning, approval trails and clear attestation boundaries. Accountability does not disappear when drafting is automated. It moves to review, configuration and change control.

Worth flagging in that respect is the penetration testing component. Conventional tests are scoped, time-boxed and human-led, with negotiated rules of engagement. Testing codebases and infrastructure with AI agents offers wider coverage and shorter cycles between code change and finding. The operational bar will be signal quality. Teams will accept autonomous findings only if duplicates are suppressed, exploitability is validated, severity maps to service ownership and execution is safe around production-adjacent systems. Without that discipline, more findings simply mean more triage.

Looking further out, the direction Comp AI is pursuing points toward compliance embedded in engineering workflows rather than layered on before an audit. Controls, evidence and offensive validation would run continuously, with humans setting policy intent and reviewing exceptions. That endpoint is plausible, and optimistic in the best sense, because it could free small security teams from repetitive collection work and let them focus on architecture and response. It will stand or fall on inspectability. Customers and auditors must be able to see what an agent checked, reproduce the result and defend it externally.