Comp AI Raises $34M for Agentic Security and Compliance

Comp AI, a cybersecurity and compliance startup, has raised a $34 million Series A to automate some of the most repetitive work behind enterprise security audits. The company is building AI agents that help write policies, collect evidence, monitor controls, and test code and infrastructure for vulnerabilities.

What happened

In a report for TechCrunch, Dominic-Madori Davis reports that the round was led by Roo Capital and Grand Ventures. The company was founded by Lewis Carhart, Claudio Fuentes, and Mariano Fuentes after the founders experienced the slow, manual SOC 2 process while scaling an earlier startup.

Comp AI says its platform continuously checks whether a company is meeting compliance controls instead of treating security as a point-in-time audit. It also offers AI-powered penetration testing that proactively probes codebases and infrastructure for weaknesses. The startup has raised $37.5 million in total funding.

The system is designed to keep people in the loop. An agent can draft a policy or gather evidence, but a human reviews and approves the result. The founders told TechCrunch that safeguards and approval requirements should increase as agents gain the ability to take more consequential actions.

Why builders should care

The important shift is from periodic compliance paperwork to continuous runtime accountability. A company can pass a SOC 2 audit and then deploy an AI agent that reads customer data, changes permissions, or ships code two weeks later. The audit is not necessarily wrong; it simply cannot describe everything that changed afterward.

That gap is becoming a product and architecture problem for AI builders. Agent workflows need durable records of what each agent accessed, which tools it called, what it attempted, and which human approved an irreversible action. Security controls also need to follow the execution graph, not just the application perimeter.

For teams building with n8n and similar orchestration tools, the practical pattern is straightforward: separate read and write credentials, restrict outbound destinations, cap autonomous retries, and require approval before permission changes, deployments, payments, or external publication. Continuous checks can then validate whether the workflow still behaves inside its intended boundaries.

Comp AI’s funding is another signal that agentic software is creating demand for a new security layer. The winning systems will not be the ones that remove humans from every step. They will be the ones that automate the routine work while making authority, evidence, and escalation visible when the stakes rise.