Comp AI’s $34M Series A: Continuous Agentic Compliance After the Audit

Audits were never designed for agents that ship weekly

On 17 September 2026, TechCrunch reported that Comp AI raised a $34 million Series A led by Roo Capital and Grand Ventures (about $37.5 million total funding). Founded by Lewis Carhart, Claudio Fuentes, and Mariano Fuentes after lessons from LeapAI’s SOC 2 grind, Comp AI builds agentic workflows for policies, evidence collection, continuous control monitoring, vendor assessments, and AI-assisted penetration testing — while stressing that agents draft and humans still approve, and that independent auditors are not replaced.

CEO Carhart’s sharpest line for product teams: imagine finishing SOC 2, then two weeks later deploying an AI agent that can access customer data or change permissions. The audit did not become invalid; it simply was not designed to tell you in real time what changed afterward. That is the gap continuous agentic compliance tries to close — and the same gap MENA scale-ups hit when enterprise buyers ask for fresh evidence mid-deal.

Engineering and UX implications

1. Evidence as a product surface. Treat control status, agent permission diffs, and audit trails as first-class UI — not PDF exports at quarter-end. Design systems should show “what changed since last attestation” in plain language for security and sales alike.

2. Human approval scales with consequence. Comp AI’s founders argue safeguards should increase as agents take more consequential actions. Encode that in workflow UX: low-risk drafts auto-queue; high-risk permission changes require named approvers.

3. Pen-test agents are dual-use careful. Automated testing of codebases and infrastructure helps startups move faster, but keep scope contracts and change windows explicit — AdSense-safe editorial note: this is about defensive continuous assurance, not offensive playbooks.

iFynx takeaway

Point-in-time compliance is a lagging metric in the agent era. Build products that emit continuous evidence and bilingual control narratives — or your next enterprise deal will stall while someone screenshots Confluence.

Originally published on iFynx.