Comp AI sets eyes on a continuously agentic future for security and compliance

Comp AI, a cybersecurity and compliance startup, announced that it has raised a $34 cardinal Series A circular connected Thursday. The circular was led by Roo Capital and Grand Ventures. 

The institution was founded past January by Lewis Carhart (CEO), Claudio Fuentes (COO), and his brother, Mariano Fuentes (CTO). Claudio and Mariano had been gathering startups unneurotic for astir a decade, met Carhart a fewer years ago, and invited him to articulation LeapAI, a workflow level they were building. Claudio was the CEO and co-founder, portion Carhart served arsenic caput of maturation and Mariano was a elder full-stack engineer. The startup ran for astir 2 years, increasing to much than a cardinal users, but they yet decided to unopen it down aft not uncovering a “sticky capable usage lawsuit to warrant continued investment.”

That acquisition taught them a lot, though, they recalled. For one, they learned however to physique with LLMs and the value of uncovering a circumstantial usage lawsuit for a product. They besides learned however tedious the SOC 2 compliance process was, particularly arsenic they tried to standard the level to enactment with bigger endeavor clients.

“It’s a precise obscure process,” Claudio said. “It took america a mates of months of doing things by hand, and the full clip it meant taking our eyes disconnected gathering the product.”

Alas, a startup thought was born. This time, Carhart would instrumentality the pb arsenic CEO due to the fact that it was his idea, the trio said. Comp AI says it’s gathering an agentic level to tackle tedious information and compliance work; that means having AI agents assistance constitute institution information policies oregon cod grounds for information audits. The level besides continuously monitors whether a institution is gathering compliance controls. Comp AI is portion of the adjacent procreation of cybersecurity startups emerging to assistance companies tally much efficiently successful the agentic era. 

“For a batch of bundle companies, information and compliance are straight tied to revenue,” Carhart told TechCrunch, citing, for example, however a lawsuit mightiness inquire a startup for a SOC 2 study earlier closing a deal. “What Comp AI automates is overmuch of the enactment companies traditionally person to bash astir that process.”

The bundle helps companies conscionable and support those information requirements, helium continued, but doesn’t regenerate existent autarkic audit review. It besides doesn’t regenerate humans, the trio said. Human workers assistance onboard the AI, enactment controls, and support the agentic workflow.

“An cause mightiness draught a policy, for example, but a idiosyncratic inactive reviews and approves it,” Carhart said. “As agents instrumentality connected much consequential actions implicit time, we judge the level of safeguards and quality support should summation accordingly.” 

The institution besides offers AI-powered penetration testing, “where the level proactively tests codebases and infrastructures for vulnerabilities,” Carhart said. The squad hopes this Series A superior volition assistance with merchandise expansion. It has raised $37.5 cardinal successful backing to date. 

There has been overmuch speech astir the caller question of information risks successful the agentic epoch (and with it, a question of AI information and compliance companies similar Vanta and Drata). Carhart said the accelerated adoption and experimentation companies are doing with AI is creating a request for continuous — and possibly autonomous — information and compliance platforms. 

“Imagine a institution completes its SOC 2 audit and 2 weeks aboriginal deploys a caller AI cause that tin entree lawsuit data, alteration permissions crossed an interior system, oregon present a caller vulnerability done codification deployment,” helium said. “The audit didn’t go invalid; it simply wasn’t designed to archer you successful existent clip what changed afterward.” 

As companies follow much AI, Mariano said, they besides request to amusement what an cause accessed, what it tried to do, and whether it stayed wrong the boundaries given. Comp AI is tackling this by starting with permissions and accountability, helium continued. “We’re gathering toward a information furniture that tin show and validate those kinds of hazard much continuously arsenic these systems evolve.”