Comp AI raises $34 million Series A to automate security and compliance with AI agents

Comp AI, a cybersecurity and compliance startup, announced in September 2026 that it has raised a $34 million Series A round led by Roo Capital and Grand Ventures, bringing its total funding to $37.5 million.

The company was founded by Lewis Carhart (CEO), Claudio Fuentes (COO), and Mariano Fuentes (CTO). The Fuentes brothers had spent nearly a decade building startups together before meeting Carhart, whom they brought on at their previous venture, LeapAI — a workflow platform that grew to over one million users before being shut down. The team cited a lack of a “sticky enough use case” as the reason for closing it.

That experience directly shaped Comp AI’s focus. While scaling LeapAI to serve enterprise clients, the founders found the SOC 2 compliance process slow and labor-intensive. “It took us a couple of months of doing things by hand, and the whole time it meant taking our eyes off building the product,” Claudio said.

Comp AI’s platform uses AI agents to handle compliance tasks such as drafting security policies, collecting audit evidence, and continuously monitoring whether a company meets its compliance controls. It also offers AI-powered penetration testing to identify vulnerabilities in codebases and infrastructure. The platform is designed to work alongside human employees, not replace them — agents draft policies, but people review and approve them.

“As agents take on more consequential actions over time, we believe the level of safeguards and human approval should increase accordingly,” Carhart said.

The company argues that traditional compliance audits are poorly suited to the pace of AI adoption. Carhart noted that a company could complete a SOC 2 audit and then deploy a new AI agent days later that changes permissions or introduces new vulnerabilities — developments the original audit was not designed to track in real time.

The Series A capital is intended to support product expansion as Comp AI works toward what it describes as continuous, and potentially autonomous, security and compliance monitoring.