Comp AI Raises $34M to Let AI Agents Run Your Company's Security Compliance
Nobody dreams of growing up to do compliance paperwork. It is the corporate world's most thankless chore: months of evidence collection, policy writing, and screenshot-gathering, all so an auditor can confirm you did the security work you already did. A 20-month-old Miami startup just raised $34 million on the bet that AI agents can do the whole miserable job for you — and the venture world is buying in.
Comp AI announced Thursday that it has closed a $34 million Series A round led by Roo Capital and Grand Ventures, bringing its total raised to more than $36 million. The company, incorporated as Bubba AI Inc., was founded just last January by three co-founders — CEO Lewis Carhart, COO Claudio Fuentes, and CTO Mariano Fuentes — and says more than 1,000 companies already use its platform, including Dub Technologies and OpenCode.
The raise lands at a moment when "agentic" is the most contested word in enterprise software, and when every compliance startup is racing to prove its AI does more than autocomplete forms. Comp AI's pitch is sharper than most: not AI-assisted compliance, but compliance run by agents that read your systems, write your policies, and keep watching after the audit is over.
Illustration: TechPulse USA (original artwork)
From a failed startup to a compliance bet
Comp AI exists because its founders suffered through the exact problem they now sell a cure for. Before Comp AI, the trio built LeapAI, a workflow platform that grew to more than a million users over two years before they shut it down, unable to find what they called "a sticky enough use case to warrant continued investment."
What stuck with them was not the product but the pain. As LeapAI tried to scale into larger enterprise customers, the team had to get SOC 2 compliant — the security certification that has become a tollbooth for selling software to serious businesses. "It's a very obscure process," Claudio Fuentes told TechCrunch. "It took us a couple of months of doing things by hand, and the whole time it meant taking our eyes off building the product."
That experience became the founding thesis. Carhart took the CEO role this time — it was his idea, the founders say — and the company set out to build what the first generation of compliance automation never quite delivered: software that does the work, not software that tracks the work.
What the agents actually do
Comp AI's platform reads a customer's own systems and documents to build organizational context, then drafts security policies and risk registers from what it finds. From there, AI agents take over the operational grind: onboarding employees into security workflows, gathering evidence for audits, monitoring whether controls are actually being met, and running vendor security assessments.
The company's ambitions go beyond getting customers through an audit. The new funding will push the platform into continuous cybersecurity — real-time monitoring and control validation across a customer's applications and infrastructure, with agents that proactively run security tests rather than waiting for the next audit cycle. "Security software shouldn't just track the work. It should understand the business, perform the work, and act as risk changes," Carhart said.
One detail that will get the open-source crowd's attention: Comp AI's core platform is open source. The company covers frameworks including SOC 2 and ISO 27001, and its GitHub presence positions it as an alternative to the compliance establishment — Vanta, which was valued at $4.15 billion in a $150 million round last year, and Drata. Open-sourcing the core is a direct bid for the developers who actually implement compliance at startups, the same audience that made the category valuable in the first place.
Illustration: TechPulse USA (original artwork)
The crowded — and suddenly agentic — GRC market
Comp AI is not inventing the category. It is trying to obsolete its first generation. Vanta and Drata proved that compliance software could be a venture-scale business by automating evidence collection and control mapping. Their pitch was essentially: the audit is painful, we make it less painful.
The agentic generation, Comp AI argues, changes the equation. "The first generation of compliance software proved this process could be automated. Agentic AI lets us go much further," Carhart said. Instead of a dashboard that reminds humans to do the work, the agents do the work — drafting, collecting, monitoring — with humans reviewing rather than executing.
COO Claudio Fuentes framed the shift more bluntly: compliance has historically been "an approximation of security," because the underlying work could only be done by hand and on a fixed schedule. AI agents remove that limit. The subtext is aimed squarely at buyers: a point-in-time audit certifies that you were secure on one day. Continuous agent monitoring claims to certify that you are secure every day — a much harder promise, and a much more valuable one if it holds.
The timing is not accidental. As AI spreads through the enterprise, attacks are getting faster and more automated, and regulators and customers are demanding more than annual paperwork. SecurityWeek noted the same dynamic in its coverage: the increasing adoption of AI across enterprise environments is forcing a change in how compliance is managed, and agentic AI enables validation without ongoing human intervention.
Why investors wrote the check
At $34 million for a 20-month-old company, this is a conviction bet on two things at once: that compliance budgets keep growing, and that agents are ready for production workloads that actually matter.
The first is the safer wager. Compliance spending is one of the most recession-resistant line items in enterprise software — nobody cancels their SOC 2 audit to save money, because the audit is what lets them sell to everyone else. More than 1,000 companies are already on the platform, which for a company founded in January 2025 suggests the go-to-market motion is working.
The second is the real question. AI agents that read your internal systems, write your policies, and run security tests are operating with a level of autonomy that would have been unthinkable two years ago. The "continuously agentic" vision — software that keeps working when nobody is watching — is exactly what the industry's AI safety debate is about. It is also exactly what customers will pay a premium for, if the agents are trustworthy. Comp AI's open-source core is, in this light, not just a developer play but a trust play: you can inspect what the agents are doing.
The company plans to spend the money on engineering and on the continuous-monitoring expansion, hiring across customer success, engineering, marketing, operations, product, and sales in both Miami and New York. The Miami-to-New York footprint is itself a statement — a compliance startup built outside the traditional Bay Area security corridor, selling to a market that lives everywhere.
What to watch
The honest caveat: "AI agents do your compliance" is a claim that will be tested in the only venue that matters — actual audits, actual breaches, actual regulators. An agent-written security policy is only as good as the auditor who accepts it and the incident it survives. Comp AI's bet is that continuous, agent-driven validation produces genuinely better security than the annual scramble it replaces. If the next wave of breach postmortems shows agent-monitored companies catching intrusions faster, the category flips from automation to infrastructure.
For now, the $34 million says the market believes the shift is real. The most boring job in tech just became one of its most interesting battlegrounds.
Sources: TechCrunch (Sept. 17, 2026); SiliconANGLE (Sept. 17, 2026); SecurityWeek (Sept. 17, 2026). Related: Factory AI's $200M raise at a $5B valuation.
Comments
Post a Comment