Comp AI’s funding round highlights a practical agent use case: collecting evidence and monitoring controls while humans retain approval and independent assurance.
Introduction
Compliance work is a promising target for agents because much of it involves recurring evidence, policy updates and control checks. TechCrunch reports that Comp AI raised a $34 million Series A to expand an agentic security and compliance platform. The company says its agents can help draft policies, collect audit evidence and continuously monitor whether controls are being met. Crucially, the founders also say the software does not replace independent audit review or human responsibility. That distinction is useful for growing businesses pursuing SOC 2, ISO 27001 or customer security requirements. Automation can reduce chasing and copying, but accountability remains with management, control owners and qualified assurance providers. A neat dashboard does not turn unsupported evidence into a functioning control.
What happened
According to TechCrunch, Comp AI was founded after its team experienced the manual burden of SOC 2 while running a previous startup. The new company positions agents around concrete security and compliance tasks, including evidence collection and continuous monitoring. Human workers assist onboarding, maintain workflows and approve consequential outputs. The article gives policy drafting as an example: an agent may prepare a draft, but a person reviews and approves it. Comp AI also offers AI-powered penetration testing, according to the report. The funding announcement is evidence of investor interest and company direction, not proof that every customer will achieve a particular return. Buyers should evaluate actual connectors, evidence quality, access model and auditor acceptance in their own environment.
Why it matters for growing businesses
Security reviews increasingly sit on the path to revenue. A prospect may request policies, access reviews, backup evidence and incident procedures before signing a contract. Small teams often scramble through shared drives and screenshots each time. A continuous evidence workflow can reduce this drag and reveal missing controls before an auditor or customer does. The risk is automating documentation without the underlying behaviour. A policy drafted by AI is worthless if teams do not follow it. A screenshot can be current yet prove the wrong thing. Broad integrations may also give the compliance platform access to identity, cloud, source code and HR systems. The implementation therefore needs the same least-privilege thinking that the resulting reports are supposed to demonstrate.
Practical actions this week
Choose one framework and map each control to a named owner, authoritative system, evidence type and collection frequency. Separate evidence that can be retrieved automatically from evidence that requires judgment or attestation. Create read-only service accounts for collection wherever possible. Require review when an agent drafts or materially changes a policy. Store approval history, source records and timestamps so evidence can be reconstructed. Test whether departed users, failed backups or unpatched assets are detected as exceptions rather than hidden by a passing summary. Ask the external auditor which automated evidence formats they accept before building the workflow. Keep the compliance platform itself in scope for supplier review, access control, incident response and offboarding.
A useful pilot
Pilot two controls with different characteristics, for example multifactor-authentication coverage and quarterly access review. The first can rely heavily on system data; the second requires managers to judge whether access remains appropriate. Measure preparation time, missing evidence, false positives, reviewer effort and time to resolve exceptions. Have a person trace a sample from the dashboard back to the source system. Deliberately create a safe test exception and confirm it appears. Document who may override a result and why. At the end of the cycle, ask the auditor or customer reviewer whether the evidence is understandable and sufficient. The objective is not a perfect score generated quickly. It is reliable proof that controls operate and failures become visible soon enough to fix.
How VDS Consultoria can help
VDS Consultoria can translate customer questionnaires and security frameworks into an evidence map tied to real systems and owners. We help automate low-risk collection from cloud, identity, code and Odoo environments while keeping policy approval, access decisions and risk acceptance with accountable people. We can also review service-account permissions, build exception workflows and prepare an audit trail that survives questions beyond the dashboard. For firms pursuing certification or enterprise sales, the result is a reusable control process rather than a seasonal document hunt. Automation should make compliance more truthful and continuous, not merely faster to present.
Buyer checklist
Verify which frameworks, systems and evidence types are supported today rather than promised. Ask whether the platform reads data directly, relies on screenshots or trusts user attestations. Confirm access scopes, regional hosting, retention, subprocessors and deletion. Determine how controls, agents and prompts are versioned and how changes affect prior evidence. Ask whether every automated conclusion links back to the underlying record. Confirm that independent auditors accept the output and that export remains possible if the subscription ends. Review false positives, exception handling and customer support. Finally, assign internal owners before onboarding. A compliance agent without accountable owners is just a very organized way to avoid deciding who is responsible.
Source
Comp AI sets eyes on a continuously agentic future for security and compliance, TechCrunch, 2026-09-17.