1,000 Companies Automated Their SOC 2. It Took 18 Months.

01 /The Concept

Getting SOC 2 certified has been the price of entry to enterprise software for a decade. It has also been a 6-to-9-month exercise in assembling evidence, managing consultants, and satisfying an auditor – work that consumes real engineering and legal time without producing a single line of product. Comp AI is treating it as a background process.

The platform runs agents that handle everything currently done manually: pulling evidence from 100+ integrations, monitoring controls in real time, drafting security policies, running penetration tests against infrastructure. Founded in January 2025, the company emerged from stealth in April with 3,500 companies already on its pre-launch list. Its first batch of customers collectively saved over 2,500 hours on compliance work. By September 2026, it had 1,000+ paying customers and 15x year-over-year ARR growth. The $34 million Series A – led by Roo Capital and Grand Ventures, bringing total raised to $37.5 million – is directed at extending the platform beyond SOC 2 into continuous cybersecurity: real-time vulnerability scanning, attack surface monitoring, and security testing that runs continuously rather than once a year before the audit.

One structural decision separates Comp AI from Vanta ($1.6B valuation) and Drata ($2B): it is open source under an AGPLv3 license. Every agent, integration, and control mapping is readable and auditable on GitHub. In a domain whose value proposition is proving trustworthiness to enterprise buyers, making the compliance tool itself fully transparent is a positioning strategy, not a PR choice.

02 /Why It Matters

The current generation of compliance tools – Vanta and Drata anchoring the category – automated evidence collection and dashboard reporting. They still require a company employee to manage the process and an external auditor to approve the result. Comp AI's bet is that agents can replace more of that human work than the previous generation attempted.

If agents can continuously verify that controls are in place and auto-generate the evidence package, the auditor's role shrinks from a multi-month engagement to a final sign-off review. That's a different product category: not a tool that helps you comply, but a system that keeps you compliant without you managing it.

The open-source advantage is sharpest in regulated industries. Healthcare and financial services buyers are skeptical of compliance tools that are themselves opaque – an auditing platform that can't be audited creates a second layer of risk. Comp AI's GitHub-readable codebase gives enterprise security teams the ability to verify exactly what the agent does before deploying it across their stack. The AGPLv3 license creates a secondary flywheel: developers who self-host contribute improvements back, which strengthens the commercial product.

The customer profile – Corgi, Dub, OpenCode, Inference, Primer – reveals the deliberate entry point: companies at pre-enterprise scale burning through compliance prep to unlock their first large deals. That segment is structurally enormous. Every SaaS startup that targets enterprise eventually passes through it. The 15x ARR growth suggests the product solves the problem well enough that word of mouth is doing most of the work.

03 /Opportunities

SOC 2 is one of more than twenty compliance frameworks that software companies eventually navigate. ISO 27001, HIPAA, GDPR, and PCI DSS each have their own control sets, evidence requirements, and audit cadences. A unified agentic layer that maps controls across frameworks – so evidence gathered for SOC 2 automatically satisfies ISO 27001 where requirements overlap – creates compounding efficiency that a single-framework tool can't match. The startup that owns the control-mapping layer across standards builds pricing power independent of any individual framework's market size.

The more interesting adjacent build is remediation. Current compliance tools monitor and report: a control has drifted, the dashboard turns red, someone has to fix it. The next generation will close the loop – rotating credentials, patching misconfigurations, pushing remediation commits automatically. The line between compliance monitoring and security operations dissolves when the same agent that detects drift is the one that resolves it.

The structural moat is the cross-customer data layer. Comp AI's 100+ integrations give it visibility into the security posture of 1,000+ companies: which services are exposed, where credentials are stored, how access control is structured across different stack configurations. Aggregated with appropriate privacy controls, that data is the input to threat intelligence that no individual company's security team could build on its own. The platform that turns a compliance footprint into a real-time threat signal will own a meaningful slice of enterprise security – not because it sold security software, but because it already had the access.