On September 17, 2026, The Next Web reported that Comp AI, a Miami-based compliance automation company, had raised a $34 million Series A led by Roo Capital and Grand Ventures. The company reported more than 1,000 customers and 15x year-over-year recurring revenue growth, and said it will expand from compliance automation into continuous monitoring, real-time control validation and security testing. Its chief executive framed the ambition simply: security software should not just track the work, it should understand the business, perform the work and act as risk changes.
The funding round is not the story. Comp AI is one company, focused on cybersecurity compliance, and it is not a proxy for the whole market. The story is what the money is chasing. Enterprises are increasingly willing to pay for systems that continuously collect evidence and demonstrate that controls work, rather than preparing compliance evidence in a scramble before each audit. For CFOs, chief audit executives, CISOs and GRC leaders, the useful question is what continuous compliance looks like when it moves beyond cyber into the rest of the control environment.
Crest.Digital's Agentic Risk & Continuous Assurance practice builds customized AI agents and continuous-control solutions around your own systems, risks and controls, so the answer arrives with evidence attached.
Explore Agentic GRCWhat the Funding Signal Actually Tells Us
Periodic compliance has a structural weakness. A SOC 2 report, a SOX walkthrough or an internal audit sample describes a control at the moment it was examined. Between those moments, access is granted, vendors change bank details, policies drift and configurations are modified. Everyone knows this, and for years the accepted response was to test more often at the margin: quarterly access reviews instead of annual ones, larger samples, more screenshots.
Three things have changed. The scope has grown, with more systems, more vendors and now more AI agents acting on company data. The cost of continuous testing has collapsed, because connectors, rules engines and language models make it cheap to read evidence, match it to control requirements and chase the exceptions. And regulators and auditors are pushing in the same direction: the IIA's Global Internal Audit Standards expect internal audit to rely on sufficient, reliable and relevant information, and the PCAOB's AS 1105 sharpens the scrutiny on the quality of evidence used in audits. Evidence that is generated continuously, at source, is simply easier to trust than evidence assembled afterwards.
Why “What Changed Today?” Is the Better GRC Question
A compliance status is a snapshot, and snapshots age quickly. A change log is different: it tells you which controls, records, users, vendors and obligations moved since yesterday, and whether any of those movements weakened your position. That reframes the GRC operating model. Instead of a calendar of assessments, the organization runs a stream of tested changes, with human attention reserved for the ones that matter.
It also changes how leaders talk about assurance. A CFO who can say that every payment approval, vendor-bank change and manual journal in the quarter was tested, with the exceptions closed and evidenced, is making a different kind of statement from one who says a sample of 25 was clean. We made the related argument about third parties in why the future is continuous evidence, not just continuous monitoring: monitoring tells you something changed, while evidence proves what you did about it.
The Six-Link Chain: From Continuous Data to Audit-Ready Evidence
Crest.Digital frames continuous compliance as a chain that must hold end to end: Continuous Data, Control Test, Exception, Materiality, Management Action, Evidence. Many tools cover the first two links well. Programmes fail at the last four, where exceptions have to be judged, acted on and proven closed.
Continuous Data
Control-relevant data flows in from ERP, identity, procurement, banking, HR, ticketing and vendor systems on a schedule or in near real time. The first question is coverage: which controls still depend on someone exporting a report once a quarter?
Control Test
Each control has machine-executable test logic, such as a three-way match, a segregation-of-duties rule, a vendor-bank-change check or a configuration baseline. The test runs against the full population, not a sample.
Exception
A failed test becomes a structured exception with the record, the rule breached, the owner and a plain-language explanation of why it is unusual. An exception nobody can explain is just another alert.
Materiality
Each exception is scored for exposure, control criticality, recurrence and regulatory or reporting relevance. This is the step that stops a thousand low-value alerts from burying the ten that matter.
Management Action
The owner acts: fix the transaction, correct the access, chase the missing document, or accept the risk with documented approval. Actions carry deadlines, escalation paths and required closure proof.
Evidence
Test result, exception, materiality score, action and closure proof are stored together, time-stamped and linked to the control and obligation. That package is what an auditor, regulator or committee can rely on.
A useful test of any continuous compliance capability, whether bought or built, is to pick a single control failure from last month and trace it through all six links. If the trail breaks between exception and action, or between action and evidence, you have monitoring, not assurance. The same discipline underpins continuous controls monitoring across ERP, procurement, payroll and banking systems.
The same chain can run across your third-party population: vendor-master controls, ownership and sanctions changes, certificate expiries and remediation, all evidenced. See how Crest.Digital applies it to vendor risk.
Extending Continuous Compliance Beyond Cyber
Compliance-automation platforms have concentrated, sensibly, on the frameworks that most directly gate revenue: SOC 2, ISO 27001 and similar security attestations. The same logic applies far more widely, and much of the exposure sits outside the security team. Consider where a chain like the one above adds value.
Cyber and security frameworks
Access, configuration, endpoint, policy-acknowledgement and vendor-security evidence. This is where most compliance automation started, and it is a good place to start.
Procure-to-pay and vendor master
Duplicate payments, split purchase orders, bank-account changes before payment, dormant vendors and payments without approval, tied to third-party intelligence on the vendors themselves.
Order-to-cash and financial close
Credit-limit breaches, revenue-timing exceptions, manual journals, post-close entries and unusual discounts, where exceptions are transactions rather than settings.
Regulatory obligations
Obligation-to-control mapping, with continuous evidence that outsourcing, privacy, sanctions and AI-governance requirements are actually being met.
Enterprise risk and committees
Recurring failures and systemic root causes rolled up for audit and risk committees, with drill-down to evidence.
These domains have different data, different owners and different definitions of an exception, which is why the strongest programmes are configured around the client's own systems and risks rather than deployed as a generic template. It is also why a single dashboard is not the goal. The goal is a shared chain and a shared evidence repository, so that a cyber exception, a procurement exception and a vendor exception are triaged, scored and closed the same way. Our piece on evidence intelligence and control validation covers how that evidence is checked for period, owner, completeness and reuse.
Materiality: The Hard Part Nobody Demos
Continuous testing produces exceptions in volume. That is a feature until it becomes a burden. A control team that receives 4,000 alerts a month will, within a quarter, learn to ignore all of them, and the organization will have created a well-documented record of failures it chose not to act on. Materiality scoring is therefore the difference between a monitoring tool and an assurance capability.
A workable scheme scores each exception on exposure (amount, data sensitivity or customer impact), control criticality, recurrence, and relevance to a regulated obligation or financial-reporting assertion. Low scores are batched and closed with light evidence. High scores escalate to a named owner with a deadline and a required closure proof, and repeat failures trigger a root-cause review rather than another ticket. The thresholds are themselves a control: they should be agreed with the CFO, chief audit executive and compliance leadership, documented and reviewed. Agents can draft the score and explain the reasoning, and that explanation is what lets a reviewer approve or override in seconds rather than minutes. Accountability for the threshold stays with people, a principle we set out in who is accountable when GRC becomes agent-ready.
Agents matter most here. Humans cannot read every exception, but an agent can gather the surrounding context, form a root-cause hypothesis, check whether the same pattern has occurred before, draft the management action and chase the owner. Agentic AI works well when it handles these repetitive analysis and coordination tasks under human-in-the-loop governance, with every step logged. Because those agents act on company data, they need the same audit trail as any other control, which we discuss in why AI agents need audit trails.
A Six-Step Playbook to Move From Periodic to Continuous
Crest.Digital delivers this as a configurable Risk Automation Pod rather than a bespoke software build. The client-specific work is data mapping, control logic, workflow, prompts and dashboards. The underlying stack of connectors, agent orchestration, workflow and approval engine, evidence repository, remediation module and audit logs is reusable, which is what keeps it faster and more maintainable than custom development.
Discover
Map your obligations, controls and systems, and identify which controls are still evidenced by periodic screenshots, spreadsheets and email rather than system data.
Design
Define the control logic, materiality thresholds, agents, owners and human approval points for a first set of high-value use cases, across cyber and non-cyber domains.
Connect
Integrate with ERP, identity, ticketing, document and GRC systems so control data flows in continuously and evidence is captured at source.
Deploy
Turn on continuous tests for the selected controls, route exceptions to owners with a root-cause hypothesis and a materiality score, and track actions to closure.
Validate
Run the new tests in parallel with your current process, measure false positives and misses, and set accuracy thresholds before anyone relies on the output.
Transfer or manage
Hand the tested monitoring set to audit, finance, compliance or risk to operate, or continue as a Crest.Digital-managed service as the control estate grows.
Executive Takeaways
- The signal: A $34 million round for continuous compliance shows buyers value continuously generated evidence over periodically assembled evidence.
- The chain: Continuous Data, Control Test, Exception, Materiality, Management Action, Evidence. Trace one real failure through all six links to find where your programme breaks.
- Beyond cyber: The same chain applies to procure-to-pay, order-to-cash, access, third parties, regulatory obligations and committee reporting.
- Materiality: Scoring and thresholds decide whether continuous testing produces assurance or alert fatigue. Treat them as a governed control.
- Humans stay accountable: Agents investigate, draft and chase. People own thresholds, approvals and sign-off.
What CFOs, CAEs and CISOs Should Ask This Quarter
Start with five questions. Which of our key controls are still evidenced by screenshots, spreadsheets or email rather than system data? For the last material control failure, can we show the test, the exception, the materiality judgment, the action and the closure proof in one place? Who owns our exception thresholds, and when were they last reviewed? Which cyber-only monitoring do we have that has no equivalent in finance, procurement or third-party risk? And if an auditor asked what changed in our control environment yesterday, how long would it take us to answer?
The answers usually point to a small number of high-value use cases where continuous testing pays back quickly. Start there, prove accuracy in parallel with the existing process, then widen. The organizations that treat funding rounds like this as a prompt to review their own assurance model, rather than as vendor news, will be better placed when auditors and boards begin asking the second question by default.
Crest Perspective
Risk programmes that treat third-party governance as a compliance checkbox are consistently underprepared when a material vendor incident occurs. The programmes that withstand regulatory scrutiny are not necessarily the most technologically sophisticated — they are the ones where risk tiering is documented, escalation paths are tested before they are needed, and the board receives accurate, timely information about the organisation’s most critical vendor dependencies.
Frequently Asked Questions
Three pressures are converging. Audit and compliance calendars have compressed while the number of systems, vendors and AI agents in scope has grown, so periodic evidence preparation no longer scales. Buyers have learned that a point-in-time report says little about whether a control worked last Tuesday. And AI agents have made it cheap to collect evidence, test controls and chase exceptions continuously. On September 17, 2026, Comp AI announced a $34 million Series A led by Roo Capital and Grand Ventures, reporting more than 1,000 customers and 15x year-over-year recurring revenue growth, according to coverage by The Next Web. The funding is one data point, but it shows enterprises are willing to pay for systems that continuously collect evidence and demonstrate control effectiveness rather than assembling it once a year.
Continuous compliance is the outcome: being able to show, at any point, that obligations are met and controls are operating. Continuous controls monitoring (CCM) is one of the main mechanisms: automated tests run against system data on a frequent or real-time cadence, with exceptions routed for action. Most compliance-automation platforms began with security frameworks and concentrate on cyber controls such as access, configuration and vendor security evidence. CCM extends the same logic into financial and operational processes such as procure-to-pay, order-to-cash, payroll, treasury and inventory, where the exceptions are transactions rather than settings. A mature programme uses both, tied together by a common chain from data to test to exception to materiality to action to evidence.
No. It changes what the audit is used for. An external or internal audit still provides independent assurance, and standards such as the PCAOB's AS 1105 and the IIA's Global Internal Audit Standards still expect sufficient, reliable and relevant evidence. What continuous testing changes is the quality and timing of that evidence. Auditors can rely on tested populations instead of small samples, spend fieldwork on judgment areas instead of evidence collection, and see exceptions and their remediation as they happen. Organizations should agree with their external auditors how continuously generated evidence will be treated before relying on it for reporting purposes.
Materiality is the step most tools skip. A useful rule set scores each exception on at least four factors: the size or exposure involved, the criticality of the control, whether the same failure has recurred, and whether it touches a regulated obligation or a financial-reporting assertion. Low-scoring exceptions are batched and closed with light-touch evidence. High-scoring ones go to a named owner with a deadline and a required closure proof. The thresholds should be set with the CFO, chief audit executive and compliance leadership, reviewed each quarter, and documented, because they are themselves a control. Agents can propose a score and explain it, but people should own the thresholds and the escalation decisions.
Crest.Digital's Agentic Risk & Continuous Assurance practice builds customized AI agents and continuous-control solutions around a client's own systems, risks and control environment, delivered as a configurable Risk Automation Pod through a six-step model: Discover, Design, Connect, Deploy, Validate, and Transfer or manage. The emphasis is on extending continuous evidence beyond cyber frameworks into audit, finance, third-party risk and enterprise risk, with human approval on material determinations and a full audit trail. It is designed to sit alongside your existing ERP, GRC and compliance tools rather than replace them, and the same evidence chain can also run across your vendor population through the Crest.Digital TPRM platform.