An AI agent can write, test, and ship a production pull request before your compliance team finishes their coffee. It can also pull in a vulnerable dependency, misconfigure a policy, or introduce a supply chain risk nobody catches until an auditor asks for proof six months later.
That’s the collision happening inside most engineering orgs. Agents are active participants in the software supply chain: reading business data, calling APIs, pulling third-party dependencies, and writing code at a volume no human team can manually review. Attackers have noticed too and are using the same tools, with none of the governance constraints slowing them down.
Meanwhile, compliance is still running on last decade’s playbook: screenshots, spreadsheets, and a scramble every Q4 to reconstruct what actually shipped. Josh Bresser, our VP of Security wrote about this shift starting almost a year ago in Navigating the New Compliance Frontier, when we first floated a term for the fix: CompOps.
Our new whitepaper, CompOps: The Modern Blueprint for Continuous Cybersecurity Compliance, lays out what it actually takes to build that fix, and why doing it now, before the next framework lands on your desk, is the difference between compliance as a bottleneck and compliance as leverage.
Who killed the annual audit?
Modern standards don’t wait for year-end anymore. The EU Cyber Resilience Act (CRA), NIST’s Secure Software Development Framework (SSDF), the Product Liability Directive (PLD), and FedRAMP 20x all demand continuous evidence, not a snapshot from last spring. Miss it, and the cost isn’t a slap on the wrist. It’s a blocked market, a stalled deal, or a halted deployment.
Layer GDPR, NIS2, and a half dozen industry-specific frameworks on top, and you get what the whitepaper calls the “spaghetti wiring” problem: every new framework adds another custom script, another spreadsheet column, another siloed GRC tool bolted onto the last one. Eventually engineering teams get scared to ship, because nobody’s sure which overlapping requirement a deployment might quietly violate.
The details compound the pain. The EU CRA requires an SBOM for every release, kept on file for 10 years. FedRAMP 20x expects evidence formatted in OSCAL, a machine-readable standard most GRC spreadsheets have never heard of. None of these requirements were designed to be filled out by hand at scale, and none of them are going away.
The fix: treat compliance like an engineering problem
CompOps applies a DevOps mindset to governance. Instead of wiring a new manual process for every regulation, you plug your security telemetry into one system once, and let Policy-as-Code translate it into whatever format SOC 2, FedRAMP, or the EU CRA demands. The whitepaper calls this the software-defined compliance router, and walks through the five technical pillars that make it real:
- Software Composition Analysis (SCA), which traces every dependency down to the ones developers don’t know they’re shipping
- Vulnerability scanning, correlating that dependency tree against live threat feeds
- The SBOM, standardized in a format like SPDX 3.0, acting as the evidence locker auditors actually trust
- Regulatory Policy-as-Code, which turns legal text into version-controlled, machine-executable rules
- A policy engine, which evaluates it all and returns a deterministic PASS, FAIL, or WARN, no human in the loop required
The whitepaper also walks through where this engine has to plug in: 4 enforcement gates spanning the CI/CD build step, the artifact registry, the deployment admission controller, and continuous runtime monitoring. Catch a violation at any one of them, and the developer gets a deterministic answer in their existing workflow, not a Jira ticket from security three sprints later.
We’ve already shipped pieces of this. Anchore Enterprise 5.26 added HTML compliance reports straight from the CLI, so developers get an audit-ready artifact without ever logging into a GRC tool. And Compliance Operations: Making Kubernetes Audit-Ready by Design shows what continuous evidence looks like when your workloads are as ephemeral as Kubernetes pods.
The business case your board actually wants
This section is for anyone who has to defend a budget line. It reframes compliance from cost center to go-to-market accelerator, with the kind of numbers a VP can repeat in a room: compliance runway for new market entry cut from 12 months to 3, thousands of engineering hours reclaimed from manual review, and compliance coverage scaled 300% without adding headcount.
That last part matters as much as the deadlines. CISOs and platform leads are accountable for proving what shipped, when, and whether an AI agent or a senior engineer wrote the code that got there. CompOps is built to be that backstop either way. And for the security engineers and compliance analysts actually running the pipeline, it means fewer 2am Slack pings asking for a screenshot nobody saved.
