Throughline is an audit firm built forAI-native companies, and for co-founder Paul Wenham it is the second time building a modern audit firm for technology startups.
His first firm, AssuranceLab, grew from a one-person consultancy to a global team of 60 serving more than 1,200 customers across 30+ countries, before it was acquired by Sensiba. Now Paul and co-founder Rob McAdam are building for what comes next: companies whose products, engineering and compliance programs are being reshaped by AI.
Their first product release to the community is Compliance Brain, a free, open-source tool that lets AI agents run a company's compliance program, while its leaders keep the key decisions and auditors stay independent.
From AssuranceLab to Throughline
Paul trained in Big 4 audit before leaving to start AssuranceLab, with a simple goal: make security compliance accessible to startups. It became the audit firm that high-growth technology companies turned to, delivering thousands of audits and expanding globally before being acquired by Californian firm Sensiba.
In 2019, while AssuranceLab was still just Paul, he shared a table at Fishburners in Sydney, with Rob McAdam, the serial cybersecurity founder behind Pure Hacking, CXO Security and Sekuro. The timing wasn't right for a deal, but Rob became a mentor and stayed close as the business grew.
Scale brought its own lessons. As compliance became big business, the industry raced to make it faster and cheaper. Leading a growing global team, Paul found himself further from the client-specific work that first inspired him. "When the market pushes for compliance that's fast, easy and cheap, audits start to lose their meaning," he says. "They follow templates, companies bend to fit them, and the evidence becomes a parallel world to how the business actually operates."
Paul and Rob stayed close over the years, and in 2026 the timing finally lined up to build something together. AI-native companies were rewriting how security and compliance get done, in a space where their experience overlaps: Paul on the audit side, Rob in cybersecurity. Rob came from a career spent building quality businesses and a passion for service excellence. Paul brought some unfinished business: helping emerging technology startups earn trust in a way that reflects how they actually operate. Throughline is where those two ambitions meet.
Why AI-native companies need a different audit
The criteria behind SOC 2 and ISO haven't changed forAI. The companies being audited have. Agents now hold access to production systems, propose and ship code, and act on customer data. Enterprise buyers, including the banks assessing fintech partners, are asking how those risks are controlled.
"A traditional audit ignores the role ofAI and agents," Paul says. "For these companies, it's core to the operating model. If the audit doesn't recognise that, the report describes a company that doesn't exist, and the customer reading it learns nothing about the risks they care about."
Throughline brings agent access, AI-enabled changes, monitoring and AI governance into the scope of frameworks customers already trust: SOC 2, ISO 27001 and ISO 42001, the standard forAI management systems. Evidence comes from where the work happens, whether that's a compliance platform, a code repository, the agent itself, or the company's operating system. Throughline also uses AI to cut coordination overhead, so there's no offshoring or junior handoffs, and experienced auditors own the client relationship and the judgement calls.
ComplianceBrain: context your AI can run on
Paul's core insight is that AI models already know compliance. What they don't know is your company. "Ask any model what SOC 2 requires and you'll get a decent answer," he says. "Ask what your company needs to do and it's guessing. Compliance knowledge is abundant now. Your context is the unknown."
Compliance Brain captures that context (customers, commitments, systems, risks and ways of working) in a structured, portable form anyAI can use. Teams bring their own model or agent platform, connect it to Slack, GitHub, cloud infrastructure, identity tools and the company workspace, then let the agent:
design and build controls around how the company actually operates
maintain policies, risks, vendors and control evidence
collect evidence from connected systems
prepare most of what the auditor needs, and even manage the audit directly
escalate decisions and exceptions to a human leader
The aim is to replace hundreds of pages of policy documents and annual review cycles with living context that updates as the company changes. Because it's open source and model-agnostic, that context isn't locked into Throughline, a compliance platform or any one AI vendor. One Brain can underpin SOC 2 and every framework that follows.
An invitation to Aussie fintechs
Throughline's early customers have pushed in one consistent direction: they want agents doing as much of their compliance program as possible, with clear human ownership and an audit they can stand behind. Throughline sums up that model as AI-managed, human led and independently audited.
For fintechs juggling SOC 2, ISO 27001, CDR and GDPR obligations alongside rising AI governance expectations from bank and enterprise partners, that model strips out the busywork without lowering the bar.
"With AssuranceLab, we made audits accessible," Paul says. "With Throughline, we're making them fit, and letting AI do the heavy lifting so founders can get back to building."
Compliance Brain is now in beta, and Throughline is inviting FinTech Australia members to join at throughlineaudit.com/compliance-brain. To talk with Paul and the team, email hello@throughlineaudit.com.
