Greenlight Financial Deploys Autonomous SOC Architecture on Bedrock AgentCore

Greenlight Financial built an autonomous security operations center (SOC) solution named Luna using Amazon Bedrock AgentCore runtime and memory capabilities. Facing 3,000 to 4,000 alerts monthly across dark web breach cards, identity anomalies, infrastructure alerts, and financial risk events, manual triage previously required 15 to 30 minutes per case. The organization structured Luna as a multi-tiered multi-agent system mirroring human SOC operations: a Tier 1 supervisor orchestrates over 30 specialized agents for high-volume automated triage, while a Tier 2 supervisor leverages extended reasoning foundation models on Bedrock for the remaining 10 percent of complex cases. Through episodic and long-term memory feedback loops, Luna increased its autonomous resolution rate from 83 percent to more than 90 percent, reducing routine case handling times to seconds and avoiding an estimated 900 to 1,800 hours of manual analyst workload per month.

Key takeaways

• Luna uses Bedrock AgentCore runtime within Amazon VPC and AgentCore memory to support a tiered supervisor pattern with over 30 specialized agents.
• A Tier 1 supervisor handles high-volume alerts in seconds, escalating roughly 10 percent of complex cases to a Tier 2 supervisor with extended reasoning across multiple data sources.
• Episodic 30-day rolling memory and long-term resolution templates compound institutional knowledge, elevating the autonomous triage rate from 83 percent to over 90 percent.
• The system was expanded from SOC alert routing into financial risk triage, such as automated dark web compromised card verification, cross-referencing, and deduplication.