Greenlight Financial Deploys Autonomous Security Operations Using Amazon Bedrock AgentCore

Greenlight Financial has successfully developed Luna, an autonomous Security Operations Center (SOC) solution built on Amazon Bedrock AgentCore, that triages and resolves more than 90 percent of up to 4,000 monthly security and financial risk alerts without human intervention. The system significantly reduces manual workload for analysts responsible for investigating threats such as dark web card breaches and identity anomalies under strict financial regulatory requirements.

Luna’s architecture employs a hierarchical, tiered multi-agent structure modeled after human SOC teams. Tier 1 handles high volumes of routine cases at machine speed through over 30 specialized agents, achieving median triage times of single-digit seconds. Complex alerts escalate to Tier 2, which uses advanced reasoning on extended data contexts to perform deep-dive investigations before presenting detailed evidence-backed reports to analysts.

The core platform runs within an isolated Amazon Virtual Private Cloud, using AgentCore runtime and memory capabilities to host agents and maintain episodic and long-term memory. This memory layer supports continuous learning and pattern recognition, enabling Luna to deduplicate alerts, recognize expected behaviors, and grow institutional knowledge over time, improving autonomous accuracy from 83% to over 90%.

Luna integrates data from multiple sources such as dark web intelligence, identity providers, infrastructure monitoring, and financial transaction systems. Automated workflows cross-reference databases including Galileo, Mixpanel, and Zendesk, consolidating relevant context to categorize risk and route urgent cases to human experts, balancing autonomy with compliance and human oversight.

The system is designed for regulated environments by separating triage and action: Luna autonomously assesses and recommends but does not remediate without explicit human or policy authorization, ensuring governance and trust. Its modular approach allows reuse and expansion of specialized agents into new domains, evidenced by its recent extension into broader financial risk triage.

Infrastructure relies fully on managed AWS services including Amazon Bedrock AgentCore for agent orchestration, AWS Lambda for event handling, DynamoDB for pattern storage, and messaging services for scheduling and notifications. This cloud-native stack supports scalable, secure deployment conforming to industry regulations.

Despite notable automation gains, limitations include the need for continuous learning input and oversight to handle ambiguous or novel threats. The multi-agent approach demands rigorous design to mirror human workflows and maintain explainability. Greenlight’s experience highlights the importance of starting with focused domains and expanding cautiously based on proven model reliability.