Greenlight Financial Automates Over 90 Percent of Security and Risk Triage Using Amazon Bedrock AgentCore
The modern digital financial landscape has placed unprecedented burdens on corporate security operations centers (SOCs). As threats scale in both velocity and volume, traditional security workflows—reliant heavily on manual data correlation and human intervention—are increasingly strained to the breaking point. For Greenlight Financial, a prominent provider of family-focused financial products including debit cards, savings tools, and connected devices like the Family Hub and Pet Tracker, processing sensitive financial data at scale involves adhering to stringent regulatory requirements comparable to those of major traditional banking institutions. To combat a monthly influx of up to 4,000 security and risk alerts, Greenlight developed and deployed an autonomous security operations solution named Luna, powered by Amazon Bedrock AgentCore.
By leveraging advanced cloud infrastructure and a sophisticated multi-tiered agent architecture, Luna has successfully transformed Greenlight’s security posture. The autonomous system now resolves more than 90 percent of incoming security and risk cases without requiring human intervention, fundamentally redefining how modern fintech companies manage threat intelligence, compliance, and risk mitigation.
The Operational Bottleneck: Why Traditional SOC Models Fail
Before the implementation of Luna, Greenlight’s security team faced a daunting volume of work. The SOC routinely ingested between 3,000 and 4,000 security and risk alerts every month, originating from diverse threat vectors. Each individual alert required human analysts to cross-reference multiple disparate data sources before a definitive verdict or remediation strategy could be established.
For instance, a single dark web breach card notification necessitated a complex, multi-step investigation: checking whether the affected card was active, deduplicating the alert against historical notifications, reviewing customer session data, and searching open support tickets. In a manual environment, this single workflow consumed between 15 and 30 minutes of an analyst’s time. Multiplied across thousands of monthly cases, the mathematical reality of manual triage broke down, threatening to overwhelm the security team, increase response latencies, and expand windows of vulnerability.
Greenlight recognized that scaling its operations required an advanced automation framework. The organization needed a system capable of handling high-volume triage autonomously, executing complex multi-step investigations when necessary, learning continuously from past resolutions without manual retraining, and seamlessly integrating with existing security orchestration, automation, and response (SOAR) tools while maintaining strict regulatory compliance.
Architectural Innovation: The Tiered Multi-Agent System
To meet these demanding operational requirements, Greenlight engineered Luna as a hierarchical multi-agent system built directly on Amazon Bedrock AgentCore. This infrastructure provides the necessary capabilities for building, connecting, and optimizing autonomous agents at scale. Specifically, Greenlight utilizes AgentCore runtime to host Luna’s agent code securely within an Amazon Virtual Private Cloud (Amazon VPC) using private subnets, alongside AgentCore memory to support a tiered multi-agent topology that mirrors the operational structure of a human SOC team.
The architecture is divided into two primary operational tiers, ensuring that volume and complexity are handled with maximum efficiency.
Tier 1 Supervisor: High-Volume Triage
The Tier 1 supervisor operates via an advanced language model accessible through Amazon Bedrock, deployed on the AgentCore runtime. It functions as the primary intake mechanism for incoming cases, which arrive via Amazon API Gateway—exposing a Luna Queue API and a Model Context Protocol (MCP) endpoint—and through Tines SOAR for automated ingestion.
Upon receiving an alert, the Tier 1 supervisor orchestrates more than 30 specialized agents mapped to specific operational domains. These include Identity and Access agents that review login histories and multi-factor authentication statuses; Endpoint Detection agents that analyze process trees and indicator of compromise (IOC) matches; Payment Processing agents that verify card and account states; and Threat Intelligence agents that enrich external contextual data. By coordinating these specialized tools, the Tier 1 supervisor synthesizes findings and renders verdicts for routine cases in single-digit seconds.
Tier 2 Supervisor: Deep-Dive Investigation
Approximately 10 percent of incoming cases exceed the complexity threshold of Tier 1 and require advanced, multi-step reasoning. These cases are escalated to the Tier 2 supervisor, which utilizes an advanced foundation model on Amazon Bedrock equipped with extended reasoning capabilities.
Operating both on demand for urgent escalations and on a scheduled basis via Amazon EventBridge rate triggers and Amazon Simple Notification Service (Amazon SNS) queue completions, the Tier 2 supervisor conducts deep forensic investigations. It correlates complex anomalies, analyzes multi-vector attack patterns, and formulates comprehensive investigative reports for cases that defy standard heuristic categorization.
Continuous Improvement Through Advanced Memory Layers
A critical factor distinguishing Luna from traditional, stateless automation tools is its sophisticated memory and learning architecture, powered by AgentCore memory. This layer enables pattern recognition, automated deduplication, and continuous accuracy refinement.
The system incorporates a 30-day rolling window episodic memory that stores recent events and resolution outcomes. When a new alert enters the system, Luna queries its episodic memory to determine if a similar pattern has occurred recently, what the prior verdict was, and whether the activity represents known, benign behavior that qualifies for automated allowlisting. For example, standard infrastructure maintenance scripts executed by internal roles on a predictable schedule are automatically recognized and allowlisted after their initial resolution, preventing alert fatigue.
Furthermore, Luna utilizes a long-term memory layer to persist semantic preferences and resolution templates beyond the 30-day threshold. A dedicated case-learnings pipeline continuously feeds resolution outcomes back into the system, driving Luna’s autonomous resolution rate from an initial 83 percent at the Tier 1 level to over 90 percent with the full integration of Tier 2 and continuous learning pipelines.
Horizontal Expansion Into Financial Risk Triage
Following the successful deployment of Luna within the security operations domain, Greenlight demonstrated the architectural flexibility of Amazon Bedrock AgentCore by expanding the platform into financial risk assessment within just two months.
The expansion required minimal architectural restructuring; rather than rebuilding the core infrastructure, Greenlight introduced new specialized agents and a dedicated risk-domain supervisor. A prime example of this expansion is the dark web breach card workflow. When a customer card appears on the dark web, Luna autonomously queries core banking platforms like Galileo, checks user databases in Amazon DynamoDB, reviews behavioral analytics in Mixpanel, and searches customer support systems in Zendesk.
While a human analyst performing these checks manually typically requires 15 to 30 minutes per card, Luna processes hundreds of daily breach notifications in seconds. This rapid triage capability significantly compresses the exposure window for potential financial fraud.
Measurable Impact and Production Metrics
Production metrics provided by Greenlight underscore the transformative impact of the Luna deployment. Prior to the implementation of the autonomous SOC, the organization relied entirely on manual triage, resulting in a zero percent autonomous resolution rate, 100 percent human analyst escalation, and median triage times ranging from 15 to 30 minutes per case.
With the introduction of Tier 1 automation, the autonomous resolution rate climbed to 83 percent, reducing human escalations to 17 percent of total volume. The full deployment of both Tier 1 and Tier 2 supervisors, coupled with the episodic memory and case-learnings pipeline, pushed the autonomous resolution rate past the 90 percent threshold while maintaining monthly case processing volumes between 3,000 and 4,000 cases.
From a resource optimization perspective, the operational implications are substantial. Handling 4,000 monthly cases manually at 15 to 30 minutes per case would demand approximately 1,000 to 2,000 analyst hours per month. By autonomously resolving over 90 percent of these cases, Luna saves an estimated 900 to 1,800 hours of routine manual work monthly. This efficiency allows human security and risk professionals to redirect their expertise toward complex investigations, strategic threat hunting, and proactive security hardening. Furthermore, consistency of execution remains uniform around the clock, eliminating human fatigue and reducing operational variance.
Core Lessons for Regulated Industries
The engineering journey behind Luna provides a valuable blueprint for organizations operating within highly regulated industries seeking to adopt multi-agent autonomous systems. Industry observers and technology analysts have highlighted several foundational takeaways from Greenlight’s implementation:
First, organizations should begin with a strictly bounded domain where success criteria—such as resolving a security case or escalating it—are explicit and measurable. Once foundational reliability is established, expansion into adjacent domains can be achieved by appending specialized agents rather than overhauling the underlying architecture.
Second, mirroring existing human organizational structures within agent hierarchies fosters institutional trust. Because Luna’s Tier 1 and Tier 2 supervisors mapped intuitively to the division of labor already practiced by Greenlight’s human SOC teams, internal stakeholders readily understood and trusted the system’s escalation logic.
Third, memory systems are vital for long-term efficiency gains. The accumulation of episodic and semantic knowledge allows autonomous agents to transcend static rule-based limitations, compounding in value over time as institutional memory grows.
Finally, maintaining a strict "triage first, action later" policy is essential in regulated financial environments. Greenlight deliberately designed Luna to provide evidence-based recommendations and automated triage while keeping final remediation actions under human-in-the-loop authorization or explicit policy controls. This governance model satisfies rigorous compliance mandates while accelerating response velocities.
Infrastructure Foundation and Future Outlook
Luna operates entirely on a managed AWS infrastructure stack designed for security, scalability, and auditability. Beyond Amazon Bedrock AgentCore, the architecture relies on Amazon DynamoDB for learnings storage and case deduplication, Amazon S3 for agent packages and state management, Amazon CloudWatch Logs maintaining a 30-day retention window for comprehensive audit trails, AWS Secrets Manager for external API credentials, and AWS Lambda for ingestion and post-processing workflows.
Building upon the proven success of its security and financial risk operations, Greenlight is currently exploring the extension of Luna’s multi-agent pattern into additional operational domains, including automated compliance auditing, customer support anomaly detection, and internal IT service management workflows.
As financial institutions face increasingly complex threat landscapes, Greenlight Financial’s implementation of Luna on Amazon Bedrock AgentCore establishes a compelling benchmark for autonomous operations. By successfully balancing high-volume automation with rigorous human oversight and continuous learning, the initiative demonstrates how modern enterprises can harness generative AI and multi-agent infrastructure to secure their digital ecosystems effectively and sustainably.
