{"slug": "how-greenlight-financial-built-an-autonomous-soc-solution-on-amazon-bedrock", "title": "How Greenlight Financial built an autonomous SOC solution on Amazon Bedrock AgentCore", "summary": "Greenlight Financial resolves more than 90 percent of up to 4,000 security and risk cases each month without human intervention using Luna, an autonomous security operations center built on Amazon Bedrock AgentCore, AWS reported. Luna runs a tiered supervisor architecture with more than 30 specialized agents on AgentCore runtime and uses AgentCore memory for episodic learning, triaging dark web breach-card alerts, identity anomalies and financial-risk events in seconds instead of the 15-30 minutes a human analyst takes per case.", "body_md": "## [Artificial Intelligence](https://aws.amazon.com/blogs/machine-learning/)\n\n# How Greenlight Financial built an autonomous SOC solution on Amazon Bedrock AgentCore\n\nGreenlight Financial resolves more than 90 percent of up to 4,000 security and risk cases each month without human intervention. Greenlight’s Luna uses [Amazon Bedrock AgentCore](https://aws.amazon.com/bedrock/agentcore/), infrastructure for building, connecting, and optimizing agents at scale. Specifically, Greenlight uses AgentCore runtime, a capability of Amazon Bedrock AgentCore, to host Luna’s agent code. It uses AgentCore memory, a capability of Amazon Bedrock AgentCore, to support its tiered multi-agent system. This avoids the need to build and operate these capabilities in-house. Luna triages dark web breach-card alerts, identity anomalies, and financial-risk events in seconds.\n\nThis post explains how Greenlight Financial built an autonomous security operations center (SOC) solution on Amazon Bedrock AgentCore. We cover its multi-tiered supervisor architecture, more than 30 specialized agents, episodic memory for continuous learning, and expansion from SOC use cases into financial risk triage. We share production metrics, infrastructure decisions, and patterns for building autonomous security operations in regulated industries.\n\n## What Greenlight needed to solve\n\nGreenlight Financial provides financial products for families: debit cards, savings tools, and connected devices such as the Family Hub and Pet Tracker. The company processes sensitive financial data at scale under the same regulatory requirements as major banks.\n\nGreenlight’s SOC receives 3,000–4,000 security and risk alerts per month from four primary vectors:\n\n- **Dark web breach cards** – Card Network and internal threat intel flag Greenlight customer cards found on the dark web.\n- **Identity and access anomalies** – Unusual login patterns, privilege escalations, and policy violations across Identity Provider (IdP) and internal systems.\n- **Infrastructure alerts** – Signals from Signals from EDR (Endpoint Detection and Response), SIEM (Security Information and Event Management), Asset Inventory, and other observability tools.\n- **Financial risk events** – Suspicious transaction patterns, compliance triggers, and fraud indicators from card processing systems.\n\nEach alert demands cross-referencing multiple data sources before an analyst can render a verdict. A single dark web breach card notification requires checking whether the card is active, deduplicating against prior notifications, reviewing customer session data, and checking open support tickets. This workflow takes a human analyst 15-30 minutes per case. At 4,000 cases per month, that math breaks.\n\nGreenlight needed a system that could:\n\n1. Triage and resolve routine cases autonomously at machine speed.\n2. Escalate complex cases with full context to human analysts.\n3. Learn from resolution patterns to improve accuracy over time.\n4. Operate within financial services compliance guardrails.\n\n## Architecture: Tiered multi-agent system on Amazon Bedrock AgentCore\n\nGreenlight built Luna as a hierarchical multi-agent system on Amazon Bedrock AgentCore. The architecture follows a tiered supervisor pattern that mirrors how human SOC teams operate. L1 handles volume, and L2 handles complexity.\n\n### Tier 1 supervisor: High-volume triage\n\nTier 1 supervisor uses an [advanced language model available through Amazon Bedrock](https://docs.aws.amazon.com/bedrock/latest/userguide/models-supported.html) running on Amazon Bedrock AgentCore runtime within an Amazon Virtual Private Cloud (Amazon VPC). The runtime uses private subnets and direct code deployment through a ZIP file and Amazon Simple Storage Service ([Amazon S3](https://aws.amazon.com/s3/)). It handles initial triage of incoming cases by orchestrating more than 30 specialized agents:\n\n| **Domain** | **What the agent does** | \n| Identity and Access | Checks login history, MFA status, session anomalies | \n| Endpoint Detection | Pulls endpoint alerts, process trees, IOC matches | \n| Observability | Correlates infrastructure metrics with alert timing | \n| Asset Inventory | Maps affected assets, ownership, exposure surface | \n| Data Analytics | Queries historical patterns and baseline deviations | \n| Payment Processing | Verifies card status, transaction history, account state | \n| Customer Experience | Reviews customer session behavior around incident time | \n| Customer Support | Checks related open tickets, prior complaints | \n| Code and Repositories | Traces code changes correlated with alerts | \n| Project Tracking | Links incidents to recent deployments or known issues | \n| Threat Intelligence | Enriches IOCs with external threat context | \n| Automation (SOAR) | Executes approved remediation playbooks | \n\nThe Tier 1 supervisor receives cases through two paths: Amazon API Gateway, which exposes the Luna Queue API and a Model Context Protocol (MCP) endpoint, and Tines SOAR for automated alert ingestion. It determines which specialized agents to invoke based on alert type, synthesizes their findings, and renders a verdict. The median triage time for routine cases is single-digit seconds.\n\n### Tier 2 supervisor: Deep-dive investigation\n\nCases that exceed Tier 1’s confidence threshold escalate to a Tier 2 supervisor using an [advanced foundation model on Amazon Bedrock](https://docs.aws.amazon.com/bedrock/latest/userguide/models-supported.html) with extended reasoning capabilities. This agent handles the 10 percent of cases that require multi-step reasoning:\n\n- Re-investigates escalated cases with deeper cross-source correlation.\n- Invokes specialized agents through `boto3` with expanded context windows.\n- Chains reasoning across 3–5 data sources to establish causality.\n- Produces detailed investigation reports with evidence chains for human review.\n\nThe Tier 2 supervisor runs on a scheduled basis, using Amazon EventBridge rate triggers and Amazon Simple Notification Service (Amazon SNS) queue completions to batch-process escalated cases, and on demand for urgent Tier 1-escalated cases.\n\n### Entry points for different personas\n\nDifferent teams engage Luna in different ways, so the application exposes three entry points. These range from fully automated alert ingestion to interactive, on-demand investigation. Each entry point maps to a persona and how their work arrives:\n\n1. **Tines SOAR** – Primary volume driver. Automated alert ingestion feeds cases directly into Tier 1.\n2. **Security, Risk, and ProdOps engineers** – Direct API access for ad-hoc investigation requests.\n3. **Claude Desktop extension** – Chat-based interface for on-call engineers. An engineer opens the extension, describes what they want investigated, and Luna executes a deep-dive with full tool access.\n\n## Memory and learning: How Luna gets smarter over time\n\nThe memory layer is built on AgentCore memory. This layer is what separates Luna from a stateless triage tool. It supports pattern recognition, deduplication, and continuous accuracy improvement.\n\n### Episodic memory (30-day rolling window)\n\nStores recent events and resolution outcomes. When a new alert arrives, Luna checks: “Have I seen this pattern in the last 30 days? What was the verdict? Is this a known behavior that I should allowlist?”\n\n**Concrete example:** A Greenlight infrastructure role generates a specific access pattern every Tuesday at 3 AM for scheduled maintenance. Without memory, Luna would flag this every week. With episodic memory, Luna learned after the first resolution that this pattern is expected and auto-allowlists it.\n\n### Long-term memory\n\nPersists semantic preferences and resolution templates beyond the 30-day window:\n\n- “This access pattern is expected because that’s the role’s purpose.”\n- Greenlight’s historical case data shows “Cards from this specific dark web source have a 73 percent false-positive rate – prioritize deduplication.”\n- Resolution templates for recurring case types that encode institutional knowledge.\n\n### Case-learnings pipeline\n\nA dedicated pipeline feeds resolution outcomes back into the system:\n\n1. **Ingestion** – An AWS Lambda function captures every case resolution from Tines events.\n2. **Learnings + Dedup** – DynamoDB stores resolution patterns and deduplicates similar cases. When Luna resolves a case the same way three times, it records that as a confirmed pattern.\n3. **Digest** – A Lambda function processes new learnings into actionable context that supervisors consume at inference time.\n4. **Feedback loop** – Resolution learnings feed back into Tier 1, improving first-pass accuracy incrementally.\n\nThis pipeline drove Luna’s autonomous resolution rate from 83 percent (Tier 1 only) to more than 90 percent (Tier 1, Tier 2, and learnings).\n\n## Expanding from SOC into financial risk triage\n\nGreenlight expanded Luna into financial risk assessment within two months of the SOC deployment. The architectural changes were minimal: new specialized agents and a risk-domain supervisor layered onto the existing infrastructure.\n\n### Dark web breach card workflow\n\nWhen a Greenlight customer card appears on the dark web, Luna executes this workflow autonomously:\n\n1. **Ingest** – Threat intel providers (Mastercard, internal feeds) report compromised card numbers.\n2. **Verify** – Luna queries Galileo: Does this card belong to Greenlight? Is it currently active? What’s the recent transaction history?\n3. **Deduplicate** – DynamoDB check: Is this a repeat notification? Has this card already been remediated? Multiple providers often report the same breach.\n4. **Cross-reference** – Query Mixpanel for customer session anomalies, Zendesk for related tickets, and internal fraud scoring.\n5. **Assess and act** – Determine risk levels. Low risk: log and monitor. Medium risk: flag for review. High risk: escalate to human analysts with full evidence chain.\n\nGreenlight receives hundreds of breach card notifications daily. Luna processes each in seconds. A human analyst doing the same work, logging into Galileo, checking DynamoDB, opening Mixpanel, searching Zendesk, takes 15-30 minutes per card.\n\n## Results\n\nThe following table tracks Greenlight’s security operations on the metrics that matter most to the SOC. It compares three stages: manual triage before Luna, Tier 1 automation, and the full Tier 1 and Tier 2 system.\n\n| **Metric** | **Before Luna** | **With Tier 1** | **With Tier 1 and Tier 2** | \n| Autonomous resolution rate | 0% (all manual) | 83% | More than 90% | \n| Cases processed per month | 3,000-4,000 | 3,000-4,000 | 3,000-4,000 | \n| Median time-to-triage (routine) | 15-30 minutes | Seconds | Seconds | \n| Human analyst escalations | 100% of cases | 17% | <10% | \n| Cost avoidance | Baseline | Significant | Equivalent of multiple full-time employees | \n| Risk reduction | Baseline | Faster detection | Consistent 24/7 quality | \n\n**Estimated analyst time avoided:**\n\nBased on Greenlight’s case volume and manual handling-time measurements, processing 4,000 cases at 15–30 minutes each would require approximately 1,000–2,000 analyst hours per month. Greenlight reports that Luna autonomously resolves more than 90 percent of these cases, avoiding an estimated 900–1,800 hours of routine manual work each month. Analysts can focus instead on cases that require human judgment.\n\nThe risk reduction comes from two factors: speed (seconds compared to minutes reduces the exposure window) and consistency (Luna applies the same triage logic at 3 AM on Saturday that it does at 10 AM on Tuesday, with no fatigue and no shortcuts).\n\n## Five lessons from building Luna\n\nBuilding Luna and expanding it from security operations into financial risk surfaced five lessons for teams building multi-agent systems in regulated environments:\n\n### 1. Start with a bounded domain, then expand horizontally\n\nGreenlight started with security triage because the success criteria were clear: resolve the case correctly or escalate. After the pattern proved reliable at 83 percent resolution, expanding financial risk required adding new specialized agents and a risk-domain supervisor, not rebuilding the architecture.\n\n### 2. Mirror your human team structure\n\nThe Tier 1/Tier 2 pattern maps directly to how SOC teams already operate. L1 analysts handle volume with playbooks. L2 analysts handle the complex cases with investigation skills. This made trust-building with the security team faster. They understood the model intuitively because it matched their own esc", "url": "https://wpnews.pro/news/how-greenlight-financial-built-an-autonomous-soc-solution-on-amazon-bedrock", "canonical_source": "https://aws.amazon.com/blogs/machine-learning/how-greenlight-financial-built-an-autonomous-soc-solution-on-amazon-bedrock-agentcore/", "published_at": "2026-11-06 16:55:05+00:00", "updated_at": "2026-11-06 17:19:43.911284+00:00", "lang": "en", "topics": ["ai-agents", "artificial-intelligence", "ai-infrastructure", "ai-safety"], "entities": ["Greenlight Financial", "Amazon Bedrock AgentCore", "Luna", "Amazon Web Services", "Amazon S3", "Amazon VPC"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/how-greenlight-financial-built-an-autonomous-soc-solution-on-amazon-bedrock", "markdown": "https://wpnews.pro/news/how-greenlight-financial-built-an-autonomous-soc-solution-on-amazon-bedrock.md", "text": "https://wpnews.pro/news/how-greenlight-financial-built-an-autonomous-soc-solution-on-amazon-bedrock.txt", "jsonld": "https://wpnews.pro/news/how-greenlight-financial-built-an-autonomous-soc-solution-on-amazon-bedrock.jsonld"}}