How Greenlight Financial built an autonomous SOC solution on Amazon

Greenlight Financial deployed an autonomous security operations center system called Luna on Amazon Bedrock AgentCore, resolving more than 90 percent of its monthly security and risk caseload without human intervention. The family-focused fintech company, which provides debit cards, savings tools, and connected hardware devices like the Family Hub and Pet Tracker, handles up to 4,000 alerts per month under bank-level regulatory requirements. Details of the production architecture, multi-agent hierarchy, and automated risk workflows were detailed in AWS Machine Learning Blog's report on the implementation.

This report examines how Greenlight structured Luna's two-tier supervisor pattern, how its episodic and long-term memory subsystems eliminate repetitive manual triage, and how the platform branched beyond infrastructure defense into financial risk evaluation. It is written for engineering leads, security analysts, and cloud architects evaluating autonomous agent frameworks for heavily regulated operational pipelines.

Greenlight Financial built an autonomous SOC: what actually changed

Greenlight shifted from manual alert triaging across fragmented observability dashboards to an automated pipeline orchestrated by Amazon Bedrock AgentCore. Previously, security analysts evaluated 3,000 to 4,000 alerts monthly across four primary streams: dark web breach-card notifications, identity and access anomalies, infrastructure alerts from endpoint detection and response or security information tools, and financial risk events. A single dark web alert required checking active card records, deduplicating prior hits, inspecting customer session logs, and scanning support tickets, demanding 15 to 30 minutes of human effort per ticket.

By deploying Luna on the AgentCore runtime within an Amazon Virtual Private Cloud using private subnets and direct ZIP file deployment to Amazon Simple Storage Service, Greenlight dropped median triage times for routine alerts to single-digit seconds. Tier 1 handling initially resolved 83 percent of incoming cases on its own. After integrating automated case learnings alongside Tier 2 deep-dive agents, Luna's overall autonomous resolution rate rose above 90 percent, freeing staff from processing repetitive alert volumes.

Greenlight Financial built an autonomous SOC: how it works

Luna uses a two-tier supervisor architecture that mirrors human operations. The Tier 1 supervisor operates an advanced language model hosted via Amazon Bedrock AgentCore runtime to coordinate more than 30 specialized agents. These specialized agents cover discrete tasks such as identity checks, endpoint detection, observability, asset inventory, data analytics, payment processing, customer support history, code change tracking, and SOAR automation. Work enters Tier 1 through Tines SOAR alert ingestion or the Luna Queue API and Model Context Protocol endpoints managed on Amazon API Gateway.

Cases exceeding Tier 1 confidence thresholds route to a Tier 2 supervisor equipped with an advanced foundation model with extended reasoning capabilities. This Tier 2 agent re-evaluates the roughly 10 percent of complex cases by chaining evidence across three to five underlying data sources using boto3 calls with expanded context windows. Tier 2 processes batched escalations through Amazon EventBridge rate triggers and Amazon Simple Notification Service queue events, or triggers immediately on urgent alerts, generating comprehensive evidence chains for human analysts.

Greenlight Financial built an autonomous SOC: why it matters

Stateless security bots struggle in production because recurring infrastructure activity continually triggers false positives. Luna addresses this problem by integrating AgentCore memory across two persistence horizons: a 30-day rolling episodic memory and a persistent long-term memory store. Episodic memory captures recent case resolutions, allowing Luna to identify known patterns, such as an internal maintenance role executing access operations every Tuesday at 3 AM, and automatically apply allowlists without alerting on-call engineers.

Long-term memory retains broader institutional knowledge and semantic guidance, such as flagging that cards from specific dark web feeds exhibit a 73 percent false-positive rate to prioritize deduplication. A closed feedback pipeline driven by AWS Lambda captures case outcomes from Tines events and writes them into DynamoDB. When Luna records identical resolutions for a case pattern three times, it formalizes a confirmed pattern. A secondary Lambda digest processes these learnings back into inference-time context, permanently raising Tier 1 accuracy.

Greenlight Financial built an autonomous SOC: who is affected

Security, risk, and production operations engineers interact with Luna through distinct operational paths tailored to their workflow requirements. The primary alert volume flows autonomously through Tines SOAR directly into Tier 1. For manual interventions or ad-hoc technical investigations, engineers submit targeted queries directly against Luna's dedicated API endpoints. On-call engineers also access a Claude Desktop extension, letting them describe investigation parameters in chat and prompt Luna to run cross-tool deep dives on demand.

The system also directly impacts financial risk teams. Within two months of deploying the initial security operations center, Greenlight extended Luna to handle card fraud triage without rebuilding the underlying runtime. In dark web compromised-card scenarios, Luna queries Galileo to confirm card ownership, activity, and transaction history, deduplicates hits in DynamoDB, and assesses fraud patterns without human intervention. This setup enables security and compliance teams to maintain uniform regulatory rigor without expanding analyst headcount.

Greenlight Financial built an autonomous SOC: what to watch

The implementation highlights an enterprise design blueprint for applying foundation models to critical infrastructure without maintaining custom model hosting stacks. Using Bedrock AgentCore runtime and built-in memory capabilities allowed Greenlight to avoid developing, securing, and operating an in-house agent harness. The combination of private VPC subnets, ZIP-based deployments, and Model Context Protocol access endpoints provides a repeatable template for deploying autonomous agents in regulated banking contexts.

Operational teams should watch how Greenlight continues expanding its multi-domain supervisor model into adjacent fraud and transaction-monitoring workflows. Because Luna abstracts domain-specific logic into modular agents while sharing core memory, API Gateway, and Tines ingestion pipelines, adding future compliance rules requires writing targeted child agents rather than redesigning the central triage engine. The durability of its DynamoDB-backed pattern-learning loop will serve as an industry test for self-refining security operations.