Greenlight Financial deploys autonomous security center Luna on Amazon Bedrock AgentCore
Greenlight Financial has deployed Luna, an autonomous SOC system with 30+ agents and a two-layer architecture, on Amazon Bedrock AgentCore, which the company says resolves over 90% of the 3000-4000 security and risk alerts it receives each month without human intervention.
Greenlight Financial, a provider of financial products for families (debit cards, savings tools, Family Hub and Pet Tracker devices), has deployed the Luna system as an autonomous security operations center built on the Amazon Bedrock AgentCore service. According to the company, Luna resolves more than 90 percent of the 3000 to 4000 security and financial risk alerts it receives each month without human intervention, in a corporate environment subject to the same regulatory requirements as large banks.
The system is built as a hierarchical architecture with two layers of supervisors, modeled on how human SOC teams operate. The first layer (Tier 1) performs initial triage using more than 30 specialized agents for areas such as identity and access, endpoint detection, payment processes, customer support, and threat intelligence; according to the company, the median triage time for common cases is a matter of seconds. Cases that exceed the Tier 1 confidence threshold are escalated to the Tier 2 supervisor, which has expanded reasoning capabilities for multi-step cases.
A key component is the memory layer built on AgentCore memory, which enables the recognition of recurring patterns and their automatic exclusion from further resolution (allowlisting), as well as the retention of resolution templates beyond short-term episodic memory. According to the company, this feedback loop increased the autonomous resolution rate from 83 percent (Tier 1 alone) to more than 90 percent after the involvement of Tier 2 and learning mechanisms. Within two months of deployment in the SOC, the company extended Luna to financial risk assessment as well, with minimal architectural changes.
The source text is only partially available; the description of the workflow for cards leaked on the dark web is cut off in the middle. Details can be found in the source article.
Why it matters
This case demonstrates a concrete production deployment of a multi-agent system in a regulated environment, where the alert volume (up to 4000 monthly) previously required 15-30 minutes of human work per case. For companies with similarly high-volume and recurring security or risk processes, this is a reference architecture – layered triage, specialized agents, and persistent memory for deduplication – that can be viewed as a model, not as a universal solution, since the figures come from the vendor and the description lacks third-party verification.
Relevant practical impact
What this means
For a business
A company in the regulated financial sector shows that a hierarchical multi-agent system with persistent memory can handle a large volume of security and risk alerts (3000-4000 monthly) with autonomous resolution of over 90% of cases and a reduction in resolution time from 15-30 minutes to a matter of seconds, which lowers SOC operating costs and speeds up incident response.
Risks and complianceCheck the original
Event sources
only one source so far · 1 publisher, 0 independent. We count feeds from the same owner only once.