---
type: "post"
id: "how-greenlight-financial-built-an-autonomous-soc-solution-83215d"
slug: "how-greenlight-financial-built-an-autonomous-soc-solution-83215d"
title: "How Greenlight Financial built an autonomous SOC solution on Amazon Bedrock AgentCore"
description: "Greenlight Financial says its Luna system resolves more than 90% of up to 4,000 monthly security and risk cases without human intervention, using a tiered multi-agent architecture on Amazon Bedrock AgentCore."
retrieval_nugget: "Greenlight Financial says its Luna system resolves more than 90% of up to 4,000 monthly security and risk cases without human intervention, using a tiered multi-agent architecture on Amazon Bedrock AgentCore. The case matters because it shows how a regulated team combines specialized agents, memory, and explicit escalation rather than treating autonomy as permission to remediate unchecked."
published_at: "2026-11-07"
updated_at: "2026-11-07"
record_date: "2026-11-07"
date_kind: "published_at"
topics: ["claude"]
entities: ["Greenlight Financial","Luna","Amazon Bedrock AgentCore","Amazon Web Services","Tines","Claude Desktop","Model Context Protocol"]
related_patterns: ["agent-ready-software-exposes-capabilities","ai-native-orgs-move-to-review-and-orchestration"]
novelty_label: "new_fact"
what_changed: "Greenlight Financial presents a distinct autonomous security operations center built with Amazon Bedrock AgentCore."
prior_refs: ["https://newruntime.com/posts/how-tamnoon-built-ai-powered-cloud-security-remediation-f9b887/"]
source_url: "https://aws.amazon.com/blogs/machine-learning/how-greenlight-financial-built-an-autonomous-soc-solution-on-amazon-bedrock-agentcore"
source_urls: ["https://aws.amazon.com/blogs/machine-learning/how-greenlight-financial-built-an-autonomous-soc-solution-on-amazon-bedrock-agentcore"]
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "post:how-greenlight-financial-built-an-autonomous-soc-solution-83215d"
status: "published"
visuals: []
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
routes: {"html":"https://newruntime.com/posts/how-greenlight-financial-built-an-autonomous-soc-solution-83215d/","markdown":"https://newruntime.com/posts/how-greenlight-financial-built-an-autonomous-soc-solution-83215d.md","json":"https://newruntime.com/posts/how-greenlight-financial-built-an-autonomous-soc-solution-83215d.json"}
markdown_url: "https://newruntime.com/posts/how-greenlight-financial-built-an-autonomous-soc-solution-83215d.md"
---

# How Greenlight Financial built an autonomous SOC solution on Amazon Bedrock AgentCore

## Retrieval answer

Greenlight Financial says its Luna system resolves more than 90% of up to 4,000 monthly security and risk cases without human intervention, using a tiered multi-agent architecture on Amazon Bedrock AgentCore. The case matters because it shows how a regulated team combines specialized agents, memory, and explicit escalation rather than treating autonomy as permission to remediate unchecked.

## Summary
Greenlight Financial says its Luna system resolves more than 90% of up to 4,000 monthly security and risk cases without human intervention, using a tiered multi-agent architecture on Amazon Bedrock AgentCore. The case matters because it shows how a regulated team combines specialized agents, memory, and explicit escalation rather than treating autonomy as permission to remediate unchecked.

## What happened
AWS’s announcement describes Luna as Greenlight Financial’s autonomous security operations center (SOC) system, built on Amazon Bedrock AgentCore. Greenlight processes sensitive financial data and receives 3,000–4,000 security and risk alerts per month, including dark-web breach-card notifications, identity and access anomalies, infrastructure alerts, and financial-risk events. AWS says a human analyst previously spent 15–30 minutes on a case such as a breach-card alert, cross-checking card status, prior notifications, customer sessions, and support tickets.

Luna uses a hierarchical supervisor design. Tier 1 runs on AgentCore runtime inside an Amazon Virtual Private Cloud and coordinates more than 30 specialized agents covering areas such as identity, endpoint detection, observability, asset inventory, payments, customer support, threat intelligence, and approved automation playbooks. Cases arrive through Tines SOAR or through an API Gateway that exposes the Luna Queue API and an MCP endpoint. The supervisor selects agents based on the alert, combines their findings, and returns a verdict; AWS says routine cases have a median triage time in the single-digit seconds.

Cases above Tier 1’s confidence threshold move to Tier 2, which uses an advanced foundation model with extended reasoning capabilities. It investigates escalations across three to five data sources, invokes specialized agents with expanded context, and produces evidence-backed reports for human review. Tier 2 can run on a schedule through EventBridge and SNS or on demand for urgent cases. Greenlight also offers direct API access to engineers and a Claude Desktop extension for on-call deep dives.

AgentCore memory supports a 30-day rolling episodic window and longer-lived semantic preferences and resolution templates. A separate learning pipeline captures case outcomes through Lambda, stores and deduplicates patterns in DynamoDB, and feeds processed learnings back to supervisors. AWS says that this combination raised autonomous resolution from 83% with Tier 1 alone to more than 90% with Tier 1, Tier 2, and learnings. Greenlight expanded Luna from SOC work into financial-risk assessment within two months, adding agents and a risk supervisor while reusing integrations such as Zendesk and Mixpanel. Its workflow is designed to recommend and provide evidence; a human or approved policy authorizes remediation.

## What the archive adds
New Runtime’s earlier coverage of [Tamnoon’s AI-powered cloud security remediation](https://newruntime.com/posts/how-tamnoon-built-ai-powered-cloud-security-remediation-f9b887/) (2026-10-19) treated the remediation pipeline, rather than one model call, as the operative unit of security automation. Greenlight is a new case: it adds reported case volume, resolution rates, and an explicit learning loop for SOC triage.

## Trend signal
This supports [agent-ready software exposes capabilities](https://newruntime.com/patterns/agent-ready-software-exposes-capabilities/): Luna is composed from bounded integrations and specialized agents that query particular systems, while escalation and policy govern what follows. The account is also consistent with [AI-native organizations move toward review and orchestration](https://newruntime.com/patterns/ai-native-orgs-move-to-review-and-orchestration/), since human analysts focus on ambiguous cases and retain remediation authority.

## Why now
Greenlight says the financial-risk expansion followed the SOC deployment within two months. That timing makes the case useful as a report of horizontal reuse: the company says it added domain-specific agents and a supervisor to extend an existing system rather than rebuilding it.

## Connections to other events
New Runtime’s earlier coverage of an [AI-powered contract intelligence platform on Amazon Bedrock AgentCore](https://newruntime.com/posts/building-an-ai-powered-contract-intelligence-platform-with-7ab3d6/) (2026-09-30) described agents handling extraction and verification while analytics served broader questions. Both accounts show AgentCore deployments organized around distinct work units and supervisory routing, though their domains and reported results differ.

## Why it matters
For teams in regulated environments, the useful detail is not simply that a large share of cases was automated. Greenlight describes a set of controls around that claim: start with a bounded decision, route low-confidence work to deeper investigation, preserve an evidence chain for human review, and separate recommendations from authorization to remediate. That separation gives teams a way to automate routine information gathering without making an agent the final authority over consequential actions.

The reported learning pipeline is also operationally important. Capturing outcomes, deduplicating similar cases, and turning repeated resolutions into context creates a path for the system to improve from work the organization already performs. Teams considering a similar design should define what counts as a confirmed pattern, how memory can be corrected, and which actions remain policy-gated. Those governance choices matter at least as much as the number of agents in the architecture.

## Limits and uncertainty
The performance figures are Greenlight’s production measurements as reported by AWS; they have not been independently verified here. The announcement does not provide the denominator and evaluation method behind correctness, confidence calibration, false negatives, or the claim that cases are resolved autonomously. It also does not disclose model names, per-case costs, the rate at which human reviewers overturn recommendations, or detailed compliance-control results. The reported time savings and risk reduction should therefore be treated as company claims, not independently measured outcomes.

## Reader takeaway
Luna’s reported gains come from a system around the model: specialized integrations, two levels of investigation, memory updated from case outcomes, and a human or approved policy in control of remediation. For a team building in a regulated domain, that is the reusable pattern—not a promise that a multi-agent design will automatically deliver the same resolution rate.

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- topic hub: [Claude](https://newruntime.com/topics/claude.md): Explore the claude topic hub.
- collection: [Field Notes](https://newruntime.com/posts.json): Open the latest editorial analysis.
- collection: [Sources](https://newruntime.com/sources/): See the original sources this archive cites.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)