What changed
Greenlight Financial announced the deployment of an autonomous security operations center (SOC) solution using Amazon Bedrock AgentCore. The system, named Luna, resolves more than 90 percent of up to 4,000 security and risk cases each month without human intervention. Luna leverages Amazon Bedrock AgentCore's runtime and memory capabilities to host its agent code and support a tiered multi-agent system, respectively.
What this means in practice
Greenlight’s Luna system triages dark web breach-card alerts, identity anomalies, and financial-risk events in seconds. The system uses a tiered supervisor architecture with more than 30 specialized agents to handle incoming cases. Tier 1 supervisor handles high-volume triage using an advanced language model on Amazon Bedrock, orchestrating specialized agents for tasks like identity checks, endpoint detection, and payment processing. The median triage time for routine cases is single-digit seconds. Tier 2 supervisor handles complex cases requiring multi-step reasoning, using an advanced foundation model on Amazon Bedrock with extended reasoning capabilities. The system also features episodic memory for continuous learning, allowing it to auto-allowlist expected patterns and improve accuracy over time.
Limitations and availability
The supplied announcement does not specify the exact number of active parameters or total parameters for the models used. The system is designed for financial services compliance and operates within regulated environments. Luna is available through three entry points: Tines SOAR for automated alert ingestion, direct API access for ad-hoc investigations, and a chat-based interface via the Claude Desktop extension. The system is currently in production use at Greenlight Financial, with metrics and infrastructure decisions shared in the blog post.
