Greenlight closes 90% of 4,000 monthly security cases with agents on AgentCore

It is a familiar pain point for any security team: there are many alerts, almost all of them are routine, yet every one must be checked manually. At Greenlight Financial, which provides debit cards for families, the SOC receives 3,000–4,000 signals a month. A single case involving a card found on the dark web requires checking the card's status, duplicate notifications, customer sessions, and open tickets. That takes 15–30 minutes of a person's time, and at this volume the model simply does not scale.

How Luna works

The team built a hierarchical multi-agent system on Amazon Bedrock AgentCore, mirroring the structure of a human SOC. A tier-one supervisor receives cases through API Gateway, with an MCP endpoint, or from Tines SOAR. It selects the necessary agents from a pool of 30+ specialists covering identity and access, EDR, asset inventory, payments, support, threat intelligence, and other areas. It then consolidates their findings and issues a verdict. The median processing time for routine cases is measured in seconds.

If confidence is insufficient, the case is passed to a tier-two supervisor. It runs on a model with extended reasoning, launches on a schedule through EventBridge or immediately on request, and correlates 3–5 data sources. The output is a report with a chain of evidence for a human reviewer. About 10% of cases follow this path.

Memory as the main multiplier

The most practical part of the story is the memory layer. Episodic memory retains 30 days of decisions. One example from the article: every Tuesday at 3 a.m., an infrastructure role performs the same access operation as part of maintenance. Without memory, the agent flags it every week; with memory, it adds the pattern to the allowlist after the first investigation.

Long-term memory stores decision templates and statistics such as “cards from this source generate 73% false positives.” A separate pipeline built on Lambda and DynamoDB records case outcomes and, when a case is resolved the same way three times, registers a confirmed pattern. According to Greenlight, this is what increased autonomy from 83% with tier 1 alone to 90%+.

Expanding into financial risk

Two months after launching the system in the SOC, the team applied the same architecture to risk triage. It added new agents for Galileo and fraud scoring, as well as a risk supervisor, while reusing the Zendesk and Mixpanel agents. The workflow for a card found on the dark web covers a check in the processing system, deduplication, session and ticket reconciliation, and risk assessment. Low-risk cases are logged, medium-risk cases are sent for review, and high-risk cases are escalated with supporting evidence.

Key takeaways

First, start with a narrow domain and a clear success metric: “resolved correctly or escalated.” Second, mirror the human organizational structure, which makes it easier for the team to trust the system. Third, triage first and take action afterward. Luna only makes recommendations; remediation is initiated by a person or an approved policy, which helped the system pass compliance checks.

There are limitations as well. This is a post on the AWS blog, the figures are reported by the company itself, and the savings are presented as an estimate of 900–1,800 analyst hours per month. There is no data on the share of incorrect automated verdicts or the cost of inference. Even so, the pattern of tiers, memory with deduplication, and shared agents can be transferred to any support operation, antifraud system, or DevOps incident workflow.