---
id: "lib-2026-11-06-how-greenlight-financial-built-an-autonomous-soc"
type: "library"
title: "How Greenlight Financial built an autonomous SOC solution on Amazon Bedrock AgentCore"
lang: "EN"
org: "Greenlight Financial (AWS co-authored)"
source_type: "Other"
date: "2026-11-06"
week: "2026-W45"
url: "https://nosov.ai/library/lib-2026-11-06-how-greenlight-financial-built-an-autonomous-soc/"
original_url: "https://aws.amazon.com/blogs/machine-learning/how-greenlight-financial-built-an-autonomous-soc-solution-on-amazon-bedrock-agentcore/"
tier: "B"
tier_name: "Useful, limited"
tier_reason: "Greenlight Financial's security team describes a production triage system on AWS's blog with clear architecture and stage-by-stage resolution rates; figures are self-reported, the hours saved are computed, and no error rate is given."
summary_basis: "full-text"
original_minutes: "10"
tags: ["ai technology", "business transformation", "security operations", "agents", "human in the loop"]
---

# How Greenlight Financial built an autonomous SOC solution on Amazon Bedrock AgentCore

Tier B (Useful, limited): Greenlight Financial's security team describes a production triage system on AWS's blog with clear architecture and stage-by-stage resolution rates; figures are self-reported, the hours saved are computed, and no error rate is given.

Summary based on the full text.

## In short

An AWS Machine Learning blog post (6 November 2026) on Luna, Greenlight Financial's security operations agent built on Amazon Bedrock AgentCore. A Tier 1 supervisor orchestrates more than 30 specialist agents for routine triage; a Tier 2 supervisor on a reasoning model takes the harder 10% of cases; episodic and long-term memory feed resolution patterns back in. Luna triages and recommends; remediation needs a human analyst or an approved automated policy.

## Key numbers

- 3,000-4,000: security and risk alerts per month
- 15-30 minutes: manual handling time per case before automation
- 83% to more than 90%: autonomous resolution rate with Tier 1 only vs Tier 1, Tier 2 and the learnings pipeline
- 17% to <10%: share of cases escalated to human analysts
- 900-1,800 hours: estimated analyst time avoided per month, computed from volume and handling time

## What it reports

- Alert sources: dark web breach cards, identity and access anomalies, infrastructure alerts, financial risk events.
- Tier 1 resolves 83% of cases; adding Tier 2 and the learnings pipeline takes autonomous resolution above 90%; escalations fall from 17% to under 10%.
- Median triage time for routine cases is single-digit seconds against 15-30 minutes by hand.
- Memory: a 30-day episodic window (for example, auto-allowlisting a weekly maintenance access pattern) and long-term notes such as one dark web source having a 73% false-positive rate. A pattern resolved the same way three times becomes a confirmed pattern.
- Expanded into financial risk triage within two months by adding agents and a risk-domain supervisor.
- Hours avoided (900-1,800 a month) are calculated from 4,000 cases at 15-30 minutes, not measured.

## How they got it

A customer case co-published by AWS. Rates come from Greenlight's production measurements; the method for judging a resolution correct is not described.

## Limits

- No accuracy, false-negative or missed-incident rate; "resolved" is not defined against a ground truth.
- Cost avoidance is stated qualitatively ("multiple full-time" equivalents) and the hours figure is arithmetic.
- Promotional for AgentCore.

## Why it matters for companies

Security alert triage fits agents well: high volume, repeatable look-ups across many systems, and a clear escalate-or-close decision. Mirroring the existing L1/L2 structure made the system easier for analysts to trust, and keeping remediation behind human or policy approval kept compliance simple. Before copying the 90% figure, ask for the miss rate: an autonomous resolver that closes a real incident is the failure that matters.

Original: https://aws.amazon.com/blogs/machine-learning/how-greenlight-financial-built-an-autonomous-soc-solution-on-amazon-bedrock-agentcore/