How Greenlight Financial built an autonomous SOC solution on Amazon Bedrock AgentCore
B · Useful, limited Greenlight Financial's security team describes a production triage system on AWS's blog with clear architecture and stage-by-stage resolution rates; figures are self-reported, the hours saved are computed, and no error rate is given.
Summary based on the full text·Original: about 10 minutes to read
In short
An AWS Machine Learning blog post (6 November 2026) on Luna, Greenlight Financial's security operations agent built on Amazon Bedrock AgentCore. A Tier 1 supervisor orchestrates more than 30 specialist agents for routine triage; a Tier 2 supervisor on a reasoning model takes the harder 10% of cases; episodic and long-term memory feed resolution patterns back in. Luna triages and recommends; remediation needs a human analyst or an approved automated policy.
Key numbers
- 3,000-4,000security and risk alerts per month
- 15-30 minutesmanual handling time per case before automation
- 83% to more than 90%autonomous resolution rate with Tier 1 only vs Tier 1, Tier 2 and the learnings pipeline
- 17% to <10%share of cases escalated to human analysts
- 900-1,800 hoursestimated analyst time avoided per month, computed from volume and handling time
As reported by the source.
English·Web page·opens aws.amazon.com
What it reports
- Alert sources: dark web breach cards, identity and access anomalies, infrastructure alerts, financial risk events.
- Tier 1 resolves 83% of cases; adding Tier 2 and the learnings pipeline takes autonomous resolution above 90%; escalations fall from 17% to under 10%.
- Median triage time for routine cases is single-digit seconds against 15-30 minutes by hand.
- Memory: a 30-day episodic window (for example, auto-allowlisting a weekly maintenance access pattern) and long-term notes such as one dark web source having a 73% false-positive rate. A pattern resolved the same way three times becomes a confirmed pattern.
- Expanded into financial risk triage within two months by adding agents and a risk-domain supervisor.
- Hours avoided (900-1,800 a month) are calculated from 4,000 cases at 15-30 minutes, not measured.
How they got it
A customer case co-published by AWS. Rates come from Greenlight's production measurements; the method for judging a resolution correct is not described.
Limits
- No accuracy, false-negative or missed-incident rate; "resolved" is not defined against a ground truth.
- Cost avoidance is stated qualitatively ("multiple full-time" equivalents) and the hours figure is arithmetic.
- Promotional for AgentCore.
Why it matters for companies
Security alert triage fits agents well: high volume, repeatable look-ups across many systems, and a clear escalate-or-close decision. Mirroring the existing L1/L2 structure made the system easier for analysts to trust, and keeping remediation behind human or policy approval kept compliance simple. Before copying the 90% figure, ask for the miss rate: an autonomous resolver that closes a real incident is the failure that matters.
Summary based on the full text. Read the original for the full argument and data.Read the original on aws.amazon.com