How Greenlight Financial built an autonomous SOC solution on Amazon Bedrock AgentCore
AWS Machine Learning Blog · 人工智能
Greenlight Financial resolves more than 90 percent of up to 4,000 security and risk cases each month without human intervention. Greenlight’s Luna uses Amazon Bedrock AgentCore , infrastructure for building, connecting, and optimizing agents at scale. Specifically, Greenlight uses AgentCore runtime, a capability of Amazon Bedrock AgentCore, to host Luna’s agent code. It uses AgentCore memory, a capability of Amazon Bedrock AgentCore, to support its tiered multi-agent system. This avoids the need to build and operate these capabilities in-house. Luna triages dark web breach-card alerts, identity anomalies, and financial-risk events in seconds. This post explains how Greenlight Financial built an autonomous security operations center (SOC) solution on Amazon Bedrock AgentCore. We cover its multi-tiered supervisor architecture, more than 30 specialized agents, episodic memory for continuous learning, and expansion from SOC use cases into financial risk triage. We share production metrics, infrastructure decisions, and patterns for building autonomous security operations in regulated industries. What Greenlight needed to solve Greenlight Financial provides financial products for families: debit cards, savings tools, and connected devices such as the Family Hub and Pet Tracker. The company processes sensitive financial data at scale under the same regulatory requirements as major banks. Greenlight’s SOC receives 3,000–4,000 security and risk alerts per month from four primary vectors: Dark web breach cards – Card Network and internal threat intel flag Greenlight customer cards found on the dark web. Identity and access anomalies – Unusual login patterns, privilege escalations, and policy violations across Identity Provider (IdP) and internal systems. Infrastructure alerts – Signals from Signals from EDR (Endpoint Detection and Response), SIEM (Security Information and Event Management), Asset Inventory, and other observability tools. Financial risk events – Suspicious tr