Greenlight Financial Transforms Security Operations with Autonomous Multi-Agent AI Systems
The rapid evolution of digital financial services has forced institutions to confront an escalating volume of security and risk alerts, often outpacing the capacity of human-led security operations centers (SOC). Greenlight Financial, a prominent provider of financial technology for families, has addressed this operational bottleneck by deploying "Luna," an autonomous, multi-agent AI system built on Amazon Bedrock AgentCore. This infrastructure allows Greenlight to resolve over 90 percent of its 4,000 monthly security and risk cases without human intervention, effectively reclaiming thousands of analyst hours and establishing a new benchmark for automated oversight in highly regulated industries.
The Scaling Challenge in Financial Security
Greenlight’s operational requirements mirror those of major banking institutions. The company manages a diverse ecosystem of products, including debit cards, savings accounts, and connected hardware such as the Family Hub and Pet Tracker. With this scale comes a significant responsibility to process sensitive data while maintaining rigorous compliance standards.
Historically, Greenlight’s SOC faced a daunting influx of 3,000 to 4,000 security and risk alerts every month. These alerts originate from various vectors, including dark web breach notifications, identity anomalies, and financial risk events. The traditional workflow for handling a single dark web alert is labor-intensive: an analyst must verify card status, cross-reference deduplication records, review customer session behavior, and inspect open support tickets. Under the manual model, each case required 15 to 30 minutes of dedicated human effort. At a volume of 4,000 cases, the manual approach was mathematically unsustainable, threatening to overwhelm the security team and increase the window of exposure for potential fraud.
The Architecture of Autonomy: Luna’s Tiered Intelligence
To overcome these constraints, Greenlight architected Luna as a hierarchical, multi-agent system. By leveraging Amazon Bedrock AgentCore, the engineering team bypassed the need to build complex infrastructure from scratch, instead utilizing the platform’s runtime and memory capabilities to manage specialized agents.
The system is structured as a tiered supervisor architecture, designed to mimic the established hierarchy of human SOC teams.
Tier 1: High-Volume Triage
The Tier 1 supervisor acts as the frontline, handling the bulk of incoming traffic. Operating within an Amazon Virtual Private Cloud (VPC), this layer orchestrates more than 30 specialized agents. Each agent possesses a distinct domain of expertise—ranging from identity and access management to endpoint detection, threat intelligence, and payment processing. When an alert arrives via API Gateway or Tines SOAR, the Tier 1 supervisor identifies the necessary agents, synthesizes their findings, and renders a verdict in a matter of seconds.
Tier 2: Complex Deep-Dives
When a case exceeds the confidence threshold of the Tier 1 supervisor—typically occurring in about 10 percent of instances—it is escalated to the Tier 2 supervisor. This agent utilizes advanced foundation models with extended reasoning capabilities. Tier 2 handles the most nuanced scenarios, such as those requiring multi-step logical deduction or complex pattern analysis. This tier operates on a hybrid model, processing batched alerts via Amazon EventBridge rate triggers while remaining available for urgent, on-demand escalations.
The Role of Episodic and Long-Term Memory
The differentiation between a simple triage tool and a truly autonomous SOC lies in the system’s memory layer. Built upon AgentCore memory, Luna retains stateful information that allows for continuous learning.
The system utilizes a 30-day "episodic" memory window to recognize recurring patterns. For example, if a specific infrastructure maintenance role triggers an alert every Tuesday at 3:00 AM, Luna recognizes the regularity after the first instance and autonomously allowlists the behavior, preventing future false positives. Beyond this, long-term memory persists semantic preferences and resolution templates, allowing the system to refine its accuracy over time. A dedicated "case-learnings" pipeline ensures that every human-reviewed resolution is fed back into the system, contributing to a virtuous cycle of improvement that pushed autonomous resolution rates from 83 percent to over 90 percent.
Expansion into Financial Risk
The versatility of this multi-agent architecture was demonstrated when Greenlight successfully expanded Luna’s scope from security operations into financial risk assessment in just two months. The transition required minimal structural changes; by adding new domain-specific agents—such as fraud scoring and transaction verification—and a new risk-domain supervisor, the existing framework was repurposed.
In the case of dark web breach card alerts, Luna performs a comprehensive sweep of the customer’s status, transaction history, and account behavior before flagging it for human review or automatic blocking. This speed of processing is critical in financial services, where the time between the discovery of a leaked card and its fraudulent use is often measured in minutes.
Quantifiable Impact and Performance Metrics
The shift to an autonomous SOC has provided Greenlight with measurable operational benefits. Prior to the implementation of Luna, the company relied entirely on manual triage. With the introduction of Tier 1 automation, the autonomous resolution rate reached 83 percent. Following the integration of Tier 2 and the continuous learning pipeline, that rate exceeded 90 percent.
Most significantly, the time-to-triage for routine cases dropped from 15–30 minutes to just seconds. This represents an estimated avoidance of 900 to 1,800 hours of manual labor per month. By automating the routine, Greenlight has effectively freed its human analysts to focus on high-judgment, complex investigations, while simultaneously ensuring that the company’s security posture remains consistent 24 hours a day, regardless of shifts or human fatigue.
Strategic Lessons for Regulated Industries
The deployment of Luna offers a blueprint for other organizations operating in highly regulated environments. The project’s success can be distilled into five core lessons:
- Bounded Domains First: By starting with security triage before moving to financial risk, Greenlight established a proof-of-concept with clear success criteria before expanding the system’s scope.
- Reflecting Team Structure: By mapping the AI hierarchy to the existing human SOC structure, the organization fostered trust. The model’s logic was immediately intuitive to the human analysts, facilitating easier adoption.
- Compound Value through Memory: The system’s ability to learn from previous incidents was the key to moving from "functional" to "highly effective." Institutional knowledge is now encoded in the system’s memory rather than siloed in human memory.
- Triage Before Action: In a regulated industry, trust is paramount. Greenlight maintained a "human-in-the-loop" model for remediation, where the AI provides the evidence and the recommendation, but final authority rests with human policy. This satisfies compliance requirements while maximizing efficiency.
- Infrastructure Reusability: The ability to reuse specialized agents across different domains—security, risk, and potentially future operational areas—significantly reduces long-term maintenance overhead.
Future Implications and Conclusion
The implications of Greenlight’s success extend beyond the company itself. As artificial intelligence continues to mature, the transition toward autonomous SOCs will likely become a competitive necessity for financial institutions. The ability to process 4,000 cases a month with sub-second latency is not merely an efficiency gain; it is a fundamental shift in risk mitigation.
Greenlight is currently exploring the extension of its multi-agent pattern into additional operational domains, signaling a broader intent to move toward an "autonomous enterprise." By relying on managed infrastructure like Amazon Bedrock AgentCore, the firm has proven that organizations can achieve high-level automation without the pitfalls of building bespoke, unmanageable internal platforms.
For the broader industry, the lesson is clear: autonomy is not about replacing human decision-making, but about providing the infrastructure that allows humans to operate at a higher level of abstraction. As threats become more automated and rapid, the ability to respond at machine speed is no longer a luxury—it is the baseline for modern financial security.
