Greenlight's SOC agents resolve 90% of 4,000 monthly cases unaided

Greenlight Financial, a US family-finance company, says its multi-agent system Luna now resolves more than 90% of its security and risk cases without a human, according to an AWS Machine Learning Blog post dated 6 November 2026. The post was written by Greenlight and AWS staff and describes a deployment on Amazon Bedrock AgentCore. It is vendor-published, and the figures are Greenlight's own.

What Greenlight built

Greenlight's security operations centre (SOC) receives 3,000 to 4,000 alerts a month from four sources: dark web breach-card reports, identity anomalies, infrastructure alerts and financial-risk events. The post says each case needed cross-checking several systems and took an analyst 15 to 30 minutes by hand.

Luna uses two tiers. A first-tier supervisor orchestrates more than 30 specialised agents (identity, endpoint, payments, support tickets, threat intelligence and others) and renders a verdict. Cases it is unsure about go to a second-tier supervisor on a model with extended reasoning, which the post says handles the roughly 10% of cases needing multi-step reasoning and writes an evidence report for people.

The numbers Greenlight reports

• Autonomous resolution: 83% with the first tier only, more than 90% with both tiers plus a learnings pipeline.
• Time to triage a routine case: 15 to 30 minutes before, seconds after.
• Human escalations: 100% before, 17% with tier one, under 10% with both tiers.
• Analyst time avoided: Greenlight estimates 900 to 1,800 hours a month, derived from case volume and its manual handling times.

Where the extra resolutions came from

The gain from 83% to over 90% is attributed to memory. A 30-day episodic memory lets Luna recognise repeat patterns, such as a maintenance role that logs in at 3 am every Tuesday, and allowlist them. A pipeline records a pattern after Luna resolves a case the same way three times, and long-term memory stores learnings such as a 73% false-positive rate for cards from one dark web source. Greenlight says Luna has run for six months.

The control that matters

The post says Luna was designed to triage and recommend, not to remediate on its own. A human analyst or an approved automated policy authorises and executes the fix. Greenlight says this separation satisfied compliance requirements for a firm regulated like a bank. Note that 'resolved without human intervention' therefore means the triage verdict, not the remediation.

What the post leaves out

• Cost. The results table says cost avoidance is 'significant' and 'equivalent of multiple full-time employees', with no dollar figure for model calls, infrastructure or build effort.
• Accuracy. It gives no rate of wrong auto-closures, reopened cases or missed incidents, so 90% resolved is not 90% correct.
• Independent checks. No outside audit is cited, and the memory feature that lifts resolution also risks allowlisting a real attacker's pattern; the post does not describe a review of what gets allowlisted.
• Model names. The tiers are described only as 'an advanced language model' on Bedrock.