Greenlight’s Luna resolves over 90% of security cases autonomously

A multi-agent system for high-volume alerts

Greenlight provides financial products for families, including debit cards, savings tools, and connected devices such as the Family Hub and Pet Tracker. According to AWS, its security operations center receives 3,000, 4,000 security and risk alerts per month from sources including dark web breach-card reports, identity and access anomalies, infrastructure monitoring, and financial risk systems.

Before Luna, a single dark web breach-card notification could require an analyst to check whether the card was active, remove duplicate notifications, review customer session data, and examine open support tickets. AWS says this process took 15-30 minutes per case.

Greenlight built Luna as a hierarchical multi-agent system on Amazon Bedrock AgentCore. A Tier 1 supervisor performs initial triage using more than 30 specialized agents covering areas such as identity, endpoint detection, observability, asset inventory, payment processing, customer support, threat intelligence, and remediation automation. The median triage time for routine cases is single-digit seconds, according to AWS.

Tier 2 investigation and persistent memory

Cases that fall below Tier 1’s confidence threshold are escalated to a Tier 2 supervisor. AWS says this layer handles the 10 percent of cases requiring multi-step reasoning, including deeper correlation across three to five data sources and the creation of investigation reports with evidence chains for human review.

Luna is available through automated ingestion from Tines SOAR, direct API access for Security, Risk, and ProdOps engineers, and a Claude Desktop extension for on-call engineers. The system can also process urgent escalations on demand or batch cases through Amazon EventBridge and Amazon Simple Notification Service.

Amazon Bedrock AgentCore memory gives Luna both a 30-day rolling episodic memory and longer-term memory for semantic preferences and resolution templates. AWS describes a case in which Luna learned that a recurring Tuesday maintenance access pattern was expected and began allowing it automatically instead of flagging it each week.

A separate learning pipeline captures case resolutions with AWS Lambda, stores and deduplicates patterns in DynamoDB, and feeds actionable learnings back to the supervisors. AWS says this increased Luna’s autonomous resolution rate from 83 percent with Tier 1 alone to more than 90 percent with Tier 1, Tier 2, and the learning system combined.

Expansion from security operations to financial risk

Greenlight expanded Luna into financial risk assessment within two months of its SOC deployment, according to AWS. The company added specialized agents and a risk-domain supervisor while keeping the existing infrastructure largely unchanged.

For dark web breach-card alerts, Luna receives reports from Mastercard and internal feeds, checks Galileo to verify the card and review its status and transaction history, then consults DynamoDB to identify repeat notifications or previously remediated cards. AWS presents the expansion as an example of how an agent architecture built for security operations can also support financial risk triage in a regulated environment.

For users and security teams, the approach is designed to handle routine alerts at machine speed while sending more complex cases to people with additional context. Greenlight also avoids building and operating the agent runtime and memory capabilities itself by using Amazon Bedrock AgentCore, according to AWS.