Greenlight's AI SOC resolves over 90% of up to 4,000 cases a month on its own. Read what resolved means

An alert arrives: a batch of payment cards linked to Greenlight customers has appeared on a dark web source. A year ago, an analyst would spend 15 to 30 minutes on it, checking card status, looking for duplicate reports, reviewing account sessions and opening tickets. Historically, 73% of alerts from that particular source turned out to be false positives.

Greenlight Financial, a U.S. fintech that, according to the post, operates under the same regulatory requirements as major banks, now hands that work to an AI system called Luna. The company reports that Luna resolves more than 90% of its 3,000 to 4,000 monthly security and risk cases without a human analyst.

How Luna is built

Luna runs on Amazon Bedrock AgentCore in two tiers.

1. Alert in
2. Tier 1 triage
3. Tier 2 investigation
4. Human analyst
5. Case learnings

Tier 1 handles volume. A supervisor agent orchestrates more than 30 specialized agents covering identity, endpoints, observability, payments and threat intelligence, inside a private network. With Tier 1 alone, 83% of cases closed without escalation and 17% went to analysts.

Tier 2 takes the roughly 10% of cases that fall below Tier 1’s confidence threshold. It uses a model with extended reasoning, runs on a schedule or on demand, and combines three to five data sources per case. With both tiers and the learnings loop, escalations dropped below 10%.

Memory keeps a 30-day rolling window of recent cases and a long-term store of preferences and resolution templates. A separate pipeline captures how each case was resolved and feeds it back.

The reported results: median triage time for routine cases fell from 15 to 30 minutes to single-digit seconds, and Greenlight estimates 900 to 1,800 analyst hours avoided per month. It extended Luna from security into financial risk triage within two months.

What “resolved” means here

The number is impressive, and it is important to read it precisely. The post is explicit that Luna triages and recommends. It does not take remediation actions on its own; remediation is done by a person or by an automated policy that was approved in advance.

So “resolved autonomously” means the investigation reached a conclusion without an analyst: a false positive closed, a duplicate merged, a real issue documented and routed. That is exactly where autonomy belongs in a SOC. Triage is high volume, mostly reversible, and easy to audit afterwards. Containment and remediation, such as blocking a card or locking an account, affect customers and need a decision someone owns.

It is the pattern we called bounded autonomy in the agentic SOC, with real numbers attached.

What other security teams can copy

Escalate on confidence, not on category. Tier 2 is triggered by Tier 1’s uncertainty, not by alert type. That keeps easy cases cheap and gives the expensive model only the hard ones.

Measure the false-positive economics first. A source with a 73% false-positive rate is the ideal starting point: high volume, low stakes, measurable gains.

Treat the learnings loop as a control surface. Resolutions fed back to the supervisors change future behavior. Someone should review what is being learned, the way a team lead reviews a junior analyst’s closures, or a wrong pattern will be repeated at machine speed.

Hold remediation behind policy. Greenlight’s line between recommending and acting is what makes a 90% autonomy rate acceptable to a regulated company. Keep it explicit.