Greenlight Financial says Luna autonomously resolves more than 90% of up to 4,000 monthly cases

In an article published November 6, 2026, AWS profiled Greenlight Financial’s Luna, an autonomous security operations center solution built on Amazon Bedrock AgentCore. Greenlight receives 3,000–4,000 monthly alerts involving dark web breach cards, identity and access anomalies, infrastructure, and financial risk. The company says Luna handles up to 4,000 cases per month and resolves more than 90% without human intervention.

Luna uses a tiered supervisor design: Tier 1 handles high-volume triage, while Tier 2 investigates more complex cases. The Tier 1 supervisor orchestrates more than 30 specialized agents. AWS reports a median triage time of seconds for routine cases, compared with 15–30 minutes for manual handling. Luna’s episodic memory retains recent events and outcomes in a rolling 30-day window. A case-learnings pipeline, AWS says, helped lift autonomous resolution from 83% with Tier 1 alone to more than 90% with Tier 1, Tier 2, and learnings combined.

Greenlight says it expanded Luna from SOC operations into financial risk assessment within two months of deployment, and estimates it avoids 900–1,800 hours of routine manual work monthly. The system is accessible through Tines SOAR ingestion, direct API access, and a Claude Desktop extension. Its stated role is to triage and recommend—not independently authorize remediation: action requires explicit policy approval and human or approved automated authorization. Broader autonomous triage for financial and business risk cases remains in progress.