Greenlight Financial replaced a labor‑intensive analyst process with an autonomous security operations center (SOC) built on Amazon Bedrock AgentCore. By deploying a hierarchical set of agents that handle high‑volume triage and escalation, the company now resolves more than 90 % of alerts without human intervention, delivering sub‑second response times for routine cases. Practitioners should note the concrete architectural choices that enable this speed and the operational trade‑offs that come with a regulated financial environment.
Why the change matters to engineers
Traditional SOC pipelines require analysts to spend 15‑30 minutes per alert, a cost that scales linearly with alert volume. Greenlight’s shift to an autonomous model reduces manual effort, improves consistency, and creates a data‑driven feedback loop for future improvements. For AI, cloud, DevOps, and security engineers, the pattern demonstrates how to offload repetitive decision logic to LLM‑backed agents while preserving a clear escalation path for complex cases.
Tiered multi‑agent architecture on AgentCore
The solution follows a two‑tier supervisor model. The Tier 1 supervisor runs an advanced language model via the AgentCore runtime inside a private Amazon VPC. It receives raw alerts, orchestrates more than thirty specialized agents, and decides whether a case can be closed automatically or needs escalation. The Tier 2 supervisor handles the subset of cases that exceed predefined complexity thresholds, providing full context to human analysts.
Specialized agents cover distinct domains such as identity access, endpoint detection, observability, asset inventory, data analytics, payment processing, customer experience, support tickets, code repositories, and project tracking. Each agent queries the appropriate data source, enriches the alert, and returns a concise assessment to the Tier 1 supervisor. The architecture leverages AgentCore memory to retain episodic context across related alerts, enabling continuous learning without rebuilding the entire knowledge base.
Implementation and operational considerations
Key implementation details include:
- Deployment of the agent code as a ZIP bundle stored in
Amazon S3and referenced by the runtime. - Isolation of the runtime in private subnets, ensuring that data‑in‑flight remains within the VPC.
- Use of the AgentCore memory feature to maintain short‑term state for each case, avoiding the need for a separate state store.
- Metrics collection that shows >90 % autonomous resolution and average processing latency measured in seconds.
From an operations perspective, the pattern reduces the number of long‑running analyst shifts but introduces new monitoring requirements for agent health, runtime latency, and memory consistency. Engineers should instrument both the supervisor layers and individual agents to detect degradation early, especially given the regulatory constraints of financial services.
Security and compliance implications
Running the runtime inside a VPC satisfies typical financial‑services network isolation requirements. Because the agents access multiple internal data sources (identity providers, EDR, SIEM, transaction databases), each integration must respect existing access controls. The architecture does not replace existing authorization mechanisms; instead, it aggregates data under the supervision of the Tier 1 and Tier 2 components. Practitioners should audit the data‑access patterns of each agent and ensure that any new data flows are logged and auditable.
Related CloudNinjas coverage: AWS.
What This Means For Practitioners
Adopting a tiered multi‑agent SOC on Amazon Bedrock AgentCore offers a concrete path to automate high‑volume security triage while preserving human oversight for edge cases. Engineers should evaluate whether their alert volume justifies the upfront effort of building specialized agents, verify that VPC‑level isolation meets compliance needs, and establish robust observability for the agent runtime. The pattern also highlights the value of episodic memory for incremental learning without a full data lake rebuild. Organizations ready to invest in these capabilities can expect dramatic reductions in manual effort and faster, more consistent incident response.