How Workday Rebuilt Its Security Agent Stack on Mastra in 31 Days

Workday is the HR/finance system for 11,500 organizations, over 65% of the Fortune 500, and has more than 80 million users. With that much sensitive data, security is paramount, which is why their security team built an autonomous agentic system to triage incoming alerts with Mastra, saving around 20 minutes per alert.

Building an autonomous SOC

Bryce Montano is an engineer on Workday's security team, where he also spends time on incident response. About a year ago, his team was formed with an ambitious goal: build autonomous agents that could triage security alerts, perform investigations, and deliver responses—without waiting for an analyst to begin the investigation.

The security industry calls this an "autonomous SOC" (Security Operations Center). Workday evaluated an out-of-the-box autonomous SOC product but found it not specific enough to their needs.

So in February 2025, the team set out to build their own. They experimented with LangGraph and LangChain. They went pretty far with Amazon Bedrock Agents, even spending months getting things up and running in production. When AWS shifted toward AgentCore, they built a separate proof of concept using Python-based Strands.

But their TypeScript-only team worried about having to keep working in another language.

At the last second, someone suggested they try Mastra instead. The team went all-in.

Why Mastra

The challenge with Amazon Bedrock Agents was there was no way to test locally. You had to deploy to AWS infrastructure every single time you wanted to test a change. "We learned that you can test your agent locally on Mastra," says Bryce Montano, an engineer on Workday's security team. "That was impressive."

The local testing and the support for S3 vector buckets kicked off what would become a 31-day Bedrock Agents to Mastra migration sprint. The outcome: it slashed their codebase by 3,000 lines and delivered roughly 98% cost savings on their vector storage infrastructure.

"After playing around with it for like a week, we were like: Mastra can do everything we need." — Bryce Montano, Engineer, Workday Security

The migration from Bedrock Agents to Mastra

What followed was a 31-day sprint to rip out Bedrock and replace it with Mastra as the orchestration layer.

The team was excited about a few things. Mastra's abstractions meant they didn't have to worry about being hampered by the lack of ML expertise. During the migration, the one member who did have expertise, Natalie Kwong, a security automation engineer, was able to wipe 3,000 lines of code from the codebase.

The cost savings were also significant. They were able to use S3 vector buckets to store embeddings, and when the team ran the numbers, they estimated a 98% reduction in vector-storage costs.

The architecture

Workday's new architecture is fully serverless, running on AWS Lambda with a 15-minute execution limit. The team's own API gateway sits in front of Mastra—they use the framework as a library rather than deploying the Mastra server.

Here's their set-up:

Agent orchestration: When a security alert comes in, it triggers an agent that triages the alert, runs tools to gather context, and delivers a response—typically within a minute or two, maybe three.

Observability: The team uses the OTEL bridge for telemetry, which "just worked out of the box" with their AWS infrastructure.

RAG with S3 Vector Buckets: The team wanted to use AWS's new S3 vector buckets for storing embeddings—a substantial cost savings over alternatives. But AWS hadn't built the necessary constructs for Bedrock Agents to support them yet. With Mastra, they simply called the knowledge base as a tool.

Beating the analysts

The team measures success by a simple metric: can the agent triage an alert before a human analyst gets to it?

The answer is yes—usually within about one minute of an alert firing. By the time an analyst opens the case, the agent has already gathered context, run its investigation, and delivered a preliminary assessment.

Not only does the agent beat the analyst, says Montano, "we save them about 20 minutes."

Workday's broader SecOps function operates 24/7/365. In that environment, saving around 20 minutes on every alert the agent handles can compound quickly. And because the team can now test agents locally instead of deploying to AWS, their iteration speed has dramatically improved.

What's next

The team is now exploring Mastra's network capabilities for multi-agent orchestration and testing the built-in evaluation tools to replace their current setup.

They're also working on making agent-building more accessible to the broader security team—analysts who may not write code but could benefit from experimenting with system prompts and tool configurations.