Joe Moore on AI, Agile Integration, and Trurisk in Siemens’ Digital Twin Security

Hey everyone. We're back here at Qualys Rock on, uh, we've got a few more interviews as we wrap up our day two shooting here of, uh, our coverage of this event. I want to introduce you to Joe Moore.

Joe, welcome to Tech Drunk tv. How are you, man? Thank you very much.

Doing pretty well. Good. Joe, if you wouldn't mind, look into this camera right here.

Let people know kind of who you are, what you do, what brought you here today. Hi, I'm Joe Moore. I'm the Cybersecurity architect for Siemens Digital Industry Software.

I've been Qualys customer for a dozen or so years and wanted to catch up on some new, new topics. Also gave a little talk here today. Excellent.

It's a great year to catch up on new topics 'cause there's plenty of 'em. Sure has. Yeah.

Yeah. You know, I've been covering the Qualys, what used to be the Qualys Security Conference, Q-S-C-K-S-A. I've been doing that for five years as as here at Techstrong.

You know, I was friends with Philippe for many years before that. Um, but this is really, uh, well a, it's a new name with a new focus, but there's so much going on in our world right now, Joe, that it's, it's a crazy time. Um, if you don't mind, you know, Siemens is a big company.

I've interviewed a ton of people from Siemens, everything from the folks who do the digital twinning Yep. For boats, for ships and stuff like this. Uh, of course the high end electronics, everything else.

What, what exactly are you, do you know, part of Siemens ux? So, I'm in the digital industry software part. We make the software, uh, the cad cam software.

We make the product lifecycle management. We do supply chain management software. Uh, we do a lot of work in the digital twin space.

Oh, you do? Yep. Okay.

Alright. So simulation and testing, electronic design. Uh, if it's, if it's something that you can download, there's a good chance that our, our company or our division is involved in, in producing it.

Yeah. I've done several on the digital twining stuff. It's really cool stuff.

It's a neat area, uh, especially seeing how that can apply outside of just the traditional manufacturing space. Uh, we actually apply it internally. I would say there's a place for it.

Insecurity. Absolutely. Yeah.

Develop, I've talked about that before, that, uh, being able to model our software production process as, and create a digital twin of the building process for our software. Uh, that can have implications, that can have benefits. Uh, you know, we, we use machines to convert raw materials or source code into our product.

Absolutely. com, security Boulevard, container Journal, a bunch of, uh, cloud Native now, a bunch of others. Um, just from the idea of being able to test software before it goes live and in, but in a real, well, it's not real.

It's a digital, a digital twin of the real environment. Right. And that makes a huge difference.

Now you spoke here, is this the first time you've spoken at the, uh, Qualys conference? Yes. It's, tell us what you, what you spoke on.

Well, I talked about, uh, Siemens journey with f Total AppSec and True Risk. So we've, we've, how long have you been using True Risk then? Two years or a couple of years.

Yeah, we were What's been, what's been your experience? Well, one of the biggest challenges we have is in, is integrating the big Siemens approach towards everything. Uh, with being a, an agile and, and very dynamic software company, uh, the big company tends to move a little bit more slowly.

Uh, so sometimes we have to drag, drag things along to, to, in order to get our pro product out the door. Um, they are coming along. It's, it's they getting a lot better.

Uh, Siemens is really focusing a lot on becoming a digital transformation, a digital engineering company. Yeah. So, cool.

Um, what was the feedback from the audience here? Well, it was, it was the first session after lunch, so everyone was a little sleepy. A little sleepy carved out.

Yeah. But, uh, overall it seemed very positive. Yeah.

What, what's been your biggest takeaways? Biggest takeaways? Uh, honestly it's putting in place, uh, framework that we can use to, to help our developers secure their own product.

Mm-hmm. Uh, it's really been, it's really been key to, to give more information to our developers so that they can make better decisions before they actually finish building the code and release it for production use. Got it.

Um, you know, you know, the big, of course the big story everywhere this year is ai, LLM use Frontier models, whatever you wanna call it. Agent ai Qualys, meet some Agent AI announcements here. How's that affecting your world?

Well, in the security world, we're still developing our maturity for ai. Uh, my team has, has a couple of people who are, who are focusing on the security threats within ai. Uh, it is also part of our, obviously our strategy going forward, uh, within the company.

We are building out capabilities for agent AI within our engineering software, especially within simulations space. Um, it's been a, it's been an advanced journey and, and I'm happy that I'm not the only one who understands it now. Well, you really think everyone's getting it, or there's, there's enough people that are getting it.

I, I came up through a pure math background, so Oh, okay. So you really wrote that a while ago and now I'm seeing actual, you know, sort of regular people come out and being able to understand it too. It is.

It's gone mainstream. That's gone mainstream. Yeah.

It's gone mainstream. Um, if I had to ask you to look in your crystal ball and say, Hey, Joe, when you come to the Qualis event next year, what in effect you think this AI and agentic AI is gonna have on your day to day by next year? I think the way that Qualys is approaching AI to have multiple different agents or different personas that are operating in, in parallel, uh, having one chat bot do everything seems a little bit difficult.

Yeah. So I like the idea of having multiple agents that I can contact. Well, I think that's the way it's going.

Yeah. Right. Yeah.

The chat bot wasn't the ultimate interface. Right. It's having multiple chat bots who are having agent agent AI on the back end.

Right. You know, I don't wanna, I don't wanna talk to the same bot to make a travel reservation as I do for my security. Well, you know, I've, I've spoken to a lot of AI people about that.

What about the idea of a master agent? Mm-hmm. And all these other agents are like alter egos of it, or, or, you know, it it it's the orchestrator an or that's a good word to use for an orchestrator agent Yeah.

That, that orchestrates all these different ones. And you know, obviously you're not gonna talk to the travel agent one to do your vulnerability remediation, I would hope. Right.

But who knows? Uh, but certainly we're going to need some sort of agent management. Yeah.

The sort of concierge or Yeah. Orchestra concierge is a good word, agent concierge. But you also see, you see the big companies, Salesforce, ServiceNow, uh, Microsoft, IBM, they're all vying for who's gonna be your agent manager.

Right. You may not use my agents, but I could manage your agents. Yep.

And I, I think that'll, I, I was having that conversation with Dill Akani here from Quala, but does he think they will manage third party agents, or will third party manage Qualis agents? Or maybe both. Yeah, I would hope that it goes both ways that you can, you can have a standard approach Yeah.

And be able to use the best agent for, you know, the best agent is probably not going to be the same one that does the best job of creating a PowerPoint presentation. No, no. But I think that's why protocols and stuff like MCP servers, a to a, these kinds of things are important Right.

To, to allow that, that communication. Um, Joe, I think we, we kind of hit on what we had here for you, but what do you think about the concept of focusing on managing risk versus vulnerability, whack-a-mole, if you will? I think it's, it's really transformative.

I mean, just like the, just like the idea of, of managing risk as a factor of cybersecurity in general. Uh, taking, taking away from cybersecurity as a purely hygienic, you know, do, do you patch, do you have all of your antivirus up to date? And turning it into a real measurement against the business risk, I think has been a, a real foundational transformation for the, for the industry.

Uh, I think transforming vulnerability management in the same way makes a lot of sense. Uh, being able to take, take your vulnerabilities and, and really identify, well, what is, what is this actually putting at risk to the business? Because, you know, if, if all that's at risk is having to put out a, a press, a different press release, that may not be a big deal.

If it shuts down, if your vulnerability is one that can shut down your business for an extended period of time, that could be fatal. Good. I, I agree with you.

I, I think that's a great way of putting it. I'm gonna ask you one last question. If you could look into this camera.

Your peers, vulnerability management professionals, security professionals, you know, this is, this conference is a bit of a oddity. They don't charge right. For a ticket.

I mean, you gotta pay your f there or travel, you know, what have you. But they have training they give out for free too. Would you recommend, is this like definitely put it on your con on your, uh, list, or what do you say?

Absolutely. It's got, it's got, it's got some great technical tracks, some great business tracks, uh, that just the information you get from this conference has been, has been remarkable. Very cool.

Joe, thanks for coming here on Textron TV with us. Good luck with you at Siemens, Joe Moore. Hey, we've got, I think one more interview before we wrap up here at, at, uh, Qualys, uh, rock on this year.

Stay tuned for that. You're watching Text Drunk tv.