Pavel Shukhman

🇨🇦 DevSecOps expert, building ReARM #SBOM repository at @relizaio, TEA Contributor, MCS from UIUC

[Pavel Shukhman @taleodor]

Working (never expires) join link for our community DevOps and DataOps Discord Server: https://t.co/kZVaXU0juX

[reliza.io @relizaio]

🚀 New on the ReARM blog: how we see the Agentic Development Lifecycle (ADLC) today, and how it led us to build ReARM Boards.
https://t.co/zDMHR79Elb

#AgenticAI #SoftwareDevelopment #ProductSecurity #ReARM

[Pavel Shukhman @taleodor]

Missed my live ReARM CE Demo at Black Hat USA 2026? Here is a pre-recorded version, where AI agent tried to cheat but ReARM caught it with the help of an #SBOM produced by cdxgen.

https://t.co/HcAVsr7f6j

[Pavel Shukhman @taleodor]

I believe hashes are the weakest link in 2026 CISA's Minimum Elements #SBOM requirements and here is why and what we can potentially do about it - https://t.co/a1fxNhgTDa

[Pavel Shukhman @taleodor]

I'm hosting Matt Rutkowski from IBM with his talk "Beyond the Model Card: Engineering Trust into AI Systems using AI/ML-BOM and #CycloneDX" on the next ML&AI Ottawa online meetup. September 23rd at 1pm - https://t.co/sdJGiLNapc #AIBOM #AI

[reliza.io @relizaio]

ReARM 26.08.95 makes Team a first-class entity so you can trace relationships from products and components to respective teams that own them with their own notification channels.

Full notes: https://t.co/RV7e7gnhXJ

#SBOM #SupplyChainSecurity #ProductSecurity #DevSecOps

[reliza.io @relizaio]

Who's really in the loop when a coding agent ships your code?

At the ML & AI #Ottawa #Meetup sponsored by #ReARM, Petar Djukic demonstrated the workflow he uses daily to generate production code with #AI agents.

https://t.co/X2sgplox56

[reliza.io @relizaio]

ReARM 26.07.158 is out.
🔔 A reworked notifications platform
🔍 Dependency-Track 5 support
📦 We've open-sourced our Dependency-Track 5 Helm chart
Plus: installing ReARM CE got much easier!
https://t.co/FL3F4vkD6Q
#SBOM #SupplyChainSecurity #DevSecOps #OpenSource

[reliza.io @relizaio]

ReARM is proud to sponsor the online meetup on #Agentic Feedback Loops, featuring the talk "The Human is the Loop" by Petar Djukic on August 11 at noon ET (9:00AM PT, 4:00PM GMT).

RSVP on the meetup page - https://t.co/8TVGl4h6Oq

[Pavel Shukhman @taleodor]

Followed up on my blog post from 6 years ago to include CI/CD principles for 2026 based on the state of supply chain #security: https://t.co/B3mEZBsIno

[Pavel Shukhman @taleodor]

CycloneDX just released updated AI/ML-BOM Guide with EU AI Act compliance part - https://t.co/JzlqB2xosx #AIBOM #MLBOM #CycloneDX #SBOM

[Pavel Shukhman @taleodor]

Running an AI agent 🤖 fully autonomously — and not worrying about it. I recorded a demo of how ReARM makes that possible. https://t.co/UTPthZRq52

#DevSecOps #SoftwareSupplyChain #AIagents #SBOM #SupplyChainSecurity

[reliza.io @relizaio]

🤖 AI agents are writing your code — can you tell which commits are theirs & govern what they ship?

🛡️ ReARM 26.06.5: agentic coding guardrails. Human-vs-agent commit signing + policies that block at session/PR/release.

👉 https://t.co/s9IGujyk87

#AIAgents #DevSecOps #DevOps

[reliza.io @relizaio]

🚀 ReARM 26.05.108 is out! A focused follow-up to last week's major 26.05.90 release.
What's in it:
🔹 Programmatic VEX import
🔹 Memory optimizations
🔹 ReARM CE docker-compose fixes

https://t.co/bBOpQbb7uT
#SupplyChainSecurity #VEX #SBOM #DevSecOps #ReARM

[reliza.io @relizaio]

🚀 ReARM 26.05.90 is out. One of our biggest releases yet!

🔀 Pull Requests as a first-class entity
🔁 VEX export & import

👉 Release news: https://t.co/MHATjkoyo7

#ReARM #SBOM #VEX #SupplyChainSecurity #DevSecOps #ReleaseGovernance

[reliza.io @relizaio]

The #Agentic Era is here! 🤖 🤖 🤖
Pavel Shukhman pitching ReARM at #Cybersecurity & Identity Summit Ottawa 2026 https://t.co/4lyHmWp63E

[reliza.io @relizaio]

New ReARM release: 26.04.90 🎉

Visual CEL policy builder · TEA 0.4.0 with per-release CLE · Download Audit Logs · Branch Suffix Mode · Reverse Feature Set Lookup · Most Recent Releases widget.

Read news release 👇

https://t.co/TJqpJ6CG5J

[Pavel Shukhman @taleodor]

Shared my thoughts on #QA and #CyberSecurity in the #AI era at OnPod podcast https://t.co/ti2Au7l3lo

[CycloneDX SBOM Spec (OWASP) @CycloneDX_Spec]

Today, we're launching CycloneDX Assessors Studio (alpha). Built for maturity tracking, compliance audits, and supply chain vendor trust. Turn compliance checklists into verifiable attestations.

#CycloneDX #OWASP #Compliance #GRC #OpenSource

https://t.co/Xhdc0K17Z1

[Pavel Shukhman @taleodor]

It is no longer possible to apply a human-scale control model to an agent-scale development world. I put together my thoughts on the principles of release management in the #agentic era - https://t.co/AkqvNTeIq9

[Pavel Shukhman @taleodor]

Time to Start Treating Dev Machines as Untrusted #CyberSecurity #SupplyChainSecurity #YubiKey

https://t.co/pU82C3Gobu