Trust in code and AI: EXP at the Java User Group Munich
Aamin Dev and Markus Herhoffer showed how LLM answers can be measured and how dependencies can be monitored across the entire lifecycle of an application
by Christine Muggenthaler
What is inside our software, and can we trust the answers of our AI? With these two questions, our colleagues Aamin Dev and Markus Herhoffer were guests at the Java User Group Munich on July 27, 2026.
Rage4J: measuring the quality of LLM answers
In his talk “Nichtdeterminismus deterministisch determinieren” Aamin Dev showed how Rage4J brings LLM testing with scientifically grounded quality metrics into the Java world. Instead of judging answers by spot checks, they are assessed systematically, which makes changes to models or prompts verifiable in the way development teams know it from classic tests.
CycloneDX and Dependency-Track: transparency across the lifecycle
Under the title “CVEs und Chaos in unserer Supply Chain” Markus Herhoffer explained how CycloneDX and OWASP Dependency-Track make it possible to monitor dependencies, vulnerabilities and license risks across the entire lifecycle of an application. A well-maintained software bill of materials shows what an application actually contains, not just once at release, but continuously in operation.
Two topics, one shared goal
As different as the two talks were, they pursue the same goal: more transparency, reliability and security in modern Java applications. These same principles underpin our work on the Agentic Twin platform, where AI results have to stay verifiable in order to carry industrial processes.
Many thanks to the JUGM and the Munich Java community for a great evening and for many good conversations.