SBOM — Glossary

Software Bill of Materials

A comprehensive inventory of all components, libraries, and dependencies that make up a software product, analogous to a list of ingredients on food packaging, used for vulnerability management and supply chain security.

Last updated

What Is an SBOM?

A Software Bill of Materials (SBOM) is a formal, machine-readable inventory of every component in a piece of software — every open-source library, third-party module, and their respective versions. Think of it as a nutritional label for software.

Why SBOMs Matter

The Log4Shell vulnerability (December 2021) demonstrated why SBOMs are critical: organizations scrambled for weeks to determine whether their software contained the vulnerable Log4j library. With SBOMs, that question could have been answered in seconds.

SBOMs help organizations:

  • Respond to vulnerabilities faster — Instantly identify which products are affected by a new CVE
  • Manage supply chain risk — Understand your dependency on third-party components
  • Meet regulatory requirements — US Executive Order 14028 requires SBOMs for software sold to federal agencies
  • Evaluate vendor security — Request SBOMs from software vendors as part of procurement

SBOM Formats

| Format | Maintained By | Focus | |---|---|---| | SPDX | Linux Foundation | License compliance + security | | CycloneDX | OWASP | Security and supply chain | | SWID Tags | ISO/NIST | Software identification |

SPDX and CycloneDX are the most widely adopted formats for security use cases.

SBOM Contents

A complete SBOM includes:

  • Component name and version
  • Supplier/author information
  • Dependency relationships (direct vs. transitive)
  • License information
  • Unique identifiers (CPE, PURL)
  • Hash values for verification

Generating SBOMs

SBOMs can be generated at different stages:

  • Build time: Most accurate, captures exact versions used during compilation
  • Source analysis: Parses dependency manifests (package.json, go.mod)
  • Binary analysis: Reverse-engineers components from compiled binaries

Tools like Syft, Trivy, CycloneDX CLI, and SPDX tools can generate SBOMs automatically. SCA tools like Snyk, Mend.io, and Black Duck also generate SBOMs as part of their analysis.

Related Resources

Categories

Software Composition Analysis (SCA) Tools

Compare the best SCA alternatives to Snyk in 2026. Mend.io, Black Duck, GitHub Advanced Security — SCA depth, license compliance, and pricing compared.

Open Source Application Security Tools

Compare the best open source application security alternatives to Snyk in 2026. SonarQube, Semgrep, Trivy — features, accuracy, and deployment compared.

Products

Snyk

Developer-first application security platform for finding and fixing vulnerabilities in code, dependencies, containers, and IaC

Mend.io

Open-source security and license compliance platform with comprehensive SCA and supply chain risk management

Black Duck

Enterprise SCA platform with deep open-source detection, license compliance, and code origin analysis

Trivy

Open-source vulnerability scanner for containers, file systems, IaC, and Kubernetes with zero-config setup

Sources & References

  1. NIST Cybersecurity Framework (CSF) 2.0[Government Standard]
  2. NIST Computer Security Resource Center[Government Standard]
  3. MITRE ATT&CK Framework[Industry Framework]
  4. OWASP Foundation[Industry Framework]
  5. CISA Cybersecurity Best Practices[Government Standard]
  6. SANS Institute Reading Room[Industry Research]
  7. Cloud Security Alliance (CSA)[Industry Framework]
  8. CIS Critical Security Controls[Industry Framework]
  9. Gartner Magic Quadrant for Application Security Testing 2024[Analyst Report]
  10. Forrester Wave: Static Application Security Testing, Q3 2024[Analyst Report]
  11. Forrester Wave: Software Composition Analysis, Q2 2024[Analyst Report]
  12. IDC MarketScape: Worldwide Application Security Testing 2024[Analyst Report]
  13. OWASP Top 10 Web Application Security Risks[Industry Framework]
  14. OWASP Application Security Verification Standard (ASVS)[Industry Framework]
  15. NIST Secure Software Development Framework (SSDF)[Government Standard]
  16. Gartner Peer Insights: Application Security Testing[Peer Reviews]