SBOM-CYCLONEDX

OWASP CycloneDX SBOM standard — ECMA TC54.

Definition

CycloneDX v1.6 (2024) covers HBOM (Hardware), AIBOM (AI-Bill of Materials), CBOM (Crypto), SaaSBOM. Formats: JSON, XML, Protobuf. OpenAPI 3.0 schemas. Compatible with Sonatype, Snyk, GitHub Dependabot. 200K+ adopters.

Origin

Launched by OWASP in 2017 ; standardised as ECMA-424 (2024).

Example in context

syft scan --output cyclonedx-json myapp:latest produces a CycloneDX JSON SBOM.

Related terms

• SBOM SPDX — alternative standard.