Free tools Windows power users keep installed
One-click scans. No signup required.
To create an SBOM, define the software release it describes, generate a machine-readable inventory from the appropriate source or artifact, review its component identities and dependency relationships, validate it, and keep it with that release. Use the inventory to find potentially affected components when new vulnerability or licensing information appears—but verify applicability separately. An SBOM is structured supply-chain data, not a security certificate or proof that a vulnerability is exploitable.
What an SBOM tells you
The National Telecommunications and Information Administration (NTIA) defines a software bill of materials as “a formal record containing the details and supply chain relationships of various components used in building software.” Its 2021 report, The Minimum Elements For a Software Bill of Materials (SBOM), identifies seven minimum data fields:
As an Amazon Associate I earn from qualifying purchases.
- Supplier
- Component name
- Component version
- Other unique identifiers
- Dependency relationship
- Author of the SBOM data
- Timestamp
These fields make an SBOM more useful than a flat list of package names: they help identify which components are present, who supplied them, and how they relate to the larger product. An SBOM can support software inventory, vulnerability management, and license management. It does not, by itself, establish that a product is secure or that a listed component is vulnerable in a particular deployment.
How do I create an SBOM?
Use this workflow for an application, package, container image, firmware, or assembled product. Keep the SBOM associated with the exact release or artifact it describes; regenerate it when the dependency set or build contents change. NTIA’s process guidance discusses scope, known unknowns, generation practices, frequency, distribution, and access control. The release-linking steps below are practical implementation guidance based on those considerations.
#1 Best Overall
- Set the scope. Name the product and release, and decide whether the inventory should describe source files, build output, or the post-build artifact that will be delivered or deployed. Record when in the lifecycle it was generated. Note components or areas that could not be observed, rather than implying the inventory is complete.
- Choose a format your recipient can use. Check the recipient’s requirements and confirm that your existing build or security tools can generate and consume the requested format. SPDX and CycloneDX are both recognized SBOM formats. The SPDX overview describes SPDX 3.0 as an open, extensible standard for communicating BOM data across software and other domains. The CycloneDX specification overview lists version 1.7, released on 2025-10-21 and published on 2025-12-10, with JSON, XML, and Protocol Buffers support. Versions can change, so check the current specification and recipient requirements when selecting one.
- Generate from the right input. Use a compatible generator on the project files, build output, or deployable image according to the inventory’s purpose. A scan of project files and a scan of a packaged image may capture different views of the software. Syft is one example of a CLI tool and library that generates SBOMs from container images and filesystems; its repository description establishes that capability, not an independent evaluation or endorsement.
- Review component identities and relationships. Check names, versions, suppliers, identifiers, and dependency links. Make absent, uncertain, or unobserved data explicit where the format and workflow allow it. Confirm that the SBOM author and timestamp are recorded.
- Validate and distribute. Parse or validate the file with a tool compatible with the selected format, then confirm that the intended consumer can ingest it. Retain it alongside the matching release artifacts or deliver it through the agreed supplier channel. Apply appropriate access controls; the distribution method depends on your organization and recipient.
- Keep release history. Preserve versioned SBOMs so you can compare the component set across releases. Regenerate when a release or its contents change; use component and version matches to identify items that need vulnerability or license triage.
CISA’s SBOM Resources Library provides official implementation resources for producers and consumers, including material on SBOM types and generation workflows.
Which SBOM format should I use?
Start with what the recipient accepts and what your tools can reliably generate and ingest. NTIA’s 2021 report names SPDX and CycloneDX among formats used to generate and consume SBOMs, alongside SWID tags. SPDX and CycloneDX both support structured component and relationship data, but their models and ecosystems differ. Neither is a universal winner.
| Format | What the cited material establishes | How to choose |
|---|---|---|
| SPDX | The SPDX Project’s overview describes SPDX 3.0 as an open, extensible standard for communicating BOM data across software and other domains, including AI, datasets, and build information. | Consider it when recipients or tools require SPDX, or when the broader model fits the data you need to exchange. |
| CycloneDX | The specification overview lists version 1.7, released 2025-10-21 and published 2025-12-10. It supports JSON, XML, and Protocol Buffers and models components, services, direct and transitive dependencies, and vulnerability- and VEX-related data. | Consider it when recipients or tools require CycloneDX, or when its dependency and vulnerability-related data model fits the exchange. |
| SWID tags | NTIA’s 2021 report names SWID tags among the formats used to generate and consume SBOMs; the cited material does not state a version or serialization here. | Use them when the recipient’s process or tooling calls for SWID tags. |
Before committing to a format, check recipient acceptance, generator and scanner interoperability, required metadata, and whether you need a software-only inventory or a broader BOM model. Specification features do not guarantee that every downstream tool supports every field.
How do I track software dependencies between releases?
Treat each SBOM as a release-specific snapshot, not a timeless description of a product. Store it with a clear release or artifact identifier and retain earlier snapshots. When a component is added, removed, upgraded, or otherwise changes in the build, generate and validate an SBOM for the changed release. Comparing snapshots can help show what changed and focus review on affected components.
When new vulnerability or licensing information arrives, match it against the component names, versions, and identifiers in the relevant SBOM. A match is a lead for investigation, not a final risk decision. Verify that the component is actually present in the deployed artifact and evaluate its configuration, exposure, reachability, and the vulnerability’s applicability before deciding on remediation.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How do I find out whether a vulnerability affects my software?
- Identify the release in use. Select the SBOM for the exact version or artifact under investigation, rather than a newer or older release.
- Match the component carefully. Compare the vulnerability information with component name, version, supplier, and unique identifiers. Similar names alone may not establish that two records describe the same component.
- Confirm presence and context. Check whether the component is in the deployed artifact and how it is configured and used. The SBOM may not describe deployment conditions or all runtime behavior.
- Assess applicability and response. Consult current vulnerability information and determine whether the affected code is reachable or otherwise relevant in your context. Decide on mitigation or remediation using that additional evidence.
CycloneDX can represent known vulnerabilities and exploitability-related information, but those capabilities do not make a bare component inventory conclusive. An SBOM match alone does not prove exploitability or establish that a vulnerability affects a deployed system.
Quick Recap
Best Value
Rank #4
What an SBOM cannot tell you by itself
- It is not a complete security assessment. NTIA says an SBOM will not solve all software security problems. It is an input to security and license workflows, not a guarantee of safety.
- Its coverage depends on scope and observability. A generator can only report what it can identify from the chosen input. Source, build, and post-build inventories may differ, and unknown or missing components should not be silently presented as known.
- It does not prove exploitability. A listed component and a vulnerability match do not, without further evidence, show that vulnerable code is reachable or exploitable in the deployed context.
- SaaS makes customer-side inventories harder. Providers control much of the deployed stack and its update cycle. NTIA’s 2021 report describes SaaS as an area with challenges and less mature cross-organization standardization, so customers may need to request release-specific information from providers.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
