What is SBOM?
SBOM stands for Software Bill of Materials.
An SBOM, or Software Bill of Materials, is a formal, machine-readable inventory of the components and dependencies that make up a piece of software, including their versions and the relationships between them.
In depth
Understanding SBOM
Modern software is assembled far more than it is written. When a vulnerability is disclosed in a widely used library, the question every organisation faces within hours is whether they shipped it — and without an inventory, answering that means auditing build systems under time pressure.
Two formats dominate. CycloneDX comes from OWASP and is oriented toward security use. SPDX comes from the Linux Foundation and originated in licence compliance. Both are machine-readable, and most tooling reads either.
An SBOM answers what is in the software, not whether any of it is exploitable in your build. That second question is what VEX exists for, which is why the two are usually produced together.
In RedStrike
How RedStrike handles SBOM
RedStrike generates SBOMs in both CycloneDX and SPDX and correlates them with scan findings, so the component inventory and the vulnerability list are one artefact rather than two that disagree. OpenVEX documents are produced alongside them to record which disclosed vulnerabilities actually apply to a given build.
FAQ
Frequently asked questions
Common questions about SBOM.
CycloneDX or SPDX — which should I produce?
Produce whichever your customers and regulators ask for, and prefer having both if you can. CycloneDX is more common in security workflows and SPDX in licence compliance, but the two overlap heavily and most consuming tools accept either.
Does the EU Cyber Resilience Act require an SBOM?
The CRA's Annex I requirements around vulnerability handling for products with digital elements include identifying and documenting components, which in practice means maintaining a software bill of materials. The precise obligation depends on your product's classification, and this is not legal advice.
How often should an SBOM be regenerated?
Per build. An SBOM describes one artefact, so a bill of materials from three releases ago describes software your customers are no longer running — which is the situation an SBOM was meant to prevent.
See SBOM in practice
Run continuous, verified security testing across your applications, APIs, and cloud accounts.