OWASP CycloneDX SBOM/xBOM Standard

What OWASP CycloneDX SBOM/xBOM Standard does

OWASP CycloneDX is a full-stack, open-source Bill of Materials (BOM) standard operated as a Flagship Project under the OWASP Foundation nonprofit umbrella and stewarded by a volunteer Core Working Group led by Steve Springett. Created in 2017 and merged into OWASP in June 2021, CycloneDX provides seven distinct BOM types — SBOM, SaaSBOM, CBOM, VEX, HBOM, AI/ML-BOM, and the Attestations (CDXA) / Formulation (MBOM) extensions — serialized in XML, JSON, and Protocol Buffers, with additional capabilities including the BOM Exchange API and a reference BOM Repository Server.

The specification is ratified as Ecma International Standard ECMA-424 (1st Edition, June 2024), the only SBOM/xBOM format with formal international standardization status, and is supported by 296 tools across 20+ programming languages in the public Tool Center. Notable contributions include IBM's donation of the SBOM Utility and License Scanner projects (March 2023), Lockheed Martin's contribution to commercial-license tracking in v1.5, and ServiceNow's input on AI transparency requirements; an invite-only Industry Working Group (NowSecure, Bloomberg, Velentium, Ion Channel, Contrast Security, nexB, Snyk, Edvina AB, Lockheed Martin) shapes real-world feature direction.

CycloneDX does not generate direct revenue — the specification is freely available and distributed via cyclonedx.org, GitHub, OWASP and Ecma channels, and a 30+ episode YouTube learning series — and adoption is anchored in users rather than paying customers. Named adopters include multiple world governments, the defense industrial base (satellite systems, missile guidance, algorithmic warfare), medical device manufacturers (authorized for FDA-relevant supply-chain use), and leading CMDB vendors; the open community spans 2,000+ Slack members across 40+ channels.

Name

OWASP CycloneDX SBOM/xBOM Standard

Legal name

The CycloneDX logo is copyright of the OWASP Foundation

Website

https://cyclonedx.org

Company type

Private

Founded year

2017

Operating status

Operating

Headcount range

1–10 employees

Short description

OWASP CycloneDX is an open-source, ECMA-424-ratified Bill of Materials (BOM) standard under OWASP Foundation that documents software, hardware, SaaS, cryptographic, AI/ML, and vulnerability components for supply-chain risk reduction across governments, defense, medical device, and enterprise adopters.

Ownership category

akta.pro rank

Headquarters

HQ city

Bel Air

HQ country

United States

HQ region

North America

Offices1 record

Markets served

GTM type

B2B

Offering type

Software

Cost components

Personnel, Technology or R&D, Operations, Marketing or Sales, Others

Revenue model

1. Open Standard Distribution: CycloneDX is freely available as an open standard. The project does not generate direct revenue from licensing the specification. The project operates under OWASP Foundation as a non-profit initiative supported by volunteer contributors and organizational sponsors.

Go-to-market motion1 record

Distribution channels5 records

Marketing channels10 records

Core offering

OWASP CycloneDX is a full-stack, open Bill of Materials (BOM) standard providing advanced supply chain capabilities for cyber risk reduction. It supports multiple BOM types — SBOM, SaaSBOM, CBOM, VEX, HBOM, and AI/ML-BOM — serialized in XML, JSON, and Protocol Buffers, and is complemented by reference implementations including the BOM Exchange API, BOM Repository Server, SBOM Utility, and License Scanner.

Product overview

OWASP CycloneDX is a full-stack Bill of Materials (BOM) standard providing advanced supply chain capabilities for cyber risk reduction. The core CycloneDX Specification supports multiple BOM types (SBOM, SaaSBOM, CBOM, VEX, HBOM, AI/ML-BOM) with serialization in XML, JSON, and Protocol Buffers. The BOM Exchange API standardizes BOM distribution for interoperability across systems, with the BOM Repository Server serving as its reference implementation. IBM contributed SBOM Utility for BOM validation and License Scanner for license identification. The Tool Center provides access to an ecosystem of 296 tools supporting various CycloneDX capabilities across 20+ programming languages.

Differentiator

Problem solved

Functional benefit

Brands

• CycloneDX Attestations (CDXA): First general-purpose attestation specification to digitally transform audit and attestation workflows, introduced in v1.6.
• CycloneDX BOM Repository Server

Products and services

• CycloneDX Specification A modern, full-stack Bill of Materials (BOM) standard providing advanced supply chain capabilities for cyber risk reduction. Supports multiple BOM types including SBOM, SaaSBOM, CBOM, VEX, HBOM, AI/ML-BOM, MBOM, OBOM, and CDXA, with serialization formats in XML, JSON, and Protocol Buffers.
• BOM Exchange API API specification that standardizes how Bill of Materials are published and retrieved independent of software ecosystem, enabling interoperability between different SBOM systems and greater out-of-the-box integration across the SBOM product and tool ecosystem.
• BOM Repository Server Reference implementation of the BOM Exchange API, specifically designed to archive and distribute bill of materials. Helps organizations meet OpenChain requirements for distribution and archival of BOMs and compliance artifacts.
• SBOM Utility API platform designed to validate CycloneDX or SPDX format BOMs against their published schemas. Can validate derivative custom schemas, perform queries against BOM contents with regex, and generate custom reports in JSON, Text, CSV, or Markdown formats.
• License Scanner Tool designed to scan files for licenses and legal terms, matching against the complete SPDX License List. Returns CycloneDX LicenseChoice data with SPDX License ID, SPDX License Expression, or License name.
• CycloneDX Tool Center The largest marketplace of tools and solutions designed to optimize and secure the software supply chain, featuring 296 tools supporting CycloneDX across software (SBOM), SaaS (SaaSBOM), Cryptography (CBOM), AI/ML (AI/ML-BOM), Hardware (HBOM), Formulation (MBOM), Operations (OBOM), Attestations (CDXA), and Vulnerabilities (VDR/VEX) capabilities.

Quantifiable outcome

• Over 260 tools support CycloneDX across 20+ programming languages
• +4 more outcomes

Named customers4 records

Segments5 records

Ideal customer profiles5 records

Technology focussed Yes

API detail

Has API

Yes

API docs

API detail

Core technology

AI maturity

App detail

Integration2 records

AI capability2 records

Feature10 records

Partnerships

Ten partnerships are on record, tiered core, major and strategic.

• Ecma International (TC54)coreStrategic or Co-development Partner · 1 December 2023Ecma TC54 (Technical Committee 54) is the technical committee responsible for final technical reviews of CycloneDX features and specification versions. The collaboration standardizes CycloneDX as an international standard (ECMA-424). Ecma members participate in OWASP work and vice versa.
• IBMcoreStrategic or Co-development Partner · 1 March 2023IBM contributed two open source projects to CycloneDX: SBOM Utility (for validating CycloneDX or SPDX format BOMs) and License Scanner (for scanning files for licenses and legal terms). IBM maintains active leadership in CycloneDX through Matt Rutkowski in Core Working Group and Mark Sturdevant as Maintainer. IBM's contribution strengthens front-end quality data and back-end SBOM validation.
• OWASP FoundationcoreStrategic or Co-development PartnerCycloneDX operates as an OWASP Foundation Flagship Project. The OWASP Foundation provides organizational resources, infrastructure, community support, and governance framework for the CycloneDX specification and ecosystem. CycloneDX joined OWASP in June 2021 after operating as an independent community project.
• Lockheed MartinmajorStrategic or Co-development PartnerLockheed Martin is an active participant in the CycloneDX Industry Working Group (IWG) and contributed to the CycloneDX 1.5 schema to strengthen tracking of commercial license information. Jerod Heck serves as Software Factory Deputy Chief Architect at Lockheed Martin and is part of the IWG.
• ServiceNowmajorStrategic or Co-development PartnerServiceNow contributed to CycloneDX v1.5 development, with Christian Hudon (Senior Applied Research Scientist) providing input on AI transparency and ML-BOM requirements for AI software deployments.
• Contrast SecuritymajorStrategic or Co-development PartnerContrast Security co-founder Jeff Williams contributed to CycloneDX v1.5 development, providing insights on SBOM quality indicators, evidence capture, and vulnerability disclosure capabilities.
• SonatypecoreTechnology or IntegrationSonatype provides significant contributor support to CycloneDX. Jeffry Hesse serves as Core Working Group member, and Amy Keibler and Hervé Boutemy serve as Maintainers. Sonatype contributes tools, libraries, and development resources to the ecosystem.
• Industry Working Group (IWG) MembersmajorStrategic or Co-development PartnerInvite-only working group of vendors including: NowSecure, Bloomberg, Velentium, Ion Channel, Contrast Security, nexB, Snyk, Edvina AB, and others. IWG provides real-world usage insights, challenges, and opportunities to shape specification development.
• OpenChain ProjectstrategicStrategic or Co-development PartnerCycloneDX fully supports OpenChain requirements for open source license compliance. The BOM Repository Server helps organizations meet OpenChain requirements for distribution and archival of bill of materials and compliance artifacts.
• 260+ Tool Vendors EcosystemcoreTechnology or IntegrationOver 260 tools across 20+ programming languages support CycloneDX, including products from Anchore, Aqua Security, Checkmarx, GitHub, GitLab, Google, JFrog, Snyk, Synopsys, and many others. This ecosystem provides SBOM generation, analysis, vulnerability scanning, and compliance tools.

Scale indicators5 records

Recent moves9 records

Expansion highlights5 records

Direct peers

• Sonatype: Provider of Nexus Repository, Nexus Lifecycle, and SBOM-centric supply chain tooling. Sonatype maintainers are core contributors to CycloneDX, and its products generate/consume CycloneDX SBOMs, placing it in the same BOM-driven supply chain security category.
• Anchore: SBOM generation, container security, and software supply chain compliance platform. Anchore is both a heavy CycloneDX consumer and a featured tool in the CycloneDX Tool Center, making it a directly comparable product/ecosystem peer.
• Chainguard: Supply chain security vendor focused on hardened container images and SBOMs. Chainguard is featured in the CycloneDX Tool Center and competes for the same software supply chain security buyer.
• SLSA (Supply-chain Levels for Software Artifacts): A supply chain security framework/specification (OpenSSF) covering build integrity, provenance, and attestation. SLSA complements CycloneDX (attestations via CDXA) and is a directly comparable standards/framework peer in the same ecosystem.
• SPDX (Linux Foundation): The principal competing SBOM/data exchange standard, backed by the Linux Foundation. SPDX and CycloneDX are the two dominant SBOM formats in regulatory and enterprise adoption, making SPDX the most directly comparable peer.
• in-toto: A supply chain attestation framework that records how software artifacts are produced. in-toto is closely comparable to CycloneDX's CDXA attestation capabilities, addressing the same supply chain integrity and auditability use cases.
• FOSSA: License compliance and SBOM management platform supporting CycloneDX. FOSSA competes for the same enterprise software composition analysis (SCA) and SBOM generation buyer.
• Snyk: Developer security platform covering SCA, SBOM, and supply chain risk. Snyk is listed as a CycloneDX Tool Center vendor and addresses the same enterprise buyer for SBOM-driven vulnerability management.

Broad incumbents

• OpenChain Project: International standard for open source license compliance with which CycloneDX explicitly integrates via OpenChain conformance. OpenChain is broader in scope (license compliance processes) but is a directly adjacent standards peer.

Emerging players

• Sigstore: Linux Foundation project for signing, verifying, and provenance for software artifacts. Sigstore overlaps with CycloneDX CDXA attestations and is a comparably scoped emerging supply chain integrity peer.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat6 records

Key risks6 records

Key highlights7 records

Customer concentration

• GitHubgithub.com/CycloneDX
• YouTubeyoutube.com/channel/UCcUKDc0izYoyQKdzAsraoUQ
• LinkedInlinkedin.com/company/owasp-cyclonedx

Compliance2 records

Revenue estimate

Valuation estimate

Number of profiles

Profiles17 records

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about OWASP CycloneDX SBOM/xBOM Standard