Home / Knowledge hub / CycloneDX
Knowledge hub
CycloneDX
A standard format for writing an SBOM so tools can exchange it.
What it means
CycloneDX is a standard format for describing what is inside a piece of software. It began in the OWASP community and is designed for security uses. A CycloneDX file lists components, their versions and how they depend on each other.
It can be written in JSON or XML, so tools can create and read it without a person in the middle. Beyond a plain list of components, the format can also carry vulnerability and VEX information and describe services.
Why it matters
An SBOM is only useful if the people who receive it can read it. A shared format means your build tool can produce it once, and your customers' scanners, registries and risk tools can all consume it.
Choosing a recognised format also answers a common question in buyer reviews. When a customer sends an SBOM requirement, naming CycloneDX or SPDX settles what you will send.
How it shows up
Most build ecosystems have a plugin that generates a CycloneDX file during the build. You attach it to the release, and may store it beside the artifact. Tools such as dependency scanners can import it to check components against known flaws.
Mistakes repeat. The SBOM is generated from source manifests but misses what ends up in the container image. It is made once and never refreshed. Or it is produced and nobody uses it. Generate it at build time from the real output, and keep it with VEX statements.
Questions people ask
CycloneDX, answered
What is the difference between CycloneDX and SPDX?
Both are SBOM formats. CycloneDX grew from security needs, while SPDX grew from licence compliance and is an ISO standard. Many tools support both.
Is CycloneDX only for SBOMs?
Mostly, but it can also describe services, vulnerabilities and VEX statements.
Which formats does it use?
JSON and XML are the main ones.
Do we need to pick one format?
Pick the one your customers ask for. Converters exist, though some detail can be lost, so test the output.
Who maintains it?
The CycloneDX project, which has roots in OWASP. Details are on cyclonedx.org.
Sources
Where this comes from
Related
Terms that sit next to this one
SBOM
A list of every component your application includes, with versions.
SPDX
A standard format for listing software components and their licences.
VEX
A statement that says whether a known flaw in a component can actually affect your product.
SBOM requirement
A customer or regulator asking you to supply an SBOM with your software.
Software composition analysis
Inventorying your open-source parts and flagging the ones with known flaws.
Can your customers read your SBOM?
An SBOM lists parts. We test whether your running application can be broken, and report only what we exploited. Ask us to run it on one of your applications.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.