CycloneDX: The OWASP SBOM Standard Built for Security Use Cases

What CycloneDX Covers That SPDX Does Not

CycloneDX's most distinctive feature is its native support for VEX — Vulnerability Exploitability eXchange. VEX allows software vendors to communicate to downstream consumers whether a specific CVE is actually exploitable in their product's specific configuration. A library might contain a vulnerable function that is never called in a given product's use of that library — a VEX statement communicates this, dramatically reducing the alert noise for security teams consuming the SBOM.

CycloneDX also natively supports service BOMs (SBOMs for external services and APIs your application depends on), hardware BOMs (for IoT and embedded systems), and Machine Learning BOMs (ML-BOM/AIBOM — an emerging standard for AI models and their training data). These extensions make CycloneDX the more forward-looking standard for complex system inventories.

The CycloneDX Schema

CycloneDX uses a JSON or XML schema with a clear, hierarchical structure. The top-level document contains metadata (format, version, timestamp, tools used), a components array (the inventory), and optionally a dependencies array (the dependency graph), services, vulnerabilities (VEX data), and compositions (completeness assertions). The JSON format is particularly developer-friendly and well-supported by modern tooling.

CycloneDX Ecosystem and Tooling

The CycloneDX ecosystem has grown dramatically since EO 14028. The project maintains official language-specific plugins (cyclonedx-npm, cyclonedx-maven, cyclonedx-python, cyclonedx-dotnet, cyclonedx-go) that generate high-quality SBOMs from package manager data. Major SCA platforms including Snyk, Fossity, and Mend support CycloneDX output natively. The CycloneDX CLI provides validation, merging, and format conversion utilities.

Which Standard Should You Use?

The practical answer for most organizations in 2022: generate both. All major regulators (CISA, FDA, EU CRA) accept both SPDX and CycloneDX. The overhead of generating both from a single scan is minimal with modern tools. If you must choose one: prefer SPDX if license compliance is your primary use case; prefer CycloneDX if security and vulnerability management is the priority. Many organizations use CycloneDX for internal security tooling and SPDX for external compliance reporting.