# CycloneDX: the security-oriented SBOM format

Source: https://libwatch.com/en/glossary/cyclonedx

Glossary · CycloneDX

OWASP's standard for describing the components of a piece of software.

Updated October 22, 2026 · 3-minute read

In one sentence

CycloneDX is an SBOM format published by OWASP, designed first and foremost for security and vulnerability management.

## What it contains

Every component with its name, its version and its purl identifier, plus license and dependency information.

## Where it's used

It can be imported into vulnerability management tools such as [OWASP Dependency-Track](/en/compare/dependency-track).

## And LibWatch?

LibWatch [exports your projects to CycloneDX 1.5](/en/features/sbom-export), in JSON, validated against the official schema. It isn't the latest version of the standard, but common tools read it.

## See also

- Glossary
### [SPDX](/en/glossary/spdx)

The other major format.

- Glossary
### [SBOM](/en/glossary/sbom)

The software bill of materials.

- Glossary
### [SCA](/en/glossary/sca)

Composition analysis.

## Export a project to CycloneDX.

[Try it for 14 days](https://app.libwatch.com/users/sign_up?source=glossary_cyclonedx)