Full glossary
Glossary · SBOM
SBOM: the software bill of materials, explained simply
What an SBOM is, what it's for, and why the Cyber Resilience Act makes it unavoidable.
Updated · 3-minute read
In one sentence
An SBOM (Software Bill of Materials) is the machine-readable list of every component that goes into a piece of software, with their versions.
What it's for
When a vulnerability is published, an SBOM tells you in seconds whether a product ships the affected component, without digging through the code.
The formats
Two standards dominate: CycloneDX (OWASP), security-oriented, and SPDX (Linux Foundation), license-oriented. Both exist in JSON.
What the CRA says
The Cyber Resilience Act requires manufacturers to keep an SBOM in a commonly used, machine-readable format, covering at least the top-level dependencies.
And LibWatch?
LibWatch generates a CycloneDX 1.5 or SPDX 2.3 SBOM for each project, from its inventory, without adding anything to your CI.