Security scanning

What is SBOM generation?

Producing a machine-readable inventory of everything in a build, usually in CycloneDX or SPDX format.

By Cláudia FernandesUpdated 2026-10-02

A Software Bill of Materials lists every component and version in a piece of software so that, when the next widely-exploited dependency vulnerability lands, an organization can answer 'are we affected' in minutes rather than weeks.

SBOMs have moved from good practice to procurement requirement in regulated sectors and government supply chains, and vendors that generate them sometimes charge for it as an add-on or a higher tier. An SBOM is only as useful as the process around it: one generated for a procurement form and never refreshed will not answer 'are we affected' on the day it matters.

What to look for

Which formats are supported, since CycloneDX and SPDX are the two that matter
Whether SBOMs can be generated per build and stored historically
Signing and attestation support, if you need supply-chain provenance
Whether an existing SBOM can be imported and scanned

Best 11 SBOM generation tools

Every tool in the directory whose documentation covers this, 10 fully and 1 partially. Full support is shown first. Shown in a random order that changes on every visit, so no tool gets an advantage from its position.

Support is not the same as parity, since some implementations are narrower in scope, gated to a higher plan tier, or maintained only for existing customers. The note under each tool is what its own documentation describes.

Code Security Platform

Exports full SBOM (CycloneDX, SPDX, CSV) from Licenses & SBOM report

Code Security Platform

CycloneDX (v1.3–v1.7 depending on surface) and SPDX v2.3, XML or JSON; can also scan an existing SBOM.

Code Quality Platform

SBOM exports available as a compliance feature; Business plan only.

PR Review Tool

Software Bill of Materials generation and analysis

PR Review Tool

Generates SBOM as a dedicated scan type; requires Security trial or paid add-on.

Code Security Platform

corgea deps sbom produces a CycloneDX SBOM

Code Security Platform

GitHub Advanced Security

SPDX-compatible SBOM export from the dependency graph via UI or REST API; linkable to artifact attestations

Code Security Platform

Per-repository CycloneDX 1.4, 1.5, 1.6, 1.7 SBOMs in JSON and XML via UI or API.

Code Quality Platform

SBOM export in standard formats is part of the separately subscribed SCA product.

Code Security Platform

REST API and 'veracode sbom' CLI output CycloneDX 1.6, SPDX 2.3, Syft JSON; unbuilt Gradle limited

Code Security Platform

Org-wide BOM view exportable to CSV and AI-BOM generation; CLI `snyk sbom test` consumes SBOMs.

SAST Taint Analysis (Data-Flow)Secrets Detection Secrets Validation SCA Reachability Analysis

FAQ

What is SBOM generation?

Producing a machine-readable inventory of everything in a build, usually in CycloneDX or SPDX format.

How many tools in the directory offer SBOM generation?

11 of the 20 tools in this directory offer SBOM generation, 10 fully and 1 partially:

Aikido Checkmarx One Codacy CodeAnt AI CodeRabbit Corgea GitHub Advanced Security Semgrep Snyk SonarQube Veracode

Support is not the same as parity, since some implementations are narrower in scope, gated to a higher plan tier, or maintained only for existing customers. The note under each tool is what its own documentation describes.

What should you check when comparing tools with SBOM generation?

Four things:

Which formats are supported, since CycloneDX and SPDX are the two that matter
Whether SBOMs can be generated per build and stored historically
Signing and attestation support, if you need supply-chain provenance
Whether an existing SBOM can be imported and scanned