9 Best SBOM Tools 2027: Dependencies, Supply Chain Risk, and Detection

Since September 11, 2026, a software maker selling into the EU has 24 hours to send an early warning once it learns that a vulnerability in one of its products is being actively exploited. That deadline sits in Article 14 of the EU Cyber Resilience Act, and the clock starts before anyone has confirmed which releases carry the vulnerable library.

SBOM tools answer that first question. This guide compares nine of them on generation accuracy, format and VEX support, vulnerability correlation, and price, using each vendor’s own documentation and price list as read in October 2026. It then covers what most roundups on page one leave out, many of them written by a vendor on their own list: what happens after a component in your SBOM turns up in CISA’s Known Exploited Vulnerabilities (KEV) catalog.

That second half is where UnderDefense, the publisher of this guide, does its work. The UnderDefense Agentic AI SOC takes the alerts from your SIEM, EDR, and cloud tools and investigates each one, so when a customer or regulator asks whether a flagged component was used, your team answers with evidence. It neither generates nor stores SBOMs, so it has a separate section below and no place among the nine.

The intended reader is a CISO or VP of Security at a software or SaaS company fielding SBOM requests from customers, regulators, or both.

What SBOM Tools Do: SBOM Generation, Management, and Matching

The Cyber Resilience Act defines a software bill of materials as “a formal record containing details and supply chain relationships of components included in the software elements of a product with digital elements.” SBOM tools do three jobs with that record, and most products on this list are strongest at one of them.

SBOM generation reads manifests, lock files, build output, container images, or compiled binaries and writes the component list in SPDX or CycloneDX.

CISA calls those two “the two data formats currently widely used” in its 2026 SBOM minimum elements, published July 29, 2026 with the NSA, the FBI, and 17 international agencies. That document replaces the 2021 NTIA baseline and adds 10 elements, among them component hash, component license, SBOM tool name, and SBOM generation context (“before build,” “build,” or “after build”).

SBOM management stores every release’s SBOM, takes in the files your suppliers send, and keeps them searchable. Matching then compares each stored component against vulnerability data and re-runs the comparison whenever a new advisory lands, with VEX (Vulnerability Exploitability eXchange) statements recording which products are not affected and why.

The CRA’s own floor is modest: Annex I asks for an SBOM “in a commonly used and machine-readable format covering at the very least the top-level dependencies.” Customers and auditors usually want transitive dependencies too, which is where generation accuracy starts to separate tools.

An SBOM also differs from a scan of running infrastructure. It describes what you ship, while network and host scanners of the kind compared in Tenable alternatives for 2026 describe what is deployed and reachable. Most security teams need both views, because a component can ship in a release that no customer has installed yet.

Where UnderDefense Fits Next to an SBOM Tool

With no SBOM product of its own, UnderDefense is left out of the numbered list. Its Agentic AI SOC picks up where SBOM tools stop: once a component you ship or run appears in a new advisory, it investigates what your SIEM, EDR, identity, and cloud tools raise on the systems that carry it. Splunk, Microsoft Sentinel, Elastic, CrowdStrike, SentinelOne, and Okta are among the connections it lists, and nothing in that stack gets replaced.

An investigation pulls evidence from those tools, links it into one case, and records each step with the reasoning behind its conclusion: sources checked, evidence found, decision made. The answer you give a customer or a regulator then comes with its trail, and an analyst can audit every step later. A human, either on your team or among UnderDefense’s analysts on shift around the clock, makes the containment call.

UnderDefense’s case study of a Colorado business-licensing company with about 100 employees shows what a list of known weaknesses misses when nobody watches the systems on it. The company’s only security tool was a Nessus vulnerability scanner. Onboarding found Cobalt Strike beacons on 11 mission-critical servers, and the case study reports it took “less than 24 hours to move from detecting Cobalt Strike to removing the malware from 11 critical servers.”

On G2, UnderDefense carries a 4.9 out of 5 score from 73 reviews as of October 2026. One founder and CEO of a small IT services firm wrote that “filling out complex security questionnaires for new enterprise clients is much easier now because we have proof of 24/7 monitoring,” and added that the platform “needed a few weeks to calibrate to our specific stack.”

Its integrations page names no SBOM or SCA product, so if you pair the two, test in a pilot whether SBOM findings reach the investigation through your SIEM, your ticketing system, or a webhook.

Scanner running, nobody watching the servers? Read the 24-hour cleanup

How These 9 SBOM Tools Were Evaluated

Each of the nine was checked in October 2026 against its vendor’s own product pages, documentation, and price lists, plus a public AWS Marketplace listing where the only hosted option comes from a third party. Five questions shaped every entry:

• Where can it generate an SBOM from: source, build, container image, or binary?
• Which SPDX and CycloneDX versions does it import and export, and does it produce or consume VEX?
• Which vulnerability sources does it match against, and does it use KEV, EPSS, or reachability to rank results?
• Can it take in supplier SBOMs and keep re-checking stored ones as new CVEs appear?
• When a stored component turns vulnerable, where does the finding go next, and which ticketing, chat, or SIEM tools does the vendor name?

The fifth question carried the most weight for this guide. Every tool here can tell you that a component is affected, and the work of finding out whether it was exploited lands on whichever team receives that message. Under the CRA, that work runs on the same 24-hour clock as your incident response plan.

Ratings and review scores are left out on purpose, because most of these products are reviewed as wider application security suites and one score says little about their SBOM work. The list order follows the table, and it is not a ranking.

SBOM Tools Compared Side by Side

The table sets all nine next to each other. The “Where findings go next” column is this guide’s own summary of the integrations each vendor documents, so treat it as a starting point for your pilot.

Read the fourth column first if your security team is small. In every row the finding still lands with your people, and most products route it to a developer ticket queue first.

Customers increasingly ask for these files during procurement, and a Trust Center for security questionnaires is one place to publish them once. Cybeats builds that sharing step into the product; the others leave publishing to you.

The 9 Best SBOM Tools for 2027

Every entry uses one structure, and each verdict names the constraint a software company shipping to enterprise customers tends to hit first.

1. Anchore Enterprise: Best for Container Builds in Regulated Estates

Best for: Container-heavy builds with compliance policy

Overview: Anchore Enterprise generates SBOMs “at every commit, every build, and every deployment” across source code and containers, then scans them against vulnerability data and policy. It is built on Anchore’s open-source Syft (generation) and Grype (matching), both under the Apache-2.0 license, so you can start with the free tools and move up when you need a central store.

The enterprise layer adds SBOM import from suppliers, policy-as-code gates that block builds, and compliance packs for NIST, FedRAMP, and DISA. Its EU CRA page lists “CRA evidence of conformity with SBOM, VDR, & VEX downloads” and cites the 24-hour and 72-hour reporting windows.

Key features:

• Imports CycloneDX JSON up to 1.6 and SPDX JSON 2.2 to 2.3, so supplier files land in the same store as your own
• An Anchore Score that weighs CVSS, severity, EPSS percentile, and KEV status equally, which puts exploited CVEs near the top
• Policy gates that “automatically block builds containing critical, fixable vulnerabilities before they reach the registry”
• Signed SBOM attestations through Syft, using the in-toto specification
• An air-gapped deployment that Anchore describes as “IL4-6 Ready” for restricted environments

Fit and setup: Anchore suits a platform team shipping containers through GitHub Actions, GitLab CI, Jenkins, or Azure DevOps into ECR, ACR, GHCR, or Artifactory registries, all named on its integrations page. There is no SaaS edition: it runs as an AWS machine image or a Helm chart on Kubernetes, which you operate.

Pricing: Anchore publishes no price, only a “Request Pricing” form and a free trial. Its pricing page does publish volume caps: 500 or 3,000 SBOMs a month on the cloud-image tiers and 2,000 or 4,000 on the container-image tiers.

Pros: Free Syft and Grype as an entry point, KEV and EPSS in the default score, ready-made federal policy packs, works air-gapped

Cons: No hosted option, monthly SBOM caps on every tier, and malware and secrets scanning work on container images only.

Why it’s a good SBOM tool: It covers generation, storage, and matching in one product, and the free tools underneath let you prove the output before you buy. Exploited CVEs rank high by default.

Final verdict: Shortlist Anchore if you ship containers into regulated or US federal markets and can run your own infrastructure. A SaaS-only security team should look elsewhere.

2. OWASP Dependency-Track: Best for a Free, Self-Hosted SBOM Repository

Best for: Free portfolio-wide SBOM management

Overview: Dependency-Track is an OWASP Foundation project that does not generate SBOMs from source. It ingests them: CycloneDX files built in CI or received from suppliers arrive through the REST API, CI plugins, or the web interface, and the platform tracks every component across your whole portfolio.

Version 5.0 shipped in June 2026 and 5.1 followed on August 31, 2026. The 5.1 release accepts CycloneDX 1.7, mirrors the CISA and ENISA EU KEV catalogs “out of the box,” and names the affected subcomponent in VEX exports, which follows CISA’s guidance on where a vulnerability originates.

Key features:

• Matching against NVD, GitHub Advisories, and OSV, plus optional analyzers such as OSS Index, Snyk, and Trivy
• An internal analyzer that “matches against mirrored data with no outbound calls,” which suits restricted networks
• Policies written in Common Expression Language that can break a build on failure
• License rules that ban copyleft or allow-list SPDX expressions across every project
• Integrity checks that flag components whose published hashes diverge from the upstream registry

Fit and setup: It fits an engineering-led team that already produces CycloneDX and has someone to run Docker Compose, PostgreSQL, and the upgrade cycle. Version 5 “does not upgrade in place,” PostgreSQL high availability “remains your responsibility,” and the Jenkins, GitHub Actions, and Azure DevOps plugins are community-maintained.

Pricing: The software is free and open source. A third party, YourSky.blue, sells a hosted edition on AWS Marketplace from $250 a month for 10 users and 20 projects, or $500 a month with high availability.

Pros: No license cost, CycloneDX 1.7 support, both EU and US KEV catalogs mirrored, alert routing to Jira, Kafka, Slack, Teams, and webhooks

Cons: No SPDX upload, so supplier SPDX files need converting first, a maintenance window for the version 5 upgrade, and PostgreSQL high availability is yours to build.

Its real strength: It is the cheapest way to keep every release’s SBOM in one searchable place. When a new CVE lands, you can query the whole portfolio at once.

Final verdict: Pick Dependency-Track if you have engineers to operate it and your suppliers send CycloneDX. Budget the operating time honestly, since that is where the cost moves.

3. Snyk: Best for Teams Already on Snyk Enterprise

Best for: SBOMs inside an existing Snyk rollout

Overview: Snyk Open Source is a software composition analysis tool that developers run against their repositories and pipelines, and the SBOM features extend it. The snyk sbom command exports CycloneDX 1.4, 1.5, or 1.6 and SPDX 2.3, and snyk sbom test checks an SBOM you already hold against Snyk’s vulnerability database.

Snyk’s documentation is explicit about the plan: SBOM export “is available only to customers on Snyk Enterprise plans,” and so is SBOM testing. Container SBOM export is in Early Access, also on Enterprise.

Key features:

• SBOM export for managed projects plus unmanaged C/C++ code and JAR, WAR, and AAR files through --scan-unmanaged
• SBOM testing for CycloneDX 1.4 to 1.6 and SPDX 2.3 JSON files, including ones generated by other tools
• Reachability analysis during SBOM tests, currently in Snyk Preview through --reachability=true
• Snyk Broker, an open-source proxy that connects Snyk to on-premises GitHub Enterprise, GitLab, Bitbucket Server, Artifactory, and Jira
• License checks alongside vulnerability checks when snyk monitor runs

Fit and setup: Snyk fits a development organization that has already standardized on Snyk Enterprise for open-source scanning and wants SBOMs from the same data. It runs as SaaS in US, EU, and AU regions, and the SBOM commands need an internet connection, so it is a poor match for air-gapped builds.

Pricing: The Free plan ($0, 5 projects) and the Team plan (from $25 a month for up to 10 developers) include no SBOM features. Enterprise is quoted through sales and billed in credits at $1 each, with open-source scanning drawing 1.0 credit per active contributor per day.

Pros: SBOMs come from the scan data developers already act on, SBOM testing for third-party files, license checks in the same scan, an established Jira workflow

Cons: Every SBOM feature sits behind the Enterprise plan, components in a tested SBOM need a PackageURL (purl), SaaS-only operation rules out air-gapped pipelines.

Who should shortlist it: Teams that already pay for Snyk Enterprise get SBOM export and testing without adding a vendor. For anyone else, it is a large purchase to make for SBOMs alone.

Final verdict: Choose Snyk when the SBOM requirement arrives in a company already running it. Price it carefully if SBOMs are the main reason to buy.

4. Sonatype SBOM Manager: Best for Managing Supplier SBOMs at Scale

Best for: Third-party SBOM intake and audit trails

Overview: Sonatype SBOM Manager tracks CycloneDX and SPDX inventories for first-party and third-party software, with audits, legal reviews, and version history in one place. It “continuously monitors any new and previously ingested SBOMs for new vulnerabilities” and raises notifications when the data changes.

The packaging has changed. Sonatype’s pricing page tells new customers they “will purchase Sonatype Guide, which now includes all software compliance capabilities found in the SBOM Manager product,” so expect the product name on your quote to differ from the one on the feature page.

Key features:

• Import of CycloneDX 1.1 to 1.6 in XML and 1.4 to 1.7 in JSON, plus SPDX 2.2 and 2.3, per Sonatype’s import documentation
• Export of any scan report as a CycloneDX or SPDX SBOM in XML or JSON, with vulnerability data in CycloneDX 1.4 and later
• A VEX-based release workflow, where analysts record “analysis state, justification” for each vulnerability before the SBOM ships
• AI bills of materials, including inspection of Hugging Face models
• Sharing of SBOMs as PDFs and data files with “customers, regulators, and certification bodies”

Fit and setup: It suits a software company that receives SBOMs from many suppliers, or one that must hand audited SBOMs to customers and certification bodies. Deployment options are unusually wide: Sonatype-hosted cloud, self-hosted, or the fully disconnected Sonatype Air-Gapped Environment. Teams on Nexus Repository can add Repository Firewall to block malicious packages before download.

Pricing: Sonatype Guide lists a Free tier up to 500 credits, Pro from $1,200 a year and custom Enterprise pricing, all consumption-based. The page does not say which tier carries the compliance features, so confirm it in the quote. Firewall Pro starts at $4,800 a year.

Pros: Wide CycloneDX import range up to 1.7, a VEX release workflow, air-gapped deployment, AI model inventories

Cons: Sold inside Sonatype Guide now, one import method drops VEX annotations, and Sonatype warns that converting between SPDX and CycloneDX “may result in the loss of data.”

Why it made this list: Few tools here handle the receiving side of the SBOM exchange as thoroughly, from intake through VEX to sharing. That matters once your own customers start auditing your suppliers through you.

Final verdict: Shortlist Sonatype if supplier SBOMs and audit evidence are the bigger part of your workload. Ask for a written tier mapping before you sign.

5. Black Duck SCA: Best for Binary and Firmware SBOMs

Best for: SBOMs of code you didn’t build

Overview: Black Duck SCA, from the company formerly known as the Synopsys Software Integrity Group, has been sold by an independent Black Duck Software since October 1, 2024, when Clearlake Capital and Francisco Partners completed the acquisition. It combines “dependency, binary, and snippet analysis to build an accurate SBOM,” which covers vendor libraries and firmware that arrive without a manifest.

Black Duck imports SBOMs to map dependencies to known components and exports SPDX and CycloneDX, with templates for custom SBOM layouts. Its documentation lists data fields for SPDX 2.2, 2.3 and 3.0, and has a dedicated VEX section.

Key features:

• Binary and firmware analysis, so a compiled third-party component still gets an SBOM entry
• Snippet detection that finds partial open-source code copied into your own files
• Black Duck Security Advisories, a vulnerability database “beyond the NVD” and “human-validated” by its Cybersecurity Research Center
• A license KnowledgeBase of “more than 2,750 unique open source licenses” for attribution and legal review
• Severity, prioritization, and reachability metrics, plus malicious package detection

Fit and setup: Black Duck suits larger software and device makers with acquired code, vendor binaries, or embedded firmware in the product. It runs on-premises or hosted, “including support for air-gapped environments,” while the Polaris SaaS platform is a separate product. Its integrations page lists Jira and Slack plugins and CI support for GitHub, GitLab, Jenkins, Azure DevOps, and Bamboo.

Pricing: Black Duck publishes no price; the product page offers “Get pricing” and “Contact sales” only.

Pros: Binary, firmware, and snippet analysis in one product, a curated license database, air-gapped deployment, SPDX 3.0 support

Cons: No published price, separate SCA and Polaris products to scope, and its integrations page names no SIEM route for security operations.

Its real strength: It produces a credible SBOM for software you did not build and cannot rebuild. For device makers and companies that acquire code, that is often the hardest part.

Final verdict: Choose Black Duck when binaries and inherited code make manifest-based tools miss components. For a cloud-native SaaS codebase, a lighter tool usually covers the need.

6. FOSSA: Best for License-Led SBOM Programs

Best for: License compliance plus SBOM management

Overview: FOSSA began as an open-source license compliance tool, and its SBOM features grew out of that work. It generates SBOMs with “a complete report of all code dependencies up to unlimited depth,” exports SPDX (tag-value and JSON) and CycloneDX (JSON and XML), and produces the attribution notices that legal teams ask for at release time.

On import, it accepts CycloneDX 1.2 through 1.6 in JSON or XML and SPDX 2.2 or later in JSON. Its documentation names “US EO 14028, the EU Cyber Resilience Act (CRA), FDA premarket cybersecurity requirements for medical devices” and DORA among the mandates it maps to.

Key features:

• VEX embedded in CycloneDX exports, with not-affected states mapped from FOSSA’s own ignore reasons
• Vulnerability data from NVD and GitHub Security Advisories among 16 sources, with human review of findings
• Clear labeling of imported-SBOM matches made on CPE alone as “Unverified,” since “CPE-based matching is inherently imprecise”
• CI gates that fail a build when fossa test finds issues matching a filter
• Scheduled re-analysis by the hour, day, or week, so stored SBOMs pick up new CVEs

Fit and setup: FOSSA suits a software company whose SBOM work starts with license and attribution obligations, including medical-device and automotive suppliers, both of which have industry pages on its site. It integrates with GitHub Actions, Jenkins, GitLab CI, and CircleCI, and with Artifactory and Nexus registries. On-premises deployment on Kubernetes is reserved for Enterprise.

Pricing: A Free tier covers 5 projects, 10 contributing developers, 5 dependency levels, and 5 imported SBOMs. The Business plan shows $207 a month for 10 developers billed annually, and Enterprise is custom.

Pros: Strong license compliance and attribution, a usable free tier, clear handling of uncertain matches, published Business pricing

Cons: Paid add-ons for binary and snippet scanning, CycloneDX export from the UI only, and findings route to Jira, Slack, or the API with no SIEM connector documented.

What it is genuinely good at: It answers the legal question and the security question from one inventory. Its honesty about weak CPE matches saves analysts from chasing false links.

Final verdict: FOSSA is the natural pick when your SBOM requests come from customers’ legal and procurement teams as often as from security. Add the binary scanning module if you ship firmware.

7. Mend.io: Best for Reachability-Ranked Open-Source Risk

Best for: Prioritizing what your code actually calls

Overview: Mend.io, formerly WhiteSource, produces SBOMs as an output of Mend SCA, its software composition analysis product. Its SBOM page says Mend SCA “automatically generates accurate, comprehensive SBOMs in both SPDX and CycloneDX formats,” incorporates VEX data and takes in third-party SBOMs.

Prioritization is the reason most buyers look at it. Mend’s reachability analysis “traces the full call graph from your code through direct and transitive dependencies,” in supported environments, and its severity data combines CVSS 4.0 with EPSS exploitability scores.

Key features:

• SBOM reports in SPDX 2.2 and 2.3 and CycloneDX 1.4 to 1.6, in JSON or XML
• Import of third-party SBOMs in the same formats, provided each component carries a PackageURL
• An inventory that regenerates “as dependencies change,” so the SBOM tracks the codebase
• Container image SBOM reports alongside source-based ones
• Named integrations with Jira, ServiceNow, Microsoft Defender for Cloud, Wiz, and Backstage

Fit and setup: Mend suits an AppSec program that wants SBOMs as a by-product of SCA it already runs, with findings flowing into Jira or ServiceNow. The ServiceNow and Defender for Cloud routes put open-source findings where IT and cloud security teams already work.

Pricing: Mend publishes ceilings by developer: Mend AppSec “up to $1000 per dev/ per year,” with Mend AI and Mend Renovate Enterprise priced separately. There is no free tier or self-serve trial, only a demo request.

Pros: Reachability that cuts the list to called code, EPSS in the severity view, ServiceNow and Defender for Cloud integrations, pricing that does not limit scans or applications

Cons: VEX in CycloneDX only, “only semantic support” for CycloneDX 1.6, and the SBOM capability cannot be bought apart from the AppSec bundle.

Why buyers shortlist it: Reachability shrinks the queue at the source. Fewer findings reach a human, and the ones that do have a code path behind them.

Final verdict: Shortlist Mend if your developers already live in its SCA results and you want those results to reach ServiceNow. Small teams may find the per-developer bundle heavy for SBOM work alone.

8. JFrog Xray: Best for Teams Already on Artifactory

Best for: SBOMs where binaries are stored

Overview: JFrog Xray scans the packages, containers, and builds that pass through JFrog Artifactory, so its SBOMs describe the artifacts you actually release. It exports SPDX 2.3 (the default, as tag-value, JSON, or XLSX), SPDX 3.0, and CycloneDX in JSON or XML, and JFrog’s documentation says the CycloneDX exports “also include VEX” data.

JFrog Curation works one step earlier. It blocks risky packages “from entering the organization,” so a malicious npm or PyPI release can be stopped before a developer pulls it, using a malicious-package database JFrog puts at “over 4M OSS packages.”

Key features:

• SBOM import for CycloneDX and SPDX JSON (version 2 only), enriched with VEX and license obligations
• A vulnerability database that combines NVD, GitHub, and Linux distribution feeds with JFrog’s own security research
• Release Bundles that package an immutable, validated SBOM with each release
• Jira integration and webhooks, including a webhook when an Xray scan finishes
• Log analytics apps for Splunk, Datadog, and Elastic, which give security operations a feed to watch

Fit and setup: Xray suits an organization that already stores builds in Artifactory, cloud or self-hosted, and wants SBOMs generated where the artifacts live. The pricing table shows “SBOM Build & Exports” in Enterprise X and Enterprise+, and contextual analysis sits in a separate Advanced Security add-on.

Pricing: Cloud Enterprise X starts at $950 a month and self-hosted Enterprise X at $51,000 a year for three servers. The cheaper Pro tiers do not include SBOM export.

Pros: SBOMs of the binaries you ship, SPDX 3.0 export, Curation to block malicious packages at download, a documented Splunk route for security operations

Cons: SBOM export starts at Enterprise X, contextual analysis costs extra, and the value drops sharply without Artifactory as the central repository.

Where it beats the alternatives: Blocking a malicious package at download and sending scan data to Splunk are both documented features. Together they cover both ends of a worm like Shai-Hulud.

Final verdict: If Artifactory already holds your releases, Xray is the shortest path to SBOMs of real artifacts. Without it, the entry price buys a repository you may not want.

9. Cybeats SBOM Studio: Best for Sharing SBOMs and VEX With Customers

Best for: Publishing SBOMs to customers and regulators

Overview: Cybeats sells two products for the two sides of an SBOM exchange: SBOM Studio for the supplier who produces SBOMs and SBOM Consumer for the buyer who collects them. Studio generates CycloneDX 1.6 and 1.7 and SPDX 2.3 and 3.0.1 at commit time, and ingests older files from CycloneDX 1.2 and SPDX 2.2 upward “so older supplier files still load.”

Its homepage leads with the CRA, and the product page states that “Article 14 reporting has applied since 11 September 2026, and the SBOM obligation follows on 11 December 2027.” Raven, an add-on, confirms reachability, drafts the VEX statement, and assembles evidence for the 24-hour notice.

Key features:

• A Sharing Portal where you decide whether each customer can download the SBOM, see vulnerabilities, and download VEX, or view only, with every action logged
• VEX generated on demand and imported from suppliers, published as a separate file paired with each release SBOM
• Daily re-scoring of top vulnerabilities against CVSS, EPSS, and known-exploited signals
• Quality analysis and autocorrection for broken supplier SBOMs, plus csv2cdx for spreadsheet inventories
• A GitHub Action that uploads an SBOM, scans it, and fails the build past a threshold

Fit and setup: Cybeats suits software and device makers that must hand SBOMs and VEX to customers or regulators, including FDA and CRA obligations, and that have a product security team to run the program. It works as a hosted service, and its pages document no on-premises edition.

Pricing: Cybeats publishes no pricing; every product page leads to a demo request. Its open-source converters (csv2cdx, csv2vex) are free on GitHub.

Pros: Current formats on both sides (CycloneDX 1.7, SPDX 3.0.1), controlled customer sharing, CRA-focused triage add-on, repair of low-quality supplier files

Cons: No published price, machine-to-machine sharing through the Transparency Exchange API still “at proof-of-concept stage,” and Cybeats documents no Jira or SIEM integration for routing findings.

Why it’s a good SBOM tool: It treats the SBOM as something you hand to a customer, the form in which procurement teams ask for it. Access control and VEX pairing are built in.

Final verdict: Cybeats fits the company whose SBOM pressure comes through customer contracts and the CRA. Pair it with a generator in CI and a separate route for security alerts.

The nine entries cover three different jobs, and the gap they share is easiest to see once a real advisory arrives.

The Gap Between Generating an SBOM and Acting on It

Every tool above can tell you that a stored component matches a new CVE. None of them can tell you whether an attacker reached the system running it, because that evidence sits in endpoint, identity, and network telemetry that SBOM tools never read.

The ENISA Threat Landscape 2026, published September 22, 2026 and covering 8,257 incidents from 2025, singled out “the increase in compromises of popular libraries or npm packages, as seen with the Shai-Hulud campaign.” CISA’s Shai-Hulud alert of September 23, 2025 described a self-replicating worm that had “compromised over 500 packages” and targeted GitHub personal access tokens and cloud API keys.

CISA’s first recommendation was a dependency review, which is an SBOM query. Its next ones were to pin safe versions and “immediately rotate all developer credentials,” which is detection and response work.

How to Take a New Advisory From SBOM Match to Investigated Case

A KEV entry or a worm advisory should trigger the same short sequence, run by named owners. These steps assume your SBOMs are stored in one of the tools above.

1. Query the SBOM store by PackageURL for every product, release, and container image carrying the affected version, including transitive dependencies.
2. Record a VEX status for each product: not affected (with the justification), affected, or under investigation. Customers will ask, and the VEX file is the answer.
3. Map affected releases to where they run: Kubernetes image digests, hosts, build agents, and developer laptops that installed the package.
4. Search SIEM and EDR telemetry on those systems for the window since the release went live: unexpected child processes from the application runtime, new outbound destinations, and token or credential use from unfamiliar locations.
5. Decide with evidence. If the vulnerability is being actively exploited and sits in a product you sell into the EU, the CRA early warning is due within 24 hours of becoming aware of it, and the fuller notification within 72.

Step 4 is where the queue usually stalls, because it needs someone who knows the log sources and can write the queries quickly, the same skill set behind most threat hunting tools. Give it a named owner before the next advisory arrives.

Open-Source vs Commercial SBOM Tools: What Changes

Open-source SBOM generation tools are good enough for most source and container builds. Syft generates SBOMs “for container images, filesystems, archives” and converts between formats, Grype matches them against vulnerability data with EPSS and KEV, and GitHub exports any repository’s dependency graph as an SPDX SBOM for “anyone on GitHub,” through the web or a REST endpoint.

Dependency-Track then covers storage and matching for free. A team that pairs Syft in CI with Dependency-Track has a working pipeline without a license fee.

What changes with a commercial tool is mostly the operating load and the edge cases:

• Who runs the database, the upgrades, and high availability, and who answers when an import fails
• Binary, firmware, and snippet analysis, which Black Duck builds in and FOSSA sells as add-ons
• Curated license knowledge for attribution notices and legal review
• Supplier SBOM intake at volume, including repair of malformed files, as Cybeats offers
• Single sign-on, role-based access, and audit trails that procurement teams ask about

New inventory requests are also arriving. CISA and G7 partners published minimum elements for an SBOM for AI in May 2026, and Sonatype and Cybeats already take in AI bills of materials. Model inventories raise the same questions as your policies on protecting data in AI tools: which models your products depend on, and what data reaches them.

If your engineers can operate a free stack, start there and buy when the edge cases cost more than the license. Either way, plan who owns step 4 of the sequence above, because no license tier covers it.

What SBOM Tools Cost in 2026

Published prices for SBOM tools and other software supply chain security tools rarely share a unit, which makes a straight comparison misleading. The table lists what each vendor publishes as of October 2026, by the unit it bills on.

Per-developer pricing grows with engineering headcount and per-SBOM pricing grows with release volume, so model both against your next 12 months before comparing quotes. The cheapest line on paper is often the one that moves operating work onto your team, and the investigation in step 4 above is the largest share of it. Put a number on that staffing with a SOC cost calculator before you compare license quotes.

Test Your Shortlist on One Real Release

A two-week pilot tells you more than any table. Pick one shipping product, generate its SBOM with each shortlisted tool, and compare component counts, transitive depth, and how many matches each tool marks as uncertain.

Replay a real advisory next, such as the Shai-Hulud package list, and time how long each tool takes to name the affected releases. Finally, follow one finding to the end: who receives it, in which system, and whether that system can reach the people who search SIEM and EDR telemetry. UnderDefense’s integrations catalog is one place to check which security tools an investigation layer can query.

Your SBOM says the component ships. See if it was exploited

Frequently Asked Questions