An SBOM workflow is not completed by a single tool. The three capabilities of generation, vulnerability matching, and lifecycle management are split across different tools, and the common conclusion of recent tool comparison analyses is that no single tool covers all three areas completely. It is more accurate to think of it as assembling a pipeline from a combination of tools.
The Division of Labor Among Generation, Management, and Scanning
Figure 1. The three roles of SBOM tools (source: compiled from tool comparison analyses, 2026-01. Retrieved 2026-06-14)
In the generation space, Anchore’s Syft is regarded as “the dedicated tool that does SBOM generation, and only that, best.” Its attestation workflow, combined with the signing tool cosign, is mature. OWASP CycloneDX’s cdxgen is distinguished by broad support for multiple languages and container images, and by a dedicated AI BOM mode.
In the management space, OWASP Dependency-Track has established itself as a platform for monitoring component usage and security/license compliance across an organization’s entire application portfolio. Eclipse SW360 is another option centered on license compliance.
In the scanning space, Grype takes an SBOM as input and matches it against vulnerabilities, while Aqua Security’s Trivy is both a scanner and an SBOM generator.
| Role | Representative open source tools | Characteristics |
|---|---|---|
| Generation | Syft, cdxgen | Syft is generation-only with mature attestation; cdxgen offers multi-language support and an AI BOM mode |
| Management | Dependency-Track, SW360 | Portfolio monitoring, license and vulnerability tracking |
| Matching/Scanning | Grype, Trivy | Matches an SBOM against a vulnerability database |
Table 1. Classification of SBOM tools by role (source: compiled from tool comparison analyses, 2026-01. Retrieved 2026-06-14)
How Far Does Automation Go
It is important to honestly distinguish between areas where automation works well and areas that people must fill in.
| Task | Automation maturity |
|---|---|
| Code/dependency SBOM generation | Mature |
| Container image component identification | Mature |
| SBOM storage and vulnerability monitoring | Mature |
| Automated license identifier extraction | Partial (requires review) |
| Interpreting non-standard licenses and tracking compliance | Immature (people/policy) |
Table 2. Automation maturity of SBOM tasks (source: compiled from tool comparison analyses. Retrieved 2026-06-14)
Tools do generation well. Put Syft or cdxgen into the build pipeline, and the component list fills in automatically. But whether the license field of a generated SBOM is accurate, whether the obligations of a non-standard license are met, and whether obligations propagate downstream without omission are things no tool guarantees automatically. This area is filled by policy and human review.
The Tool Itself Is an Attack Surface
Before trusting an automation tool, its own integrity must be verified. In January 2026, a case was reported in which an SBOM tool was implicated in two supply chain attacks within a short period, with the damage spreading to downstream projects. On this basis, some pipeline operators removed the tool in question.
The fact that an SBOM generation tool can itself become a target of supply chain risk requires combining hashes, signatures, and attestations at the generation and verification stages. This same concern lies behind CISA’s 2025 minimum elements draft adding Tool Name, Generation Context, and Component Hash as new fields. Avoiding the paradox that “an SBOM made by an untrustworthy tool cannot be trusted” requires pinning tool versions, verifying provenance, and signing the output.
Sources
Anchore. Syft https://github.com/anchore/syft, Grype https://github.com/anchore/grype. OWASP. cdxgen https://github.com/CycloneDX/cdxgen, Dependency-Track https://dependencytrack.org/. Aqua Security. Trivy https://github.com/aquasecurity/trivy. Eclipse SW360 https://www.eclipse.org/sw360/. (All retrieved: 2026-06-14)