An SBOM workflow is not completed by a single tool. The three capabilities of generation, vulnerability matching, and lifecycle management are split across different tools, and the common conclusion of recent tool comparison analyses is that no single tool covers all three areas completely. It is more accurate to think of it as assembling a pipeline from a combination of tools.

The Division of Labor Among Generation, Management, and Scanning

Figure 1. The three roles of SBOM tools(source: compiled from tool comparison analyses, 2026-01. Retrieved 2026-06-14)

In the generation space, Anchore’s Syft is regarded as “the dedicated tool that does SBOM generation, and only that, best.” Its attestation workflow, combined with the signing tool cosign, is mature. OWASP CycloneDX’s cdxgen is distinguished by broad support for multiple languages and container images, and by a dedicated AI BOM mode.

In the management space, OWASP Dependency-Track has established itself as a platform for monitoring component usage and security/license compliance across an organization’s entire application portfolio. Eclipse SW360 is another option centered on license compliance.

In the scanning space, Grype takes an SBOM as input and matches it against vulnerabilities, while Aqua Security’s Trivy is both a scanner and an SBOM generator.

Table 1. Classification of SBOM tools by role(source: compiled from tool comparison analyses, 2026-01. Retrieved 2026-06-14)

How Far Does Automation Go

It is important to honestly distinguish between areas where automation works well and areas that people must fill in.

Table 2. Automation maturity of SBOM tasks(source: compiled from tool comparison analyses. Retrieved 2026-06-14)

Tools do generation well. Put Syft or cdxgen into the build pipeline, and the component list fills in automatically. But whether the license field of a generated SBOM is accurate, whether the obligations of a non-standard license are met, and whether obligations propagate downstream without omission are things no tool guarantees automatically. This area is filled by policy and human review.

The Tool Itself Is an Attack Surface

Before trusting an automation tool, its own integrity must be verified. In January 2026, a case was reported in which an SBOM tool was implicated in two supply chain attacks within a short period, with the damage spreading to downstream projects. On this basis, some pipeline operators removed the tool in question.

The fact that an SBOM generation tool can itself become a target of supply chain risk requires combining hashes, signatures, and attestations at the generation and verification stages. This same concern lies behind CISA’s 2025 minimum elements draft adding Tool Name, Generation Context, and Component Hash as new fields. Avoiding the paradox that “an SBOM made by an untrustworthy tool cannot be trusted” requires pinning tool versions, verifying provenance, and signing the output.

Sources

Anchore.Syfthttps://github.com/anchore/syft,Grypehttps://github.com/anchore/grype. OWASP.cdxgenhttps://github.com/CycloneDX/cdxgen,Dependency-Trackhttps://dependencytrack.org/. Aqua Security.Trivyhttps://github.com/aquasecurity/trivy. EclipseSW360https://www.eclipse.org/sw360/. (All retrieved: 2026-06-14)

Overview

cdxgen is the official SBOM generator of the OWASP CycloneDX project. It supports more than 20 languages and package managers, and the latest version offers a dedicated AI BOM mode. It automatically identifies the dependencies of AI applications (PyTorch, Transformers, and so on) and integrates well with CI/CD pipelines.

From an AI SBOM standpoint, cdxgen’s strength is speed and automation. Its weakness is that it does not fill in license information in a default run. This trait shows up in the execution result below. Where OWASP AIBOM Generator centers on model card metadata, cdxgen centers on code and dependencies. Using both together covers both models and dependencies.

Key Features

• Identifies dependencies from source code and container images to generate a CycloneDX SBOM.
• Includes AI/ML metadata (formulation) with AI BOM mode (-t ai).
• Takes Hugging Face model URLs, Modelfiles, and GGUF artifacts directly as input.
• Automatically submits SBOMs to a Dependency-Track server for continuous management.

Installation

# One-off run (requires Node.js)npx @cyclonedx/cdxgen@latest --version# Global installnpm install -g @cyclonedx/cdxgen

Usage — Generating an AI BOM

Run in AI BOM mode from the AI project directory.

# Generate an AI BOMcdxgen -t ai -o aibom.json .# Generate including AI/ML metadata (formulation)cdxgen -t ai --include-formulation -o aibom.json .

Below is the actual result of running cdxgen against a summarization app (transformers,torch dependencies) that loads a pretrained model (facebook/bart-large-cnn). It automatically identifies 5 dependencies and produces a CycloneDX 1.7 BOM.

$ cdxgen -t python --include-formulation -o aibom.json .CycloneDX Generator 12.5.1 (Node.js)Generated components — 5 entries (CycloneDX 1.7): transformers 4.44.2 pkg:pypi/transformers@4.44.2 license: empty torch 2.4.0 pkg:pypi/torch@2.4.0 license: empty numpy 1.26.4 pkg:pypi/numpy@1.26.4 license: empty tokenizers 0.19.1 pkg:pypi/tokenizers@0.19.1 license: empty huggingface-hub 0.24.6 pkg:pypi/huggingface-hub@0.24.6 license: empty

Figure 1. cdxgen execution output(cdxgen 12.5.1, run 2026-06-13)

One of the generated components looks like this. The identification evidence is filled in, but thelicenses field is empty.

{"name":"transformers","version":"4.44.2","purl":"pkg:pypi/transformers@4.44.2","type":"library","evidence":{"identity":[{"field":"purl","confidence":0.5,"methods":[{"technique":"manifest-analysis","value":"requirements.txt"}]}]}}

What the Execution Result Shows

See Also

• AI SBOM generation and management procedure:3.9 AI SBOM
• Generator centered on model metadata:OWASP AIBOM Generator
• SBOM management:Dependency-Track,cdxgen + Dependency-Track integration
• Official:cdxgen AI-BOM documentation