One of the two standard SBOM formats — security-optimised and widely adopted.
CycloneDX is an open, lightweight SBOM (Software Bill of Materials) standard, originally created by the OWASP Foundation and now the de facto format for security use cases. It describes the components that make up a piece of software — libraries, containers, services, hardware, AI models — plus the relationships, vulnerabilities, licenses, and attestations that attach to them.
The current specification is v1.5, which added first-class support for VEX (Vulnerability Exploitability eXchange), SaaSBOM, ML-BOM for AI components, and formulation data describing how a build was produced. CycloneDX is recommended by CISA and is one of two formats named in the US Executive Order 14028 guidance.
A CycloneDX document is JSON, XML, or Protobuf. The core objects are:
If an SBOM is going to drive security decisions — block deployments, answer auditor questions, feed a vulnerability correlation engine — it needs richer fields than just "component + version + license". CycloneDX was designed for that job.
It is the format most security tools emit and consume, the format regulators and platform owners ask for by name, and the format that covers emerging surfaces like AI models and SaaS integrations natively rather than as awkward extensions.
Vulnerabilities, VEX, pedigree, and attestations live in the same document — no sidecar files to keep in sync.
Containers, applications, firmware, AI/ML models, SaaS dependencies, and hardware all fit in the same schema.
Trivy, Syft, Grype, Dependency-Track, and most commercial SCA platforms read and write CycloneDX natively.
Named in CISA SBOM guidance and accepted by US federal software attestation programs — a safe default for procurement.
Documents can reference each other, which means a product SBOM can point at component SBOMs without duplicating their contents.
Safeguard generates CycloneDX 1.5 SBOMs by default for every scanned artifact, enriches them with reachability and license data, and ships them with embedded VEX statements so consumers can see which CVEs you have already cleared. The same documents feed the internal risk engine, the inventory use case, and customer-facing compliance exports.
Safeguard produces signed, VEX-enriched CycloneDX SBOMs for every repo, image, and release — no custom pipelines required.