The best SBOM generator is the one built for your stack. Syft and Trivy cover container images and filesystems. cdxgen reads many languages from source. Microsoft's sbom-tool writes SPDX for build pipelines. cyclonedx-gomod is specific to Go. Generate at build time, then check the output.
Safeguard publishes this guide and sells a competing product, so we describe other tools only from their own documentation, as of 19 October 2026.
Key takeaways
- Pick the output format your customers ask for: SPDX or CycloneDX.
- Language specific generators usually know their package manager better. Image scanners see what is actually installed.
- Generate the SBOM from the build, not from a developer laptop.
- An SBOM is a list. It is useful once you scan it and keep it current.
What is an SBOM generator?
An SBOM generator lists the components inside software. NTIA describes an SBOM as "a nested inventory for software, a list of ingredients that make up software components." A generator reads a project or an image and writes that list in a standard format.
How do the main generators compare?
| Tool | Type and license | Inputs (per docs) | Output formats (per docs) |
|---|---|---|---|
| Syft | Open source, Apache-2.0 | Container images, filesystems, archives | CycloneDX, SPDX, Syft JSON; can convert between them |
| Trivy | Open source | Subcommands such as image, fs, rootfs and vm | CycloneDX and SPDX; CycloneDX XML is not supported yet |
| cdxgen | Open source, Apache-2.0 | Source projects, container images, root filesystems, live hosts | CycloneDX (1.7 default, downgradable to 1.4 or 1.5); SPDX 3.0.1 JSON-LD |
| Microsoft sbom-tool | Open source, MIT | Build component folders, via Component Detection | SPDX 2.2 by default; SPDX 3.0 with a flag |
| cyclonedx-gomod | Open source, Apache-2.0 | Go modules, applications, binaries | CycloneDX XML by default or JSON |
When should I pick each one?
Syft fits container workflows and pairs with Grype for scanning. It can also create signed SBOM attestations using in-toto.
Trivy suits teams already using it as a scanner. Add --scanners vuln to include vulnerability data in CycloneDX output, otherwise you get a plain SBOM.
cdxgen suits polyglot repos. Its docs name Java (Maven, Gradle, sbt), JavaScript and TypeScript (npm, pnpm, yarn, Bun, Deno), Python, Go, PHP, Ruby, Rust, .NET and C, and note that the full list is on a separate page.
sbom-tool suits Microsoft heavy pipelines, with guides for GitHub Actions and Azure DevOps. The project does not accept open source contributions.
cyclonedx-gomod has a mode that lists only the modules an application depends on. Its notes say SBOMs for vendored modules lack component hashes.
How do I choose an SBOM generator?
- Which format do customers or regulators require?
- Does it read your package manager, or only installed files?
- Does it cover container base layers?
- Can it run in CI and publish the file as a build artifact?
- Can it sign or attest the output?
- Does it record dependency relationships, not only a flat list?
- Can you diff two SBOMs to catch drift?
What should I do after I generate an SBOM?
Scan it. The free tool at gold.safeguard.sh/scan accepts a dependency manifest or a CycloneDX or SPDX SBOM, checks up to 100 dependencies, needs no login and parses the file in your browser. Safeguard also supports SBOM generation and import, with CVE and CISA KEV status in the Gold registry at gold.safeguard.sh.
Frequently asked questions
Which is better, SPDX or CycloneDX?
Neither wins outright. Use whichever your customers or regulators request, and pick a tool that exports both. Syft, Trivy and cdxgen can produce either.
What is the best free SBOM generator?
Syft, Trivy, cdxgen, sbom-tool and cyclonedx-gomod are all free and open source. The right one depends on your language and whether you ship containers.
Should I generate an SBOM from source or from the image?
Source shows what you declared. The image shows what shipped. Many teams keep both and compare them.
Does an SBOM list vulnerabilities?
Not by default. Scan the SBOM against a vulnerability database, or share VEX statements to say which findings apply.
Sources
- NTIA SBOM page: https://www.ntia.gov/page/software-bill-materials
- Syft: https://github.com/anchore/syft
- Trivy SBOM docs: https://trivy.dev/latest/docs/supply-chain/sbom/
- cdxgen: https://github.com/CycloneDX/cdxgen
- Microsoft sbom-tool: https://github.com/microsoft/sbom-tool
- cyclonedx-gomod: https://github.com/CycloneDX/cyclonedx-gomod
- Free dependency scan: https://gold.safeguard.sh/scan
Last reviewed: 19 October 2026.
