A SaaSBOM is a machine readable inventory of the services that make up an application and the relationships between them. An SBOM lists components inside one piece of software. A SaaSBOM lists the running services around it. It is useful when you need a map of services before you scan them.
Definition
CycloneDX describes itself as a specification for machine readable inventories of software components, services, and the dependency relationships between them. Its capabilities page lists Software, SBOM, and Software as a Service, SaaSBOM, as separate capabilities, along with others such as cryptography, hardware, machine learning, operations, VEX and vulnerability disclosure reports.
So the family has different documents for different questions.
SBOM or SaaSBOM
| Question | Document |
|---|---|
| What libraries are inside this service? | SBOM |
| Which services make up this product, and what do they call? | SaaSBOM |
| Is this vulnerability exploitable in my product? | VEX |
| Which cryptographic assets are used? | CBOM |
The two work together. A SaaSBOM gives the list of services. An SBOM per service gives the contents. Join them on the service name.
Why a service inventory may want it
OWASP asks teams to inventory API hosts and integrated services, including their role, the data they exchange and that data's sensitivity. That is very close to what a SaaSBOM can express. It also names a data flow blindspot, where sensitive data is shared with third parties without business justification, inventory or visibility.
A structured document for services and data flows makes those blindspots queryable, instead of locked in diagrams.
What to put in one
- Each service, with name, version and owner.
- Endpoints and whether they are public.
- Data classifications that flow in and out.
- Dependencies on other services and third parties.
- A link from each service to its SBOM.
A caution
Do not build this by hand across hundreds of services. Generate it from your catalog and deploy data, and review the generated output. A hand maintained file decays the same way a wiki page does.
When you can skip it
If you run a handful of services and keep a clear catalog, a SaaSBOM adds formality more than value. Start with the catalog and SBOMs, and add the service level document when auditors or customers ask for it.
Quick check
Is a SaaSBOM a replacement for an SBOM?
No. It describes services and their relations. An SBOM describes components inside software. You usually want both.
Is a SaaSBOM required by any law?
This post does not cover legal requirements. Check the specific regulation or contract that applies to you.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how components roll up to projects.
Safeguard produces SBOMs and scans dependencies, and a free scan shows the result for one repository.
Sources
Last reviewed: 19 October 2026.
