CycloneDX

CycloneDX is an SBOM format created within OWASP (the Open Worldwide Application Security Project, the non-profit behind the widely cited OWASP Top Ten) and standardized as ECMA-424 by Ecma International, the standards body that also gave the world ECMAScript, the specification JavaScript implements.

It was designed from the outset around security and supply-chain risk, which shows in its scope. Alongside the component inventory it can carry service definitions, formal dependency relationships, and VEX (Vulnerability Exploitability eXchange) data — assertions about whether a known vulnerability in a bundled component is actually exploitable in this product, which is how a vendor says “yes, that library is in there, and no, the flawed code path cannot be reached.”

It is deliberately compact and is emitted as JSON or XML, which makes it straightforward to generate from a build and to consume in a scanner. Adoption in the vulnerability-management tooling ecosystem is broad, and it is often the default output of SBOM generators.

CycloneDX and SPDX are the two formats that matter in practice, and the choice between them is usually made by the tools an organization already runs rather than by the merits of either. CycloneDX has more traction in security tooling; SPDX has deeper roots in license compliance. They overlap substantially, and converters exist but are imperfect — which is why artifacts are frequently published in both formats rather than forcing consumers to convert.