Best SBOM Tools for Generate, Diff, and Release Gates in 2026
Name the tree that shipped, compare it to the last ship, refuse the next one when policy fails.
Expertise: Supply Chain · Level: Intermediate · 12 min read
The lockfile in CI named 412 packages. The container that left the registry named 487. When the next CVE drops, a green scanner dashboard alone cannot tell you which release actually carries the package.
NTIA’s July 2021 minimum elements for an SBOM require automation support and machine-readable formats. The formats named in that report are SPDX, CycloneDX, and SWID tags. A spreadsheet attached to the release ticket does not meet that bar.
The workflow that does has three stages. Generate a bill at build time from the image or the source tree. Store those bills so you can diff what changed between release candidates. Gate the release when policy fails: banned license, critical CVE with a fix, or missing required fields.
CLI generators, platforms that ingest bills, and commercial license desks sit on different stages of that path. Matching CVEs on names you already own is SCA tools. This shortlist is whether you can name the tree that shipped, compare it to the last ship, and refuse the next one when policy says so.
How we evaluated
We read first-party docs, licenses, pricing pages, and release notes. We asked whether the product generates SPDX or CycloneDX as a first-class output, whether it can ingest and diff bills across releases, and whether a policy evaluation can fail CI or admission. Marketing pages count as claims, not as proof two tools do the same work.
| Tool | Best for | What to check |
|---|---|---|
| Syft | Generate SPDX or CycloneDX from images and dirs | Apache-2.0 · CLI · Anchore OSS |
| Trivy | Generate SBOM and fail CI on severity | Apache-2.0 · CLI · Aqua OSS |
| cdxgen | CycloneDX across many language ecosystems | Apache-2.0 · CLI · OWASP CycloneDX |
| Anchore Enterprise | Policy gates on stored SBOMs and images | Commercial · anchorectl · Syft inside |
| Dependency-Track | Ingest, monitor, and FAIL policy for CI | Apache-2.0 · self-host · CycloneDX in |
| FOSSA | License compliance with SBOM export | Free path · Business from $20/project/mo · SPDX/CycloneDX |
Syft
Best for generating SPDX or CycloneDX from container images and directories
Syft is Anchore’s open-source CLI for cataloging packages in container images, filesystems, and archives. First-party docs show SPDX JSON/tag-value and CycloneDX JSON/XML outputs, plus Syft’s native JSON when you need deeper catalog detail. You can write multiple formats in one run.
Syft also documents experimental format conversion and SBOM attestations with in-toto and Sigstore. It does not run a vulnerability policy engine by itself. Pair it with Grype, Trivy sbom, Dependency-Track, or Anchore Enterprise when the next step is match or gate.
Key features:
- Image, directory, archive, and OCI source targets
- SPDX and CycloneDX as first-class outputs
- Multiple <<-o>> formats in a single scan
- Attestation and experimental convert workflows in the docs
Why we like it:
When the job is emit a standards bill from what is on disk, Syft is the generator most teams already reach for, and the docs stay format-honest.
Limits:
Inventory only. No built-in release gate. Catalog depth still depends on which package types your image or tree actually exposes.
License or pricing: Apache-2.0. Free CLI. Commercial Anchore Enterprise is a separate seat when you want centralized policy on stored SBOMs.
Trivy
Best for generating an SBOM and failing CI on severity in one CLI
Trivy generates CycloneDX and SPDX from images, filesystems, and related targets through the same CLI teams already use for vulnerability scanning. Docs show cyclonedx and spdx-json format flags for bill output, and a dedicated sbom subcommand to re-scan a stored bill when a new CVE lands.
The gate story is the exit code. Pipelines commonly fail on HIGH/CRITICAL with a fix available, then archive the CycloneDX artifact beside the image. That is generate-plus-gate without standing up a separate policy server on day one.
Key features:
- CycloneDX and SPDX SBOM output from image and fs scans
- Optional vulnerability embedding in CycloneDX when scanners are enabled
- Re-check a stored inventory with the sbom subcommand
- CI-friendly exit codes and an official GitHub Action
Why we like it:
One binary covers write the bill and fail this job without splitting the toolchain on the first sprint.
Limits:
Exit-code severity gates are not a full license or NTIA-field policy engine. Portfolio diff across hundreds of apps still wants a store such as Dependency-Track.
License or pricing: Apache-2.0. Free CLI and Trivy Operator. Aqua commercial products are separate if you outgrow the OSS path.
cdxgen
Best for CycloneDX across many language ecosystems in one generator
cdxgen is the OWASP CycloneDX project CLI, library, REPL, and server for producing CycloneDX JSON bills, with SPDX export documented on the project. It targets source trees, containers, and related inputs across a wide language set.
License resolution against public registries is off by default. Teams that standardize on CycloneDX consumers such as Dependency-Track often prefer cdxgen when the repo mixes ecosystems that per-language plugins would otherwise split into separate bills.
Key features:
- CycloneDX-first generation across many ecosystems
- CLI, library, REPL, and server modes
- Optional license fetch from package registries
- Evidence and signing options documented by the project
Why we like it:
When the consumer is CycloneDX-native and the monorepo is messy, one OWASP generator beats a pile of per-language plugins you then merge by hand.
Limits:
Prefer Syft when contracts need deep image cataloging with many SPDX variants.
License or pricing: Apache-2.0 open source.
Anchore Enterprise
Best for policy gates on stored SBOMs and container images
Anchore Enterprise is the commercial platform built around SBOM-centric analysis. Docs describe automatic SBOM generation for images and filesystems, import of external bills, export to SPDX and CycloneDX, and a policy engine with gates and triggers that return pass, warn, or fail for CI and admission control.
AnchoreCTL embeds Syft for local generation and talks to the Enterprise API for app-version policy status. That is the release-gate seat when you already standardized on Syft files and need a durable store plus rule sets, not only a runner exit code.
Key features:
- Central SBOM repository with continuous vuln monitoring
- Policy gates and triggers for images and SBOM rule sets
- AnchoreCTL for CI generate, submit, and policy status
- App-version evaluation across attached assets
Why we like it:
It keeps the Syft generator story and adds the enterprise gate and archive that pure CLI workflows eventually need.
Limits:
Commercial packaging and operational cost. SBOM rule sets are narrower than full image gate libraries.
License or pricing: Commercial. Sales-quoted. Syft remains Apache-2.0 for the open path.
Dependency-Track
Best for ingesting CycloneDX bills, monitoring them, and failing CI on policy
Dependency-Track is the OWASP platform that consumes SBOMs (CycloneDX-first), continuously re-analyzes components for new vulnerabilities and policy violations, and exposes FAIL states CI plugins can wait on. Recent docs emphasize expression-based component policies and vulnerability policies that can suppress or audit findings before analysts see them.
That upload pattern is the product: generators create the bill, Dependency-Track keeps the portfolio view and the gate. Jenkins and other CI plugins document synchronous publish modes that fail the job on policy violations.
Key features:
- CycloneDX BOM upload and continuous re-analysis
- Component policies with FAIL for CI gating
- VEX-aware triage and vulnerability policies
- Self-hosted control of the SBOM archive
Why we like it:
Open-source answer to we generate bills in every pipeline and still cannot answer which apps gained a package this week.
Limits:
You operate the platform. Generators stay separate. Incomplete bills mean weak findings, especially if transitive deps were never included.
License or pricing: Apache-2.0. Free to self-host. Cost is compute, storage, and the people who own policies.
FOSSA
Best for license compliance with SPDX and CycloneDX SBOM export
FOSSA is the commercial open-source management desk that scans dependencies for license and vulnerability issues, then exports SBOMs in SPDX and CycloneDX, including optional VDR/VEX content on CycloneDX exports. Docs also cover importing third-party SBOMs on paid plans and SBOM policies for required fields.
Public pricing lists a Free forever tier with limited projects and SBOM exports, Business billed around contributing developers and projects (from $20 per project per month on the annual calculator we read), and Enterprise for custom deployment. Binary and snippet scanning are add-ons.
Key features:
- SPDX and CycloneDX export from analyzed projects
- License policy and PR-oriented workflows
- SBOM import on paid tiers
- Optional binary and snippet scanning add-ons
Why we like it:
When legal owns the license allow-list and security still needs a standards bill for customers, FOSSA covers both without pretending a CLI generator is a compliance program.
Limits:
Commercial path for serious portfolio import. Not a substitute for deep image cataloging when that is the only job.
License or pricing: Free tier with project caps. Business from $20 per project per month billed annually on the public pricing page we read. Enterprise is custom.
How to choose an SBOM tool
Four questions before you standardize a format and a gate. Names below are the shortlist, not a scored bake-off.
| Critical question | Why it matters | What to evaluate | Red flag |
|---|---|---|---|
| Is the deliverable a file or a policy verdict? | Generators and gates are different seats. | Syft or cdxgen for the file. Trivy for file plus severity exit. Anchore or Dependency-Track for stored policy. | Buying only a CVE PDF and calling it an SBOM program. |
| Which format do consumers require? | SPDX and CycloneDX are not interchangeable in every contract. | Syft for both. cdxgen for CycloneDX-first. FOSSA for customer-facing exports. | Promising SPDX from a CycloneDX-only pipeline with no converter. |
| Where does the bill live after CI? | Diff and continuous re-scan need a store. | Dependency-Track or Anchore Enterprise for archives. | Generating once and deleting the artifact with the runner. |
| Is license the gate or CVE severity? | Policy engines differ. | FOSSA for license programs. Trivy exit codes for severity. Dependency-Track or Anchore for broader rules. | A license-only tool sold as full vuln gating without a matcher. |
What we left out
- Grype: strong vulnerability matcher for Syft bills, not a generator. Keep it beside Syft when matching is the job.
- Microsoft sbom-tool, Tern, and ORT: real generators for narrower or heavier workflows.
- Snyk, GitHub dependency export, and Harbor adapters: useful in estates that already standardized there. Covered better next to SCA tools when the buy is findings, not the bill format.
What practitioners argue about SBOMs
Live threads keep returning to the same split: a generator file is necessary, and it is not sufficient. Teams that only emit CycloneDX in CI still lose when nobody stores the bill, includes transitives, or fails the job on policy.
Stack Overflow · Dec 2024
“Consider looking at Syft, an open-source SBOM generator that can scan project folders containing software from diverse ecosystems.”
The question asked for one CycloneDX approach across mixed-language repos headed to Dependency-Track. Some teams still generate per ecosystem and merge. Syft is the shortcut when a single folder scan is honest enough.
Hacker News · Sep 2025
“Have you tried Dependency Track from OWASP? Generate SBOM from each repo/projects and post it with API to DT and you have full overview. You have to hook it up so it is done automatically because of course stuff will always move.”
Automation is the argument. A manual upload process dies the week after the audit. The counter-risk is uploading incomplete bills that omit lockfile transitives.
Stack Overflow · 2022
Operators wire Trivy filesystem or image CycloneDX output into Dependency-Track over the BOM API so CI both produces the bill and updates the portfolio project.
The GitLab CI threads show generate and ingest as one pipeline, not two programs. That pairing is why Trivy and Dependency-Track both appear on this shortlist.
Start with Syft or cdxgen when you only need a standards file from the artifact. Add Trivy when the same CLI must fail severity gates. Stand up Dependency-Track or Anchore Enterprise when bills must live past the runner and policy must fail the release. Bring FOSSA when license counsel owns the gate and still needs SPDX or CycloneDX for customers.
FAQs
Is this the same page as SCA tools?
No. SCA matches known issues to dependencies. This shortlist is generate, store/diff, and gate on SBOM inventory. Some products span both. The SCA cut stays on SCA tools.
Should we pick SPDX or CycloneDX?
Pick what your consumers and contracts require. Syft and FOSSA speak both. cdxgen and Dependency-Track are CycloneDX-native. Do not invent a second format late in procurement.
Can open source cover generate and gate?
Yes for many teams: Syft or cdxgen to generate, Trivy for severity exits, Dependency-Track for portfolio policy. Anchore Enterprise and FOSSA add supported commercial planes when that is the buy.
Is this a scored bake-off?
No. Order is editorial.
