SBOM Tools Compared: Generating, Managing and Reading

The question about the right SBOM tool is usually asked wrong, because there is no single one. SBOM work splits into three disciplines, each with its own tool class: generating documents, managing and monitoring an inventory, and reading and understanding individual documents. Mixing the disciplines means hunting forever for one tool that does everything, then ending up back in a text editor. This overview sorts the relevant open source tooling along the three jobs and closes our series on making the software supply chain visible.

Generating: Syft and Trivy

Everything starts with generation, and two tools dominate here. Syft by Anchore is the specialized SBOM generator: it scans container images, directories and archives, detects packages across a wide range of ecosystems and writes both SPDX and CycloneDX with high detail.

syft ghcr.io/acme/billing:2.4.1 -o spdx-json > billing.spdx.json

Trivy by Aqua Security is the Swiss army knife: primarily a vulnerability scanner, it also produces solid SBOMs and is already present in many pipelines. If you run Trivy for CVE scans anyway, SBOM generation comes almost for free, a pattern that pays off in DevSecOps pipelines generally.

trivy image --format spdx-json --output billing.spdx.json ghcr.io/acme/billing:2.4.1

On package metadata depth, Syft usually leads in our projects; on pipeline economy, Trivy wins. Both belong to the category “run in the build, store the artifact next to the image”. Worth noting in passing: scanners are themselves supply chain components with attack surface, as the supply chain attack via a fake Trivy plugin demonstrated.

Managing and monitoring: Dependency-Track

Generated SBOMs only create value when matched against current vulnerability data, continuously rather than once. That is the domain of OWASP Dependency-Track: a server ingests the SBOMs of all projects, continuously compares the contained components against vulnerability databases and alerts when a new CVE hits a component in the inventory. The Log4Shell question, “where exactly is log4j running?”, takes a well-maintained Dependency-Track seconds to answer.

The price is operations: Dependency-Track is a server with a database, update care and access control. For organizations with more than a handful of products it pays off quickly; for a single small product, a CI job scanning with Trivy against the current CVE feed can be the more pragmatic start. Readers of our self-hosted versus SaaS comparison know this trade-off pattern well.

Reading and understanding: SBOM Lens

The third discipline is missing from most tool lists: actually looking at a single document or a release cascade, asking questions, taking answers away. Dependency-Track thinks in inventories and alerts, not in document structures; nobody meaningfully displays a release SBOM with an ExternalDocumentRef cascade four levels deep there. We built SBOM Lens for exactly this gap: cascading SPDX documents as one tree, conflict and diff views, an NTIA-oriented quality report, all client-only in the browser and open source under Apache-2.0.

Typical moments of use: the release review before shipping, comparing two states for release notes, quality-checking SBOMs delivered by suppliers, hunting duplicate versions across a cascade. In short: wherever a human needs to understand a document rather than feed a database.

The combination that works day to day

For a mid-sized delivery pipeline, this triad has proven itself. Syft or Trivy generate an SPDX document per artifact in the build and store it, signed, next to the image. Dependency-Track, once more than a handful of products are involved, takes over inventory and CVE monitoring. SBOM Lens serves as the reading and review tool for humans, in the browser, in VS Code, or self-hosted with a curated catalog. All three classes are open source; the entry cost is configuration effort, not license budget.

Conclusion

Generate, manage, read: thinking of the three SBOM disciplines separately makes tool choices faster and combinations better. Syft or Trivy into the pipeline, Dependency-Track for the monitored inventory, SBOM Lens for the understanding eye. That way the supply chain is not just documented but visible. If you want to build or harden this chain in your CI/CD, we support you hands-on, from pipeline integration to review process: software engineering at EverBright.

Frequently Asked Questions

Which tool generates better SBOMs, Syft or Trivy?

Syft typically delivers richer package metadata and is specialized in SBOM generation. Trivy produces solid documents and shines when it already runs in the pipeline as a vulnerability scanner. Both write SPDX and CycloneDX; for most teams the existing toolchain decides, not format quality.

What is Dependency-Track used for?

Dependency-Track centrally manages the SBOMs of all projects and continuously compares the contained components against vulnerability databases. When a new CVE appears, it immediately shows which products are affected. It pays off from a handful of products upward; the trade-off is operating a server with a database.

How does SBOM Lens differ from Dependency-Track?

Dependency-Track thinks in inventories and alerts: many projects, continuous CVE monitoring. SBOM Lens thinks in documents: reading a release including its cascading SPDX structure, comparing states and checking quality, client-only in the browser. The tools do not replace each other; they complement different working moments.

Is one SBOM tool enough for the Cyber Resilience Act?

No. The CRA effectively demands all three disciplines: a machine-readable SBOM as part of the technical documentation, effective vulnerability handling built on it, and the ability to produce and assess documents on request. A pipeline of generator, inventory management and reading tool covers exactly that.