CycloneDX
¿Qué es CycloneDX?
CycloneDXAn OWASP-curated open standard for software, SaaS, ML, and crypto bills of materials, designed from the start for security use cases and now widely used to ship SBOMs alongside releases.
CycloneDX is a lightweight, OWASP-stewarded BOM specification that emerged in 2017 specifically to support security use cases such as vulnerability correlation, license compliance, and supply-chain transparency. Unlike SPDX (which began as a licensing format), CycloneDX was security-first from day one: it natively models components, services, dependencies, hash values, pedigree, vulnerabilities, and — through extensions — machine-learning models (ML-BOM), SaaS components (SaaSBOM), and cryptographic assets (CBOM). The spec is published in JSON, XML, and Protobuf and is officially recognized by NTIA, CISA, and the U.S. Executive Order 14028 SBOM minimum-elements guidance. Tooling exists across most ecosystems (`cyclonedx-bom` for Python, `cyclonedx-npm` for Node, plugins for Maven, Gradle, .NET, Go, Rust, etc.), and most security platforms can ingest CycloneDX directly. Alongside SPDX, it is one of the two formats most likely to satisfy regulator SBOM requirements through 2026.
● Ejemplos
- 01
A CI job runs `cyclonedx-bom` after every build and uploads the resulting cdx.json to a vulnerability-management platform.
- 02
A vendor delivers a CycloneDX 1.5 SBOM to a customer who requires SBOM submission under U.S. Executive Order 14028 contract clauses.
● Preguntas frecuentes
¿Qué es CycloneDX?
An OWASP-curated open standard for software, SaaS, ML, and crypto bills of materials, designed from the start for security use cases and now widely used to ship SBOMs alongside releases. Pertenece a la categoría de Seguridad de aplicaciones en ciberseguridad.
¿Qué significa CycloneDX?
An OWASP-curated open standard for software, SaaS, ML, and crypto bills of materials, designed from the start for security use cases and now widely used to ship SBOMs alongside releases.
¿Cómo funciona CycloneDX?
CycloneDX is a lightweight, OWASP-stewarded BOM specification that emerged in 2017 specifically to support security use cases such as vulnerability correlation, license compliance, and supply-chain transparency. Unlike SPDX (which began as a licensing format), CycloneDX was security-first from day one: it natively models components, services, dependencies, hash values, pedigree, vulnerabilities, and — through extensions — machine-learning models (ML-BOM), SaaS components (SaaSBOM), and cryptographic assets (CBOM). The spec is published in JSON, XML, and Protobuf and is officially recognized by NTIA, CISA, and the U.S. Executive Order 14028 SBOM minimum-elements guidance. Tooling exists across most ecosystems (`cyclonedx-bom` for Python, `cyclonedx-npm` for Node, plugins for Maven, Gradle, .NET, Go, Rust, etc.), and most security platforms can ingest CycloneDX directly. Alongside SPDX, it is one of the two formats most likely to satisfy regulator SBOM requirements through 2026.
¿Cómo defenderse de CycloneDX?
Las defensas contra CycloneDX combinan habitualmente controles técnicos y prácticas operativas, como se detalla en la definición.
¿Cuáles son otros nombres para CycloneDX?
Nombres alternativos comunes: CycloneDX SBOM, OWASP CycloneDX.
● Términos relacionados
- appsec№ 1185
Software Bill of Materials (SBOM)
Inventario formal y legible por máquina de los componentes, bibliotecas y dependencias que componen un software, junto con sus versiones y relaciones.
- appsec№ 1190
SPDX (Software Package Data Exchange)
A Linux Foundation-maintained, ISO/IEC 5962-standardized open format for software bills of materials, originally focused on license metadata and now broadly used for SBOMs.
- appsec№ 1328
VEX (Vulnerability Exploitability eXchange)
A machine-readable companion to the SBOM that tells consumers whether a listed CVE actually affects a given product — distinguishing 'present in the bill of materials' from 'reachable and exploitable'.
- appsec№ 271
Cryptographic Bill of Materials (CBOM)
Inventario de todos los activos criptográficos que utiliza un software o sistema —algoritmos, longitudes de clave, certificados, bibliotecas y protocolos— para apoyar la cripto-agilidad y la preparación postcuántica.
- appsec№ 1186
Seguridad de la cadena de suministro de software
Disciplina que protege cada eslabón de la producción de software —fuente, dependencias, build, firma, distribución y despliegue— frente a manipulación, código malicioso y pérdida de integridad.
- ai-security№ 029
Lista de materiales de IA (AIBOM)
Inventario legible por máquina de cada componente que entra en un sistema de IA —datasets, modelos base, datos de fine-tuning, librerías, prompts y artefactos de evaluación— usado para seguridad, cumplimiento y rendición de cuentas.