Glossary

CycloneDX

What Is CycloneDX?

CycloneDX is an open standard, maintained by OWASP, for representing software bills of materials and related supply chain artifacts — including SBOMs, VEX statements, AI-BOMs, and CBOMs — in a structured, machine-readable format.

CycloneDX is the other major SBOM format alongside SPDX, with particular strength in extensions for AI components and cryptographic inventories. NetRise Turbine produces CycloneDX-formatted SBOMs, AI-BOM data, and CBOM exports (CycloneDX 1.6 for cryptographic elements).

Software Supply Chain ConceptsVulnerability Exploitability eXchange (VEX)VEX is a standardized format for communicating whether a vulnerability in a software component is actually exploitable in a given product — filtering noise from risk.Read definition
Software Supply Chain ConceptsSoftware MaintainerA software maintainer is the individual or group responsible for an open-source project's code, releases, and direction — its stewardship over time.Read definition
Software Supply Chain ConceptsDirect DependencyA direct dependency is a software component an application explicitly declares in its own manifest or source — chosen by the developer, not pulled in downstream.Read definition

CycloneDX

What Is CycloneDX?

Related Terms

Related Content