125% more reported CVEs per day in 2026 than last year.

Compare

SBOM management

SBOM management is the ongoing work of storing SBOMs by product and release, monitoring them for new vulnerabilities and getting them to the people who ask. Generating an SBOM takes one step in a pipeline. Keeping hundreds of them useful is the real job.

Updated

Two routes to a monitored SBOM After the build: files such as source, a lockfile or an image are scanned by a generator such as Syft, Trivy or cdxgen, and the SBOM file goes to a manager such as Anchore, FOSSA, Cybeats, Manifest, Lineaje or Dependency-Track, which stores and monitors it. During the build: CRACI records what the build job fetched and produces an SBOM with a completeness state, which it monitors for new vulnerabilities. After the build generate, then manage Files source, lockfile or image Generator Syft, Trivy, cdxgen SBOM file what the scan could see Manager Anchore, FOSSA, Cybeats, Manifest, Lineaje, D-Track During the build record, then monitor build job on CRACI Recorded every package the job fetched SBOM with a completeness state Monitored for new vulnerabilities

Each comparison says what the other product does well, where CRACI is different, and when you would use both. For every category, see all comparisons.

What SBOM management involves

  1. Collect. Gather SBOMs from your own builds and from suppliers, in whatever format they arrive.
  2. Normalize. Bring CycloneDX and SPDX files, and the different ways tools name a component, into one consistent view.
  3. Check quality. Find what is missing, such as licenses, identifiers or dependency relationships. See what a weak SBOM looks like.
  4. Monitor. Keep matching stored SBOMs against new vulnerability data, so that an advisory turns into a list of affected releases.
  5. Triage. Decide what matters, send it to the owning team and record the outcome, for example in a VEX statement.
  6. Share. Give customers, auditors and regulators the SBOM for the version they ask about.

For the habits behind this, see SBOM best practices. If you are new to the topic, start with what is an SBOM.

Why spreadsheets and folders stop working

One product with one SBOM fits in a repository. Several products, each with supported versions and suppliers, do not. The questions that matter cross all of them: which releases contain this package, which customers run those releases, and since when? Answering that from a folder of JSON files takes days, at the moment when you have hours.

Managers, generators and build-time recording

  • SBOM managers such as Anchore, FOSSA, Cybeats, Manifest, Lineaje and Dependency-Track store, analyze and monitor SBOMs. They manage the SBOMs they are given, so the record is only as complete as the generator behind it.
  • SBOM generators such as Syft, Trivy and cdxgen scan a directory, an image or a lockfile after the fact. What they report depends on the files in front of them. See the best SBOM tools for both groups side by side.
  • Build-time recording captures the dependencies while the build runs. This is CRACI's approach.

What to look for in an SBOM management tool

  • Imports both CycloneDX and SPDX, and SBOMs from suppliers if you need them
  • Tracks SBOMs per release, not only per repository
  • Re-checks stored SBOMs as new vulnerabilities are published
  • Shows dependency relationships, so a finding leads to the package to upgrade
  • Supports triage and VEX, so that decisions are kept
  • Offers a way to share SBOMs with customers, if they ask for them

Where CRACI fits

CRACI records the SBOM while your GitHub Actions build runs. A package-aware proxy on the runner records every package the job fetched, including packages restored from CI caches, so the SBOM describes the build that produced the artifact rather than a scan that ran somewhere nearby. Each job's SBOM carries a completeness state, and exports in CycloneDX and SPDX include transitive dependencies and each component's declared license. CRACI keeps re-evaluating monitored SBOMs as new vulnerabilities appear, and its inventory view shows exactly which software versions are deployed to which products, globally.

For what the Cyber Resilience Act asks of an SBOM, see CRA compliance: SBOM requirements and tools. Read more about build-time SBOM generation.

CRACI compared with each tool

Side by side

Several tools on one page, for when you are choosing a category, not one product.

SBOM management: frequently asked questions

What is SBOM management?

It is the ongoing work of collecting SBOMs across products and suppliers, keeping them consistent, monitoring them for new vulnerabilities and sharing them with the people who need them.

What is the difference between an SBOM generator and an SBOM manager?

A generator produces the SBOM file. A manager stores SBOMs from many sources and keeps checking them. A manager can only be as complete as the SBOMs it receives.

Do you need an SBOM management tool?

With one product and few releases, a generator and careful storage can be enough. With several products, supported versions or supplier SBOMs, the questions cross too many files to answer by hand.

Is Dependency-Track an SBOM management tool?

Yes. It is an open source platform from OWASP that ingests SBOMs and monitors them for known vulnerabilities. You run it yourself and supply the SBOMs.

Other categories

See CRACI on your own pipeline

Book a demo and we will walk through your builds, your SBOMs and your compliance evidence.

Book a demo