Question 1

What is an SBOM?

Accepted Answer

A Software Bill of Materials (SBOM) is a machine-readable inventory of every component inside an application, including direct and transitive open-source dependencies. SBOMs power vulnerability tracking, license audits, and procurement reviews. Regulations like U.S. Executive Order 14028 and the EU Cyber Resilience Act increasingly require SBOMs as part of software transparency obligations for vendors and manufacturers.

Question 2

How does automated SBOM generation work in DerScanner?

Accepted Answer

DerScanner scans your source code along with manifest and lock files (package.json, pom.xml, Podfile.lock, and similar) to identify every direct and transitive dependency. The platform then produces a CycloneDX SBOM in JSON, cross-references each component against vulnerability databases, and overlays license metadata. Output is ready for audit, CI/CD pipeline integration, or customer-facing security portals.

Question 3

What format does DerScanner generate SBOMs in?

Accepted Answer

DerScanner generates SBOMs in CycloneDX format and JSON. CycloneDX is the OWASP-maintained standard focused on vulnerability management and software supply chain security, widely adopted across DevSecOps workflows. The format captures direct and transitive dependencies, license data, vulnerability links, and component metadata in a single machine-readable inventory.

Question 4

What is an SBOM and why does it matter?

Accepted Answer

An SBOM is an inventory: a list of every component inside an application. Software Composition Analysis (SCA) is the activity of analyzing that inventory for security and license risks. The two are tightly linked. A modern SCA tool usually generates the SBOM as a by-product of scanning and then layers CVE matching, license analysis, and supply chain attack detection on top of every component.

Question 5

What is the difference between SCA and supply chain security?

Accepted Answer

SCA focuses on finding known CVEs in dependencies. Supply chain security is broader: it includes SCA plus malicious package detection, typosquatting and namespace hijacking checks, license risk analysis, package health scoring, and reachability. Mature programs treat SCA as one layer inside a wider supply chain strategy that also covers build integrity, provenance, and continuous monitoring of components in production.

Question 6

What is the difference between CycloneDX and SPDX formats?

Accepted Answer

CycloneDX is the OWASP-maintained SBOM standard, designed for vulnerability management and software supply chain security. SPDX is a Linux Foundation standard focused on license compliance and procurement workflows. Both are widely adopted across the industry. Many organizations use CycloneDX for security teams and SPDX for legal and procurement workflows. DerScanner generates CycloneDX.

Question 7

What are direct vs transitive dependencies in an SBOM?

Accepted Answer

Direct dependencies are libraries your code explicitly imports. Transitive dependencies are the libraries those libraries depend on, layered three or four levels deep. Most software supply chain attacks exploit transitive components developers never see directly. A complete SBOM captures the full dependency tree where lock files are present, exposing every component that ships with the application.

Question 8

Is automated SBOM generation required by law?

Accepted Answer

In several jurisdictions, yes. U.S. Executive Order 14028 establishes SBOM transparency expectations for software sold to federal agencies. The EU Cyber Resilience Act imposes component-tracking requirements on manufacturers of products with digital elements. Sector-specific regulations in healthcare, finance, and critical infrastructure are following the same direction. Automated generation is the practical way to meet these obligations at scale.

Question 9

How is DerScanner different from open-source SBOM generators?

Accepted Answer

Open-source generators like Syft and cdxgen produce a software inventory. DerScanner integrates SBOM generation with native CVE scanning, license analysis, supply chain attack detection (MavenGate, starjacking, typosquatting), 8-metric package health scoring, and reachability analysis. The platform also handles audit reporting, CI/CD integration, and on-premise deployment that standalone generators don't provide out of the box.

Question 10

Which programming languages does DerScanner support for SBOM generation?

Accepted Answer

DerScanner generates SBOMs across 12 ecosystems: JavaScript/TypeScript, PHP, Python, Ruby, C#/VB.NET, C/C++/Objective-C, Go, Java/Kotlin/Scala, Rust, Swift, and Erlang. Coverage includes major package managers like npm, pip, Maven, Gradle, NuGet, Cargo, Composer, Go modules, CocoaPods, and Swift Package Manager. Transitive dependency trees are fully resolved where lock files are present.

Automated CycloneDX
SBOM Generation Tool

Why Your Team Needs DerScanner SBOM Generator?

CycloneDX SBOM across 12 ecosystems.

Full transitive dependency coverage

Native CVE and license overlay

CI/CD pipeline integration

Why Modern Companies need Automated SBOM Generation

U.S. Executive Order 14028

EU Cyber Resilience Act (CRA)

Incident response

The cost of inaction

Key Capabilities
for Software Supply Chain Security

Automated SBOM creation during builds

Multi-ecosystem support

Vulnerability and license overlay

Continuous monitoring

Approved by industry leaders

What Is SBOM
Generation?

Frequently Asked Questions

Generate Your First SBOM Today

Automated CycloneDX SBOM Generation Tool