Regulatory Open Forum

We are starting an evaluation of SBOM tools and wanted to see if anyone here had recommendations. We want a tool that does both SBOM generation and also checks for known vulnerabilities from the NVD/CVE databases.

Thanks!

Hi Cathy, FOSSology, WhiteSource, Black Duck these are few tools for this purpose.

FOSSology is an open-source tool that analyzes software packages and generates SBOMs. It can identify licenses, copyrights, and vulnerabilities associated with open-source components. It integrates with SPDX (Software Package Data Exchange) for generating standardized SBOMs.

WhiteSource is a comprehensive software composition analysis (SCA) tool that can generate SBOMs and identify open-source components in your software. It integrates with the NVD/CVE databases to provide vulnerability information.

Black Duck, now a part of Synopsys, offers an SCA solution for generating SBOMs and identifying open-source components. It provides vulnerability scanning capabilities by integrating with the NVD/CVE databases. It also offers license compliance management features.

We are starting an evaluation of SBOM tools and wanted to see if anyone here had recommendations. We want a tool that does both SBOM generation and also checks for known vulnerabilities from the NVD/CVE databases.

Thanks!