Syft is the best software bill of materials SBOM tool for most readers who need a free SBOM fast, and OWASP Dependency-Track is the best free place to store and watch those SBOMs over time, while Snyk is the best choice for small development teams that want scanning and fixes in one place. Snyk Team starts at $25 per contributing developer per month, with a minimum of 5 developers and a cap of 10 contributing developers, so an 11th developer moves a team to the Enterprise credit plan, a limit most roundups skip. FOSSA Business starts at $20 per project per month when billed annually, yet its own pricing page says pricing is primarily based on contributing developers, and its calculator shows $207 per month for a 10 developer team, so the per project figure alone does not set the bill.
An SBOM is a list of every component, library, and dependency inside a piece of software, with versions and licenses. Buyers ask for SBOMs in CycloneDX and SPDX formats, and security teams use them to find which products contain a named vulnerable component. The tools below split into generators that create an SBOM, and managers that store SBOMs and check them against vulnerability data. Most teams need one of each.
On this page
Best software bill of materials sbom tools: comparison table
Swipe the table sideways on a phone to see every column.
| # | Name | Best for | Starting price | Free plan / trial | Link |
|---|---|---|---|---|---|
| 1 | Syft | Free SBOM generation in CI | $0 | Yes | Visit |
| 2 | OWASP Dependency-Track | Free SBOM storage and monitoring | $0 | Yes | Visit |
| 3 | Snyk | Small development teams that want scanning and fixes | $25 per contributing developer/month | Yes | Visit |
| 4 | FOSSA | License compliance with SBOM export | $20 per project per month | Yes | Visit |
| 5 | Mend | Enterprise license and vulnerability policy | $1,000 per developer/year | Yes | Visit |
| 6 | Anchore Enterprise | Policy enforcement for containers at scale | quote only | Free trial (15 days) | Visit |
| 7 | JFrog Xray | Artifact and container scanning inside JFrog | quote only | No | Visit |
| 8 | Black Duck | Audit grade SBOMs for regulated suppliers | quote only | No | Visit |
The 8 best best software bill of materials sbom tools, in detail
Syft
Best for: Free SBOM generation in CI
Syft is a command line tool from Anchore that builds an SBOM from a container image, a filesystem, or an archive. It catalogs operating system packages and language packages, then writes the result in CycloneDX JSON, SPDX JSON, SPDX tag value, Syft JSON, or GitHub dependency snapshot format. Syft costs $0.
- A team can add one command to a build and keep the SBOM as a build artifact.
- The trade-off is scope: Syft creates the list, it does not watch the list over time.
- New vulnerability data will not reach an old SBOM unless a second tool rechecks it, so pair Syft with Grype, Dependency-Track, or a commercial scanner
Pros
- Generates CycloneDX and SPDX SBOMs from images and filesystems
- single command in CI
- Apache 2.0 license with no seat count
Cons
- No central dashboard or policy store on its own
- needs a scanner such as Grype to match components to known flaws
OWASP Dependency-Track
Best for: Free SBOM storage and monitoring
Dependency-Track is an open source platform from OWASP that takes SBOMs as its main input. It builds an inventory of components across every version of every project, then checks those components against vulnerability and policy data on a continuous basis. It consumes and produces CycloneDX SBOM, VEX, and VDR records, and it connects to Jenkins, Jira, and Slack.
- Dependency-Track costs $0 for the software.
- The cost that remains is operation: a server, a database, feed updates, and backups.
- It is the best free manager in this list for teams with that skill in house.
- It is a poor fit for a team that wants a vendor to host the service and answer support calls, because those services are not part of the open source p
Pros
- Stores CycloneDX and SPDX SBOMs for a full project portfolio
- checks components against NVD, GitHub Advisories, and OSV data
- API first design for CI use
Cons
- You host and maintain it yourself
- setup needs a database and vulnerability feed sync, with no vendor support contract included
Snyk
Best for: Small development teams that want scanning and fixes
Snyk covers open source dependencies, first party code, containers, and infrastructure as code, and it generates SBOMs as part of that scanning. Developers see findings in the IDE and in pull requests, with fix suggestions. The Free plan starts at $0 per month, and the Team plan starts at $25 per contributing developer per month, with a minimum of 5 developers and a cap of 10 contributing developers.
- A 5 developer team therefore starts at $125 per month on Team.
- Enterprise uses a credit plan: 1 credit equals $1, and each capability draws credits at a listed rate, such as 1.0 credit per active contributor per d
- Credits expire at the end of the contract term.
Pros
- Free plan at $0 per month
- Team plan starts at $25 per contributing developer per month
- SBOM export in CycloneDX and SPDX formats
Cons
- Team plan requires a minimum of 5 developers and caps at 10 contributing developers
- Enterprise is a credit based plan that needs a sales quote
FOSSA
Best for: License compliance with SBOM export
FOSSA is an open source management platform that scans code for dependencies, licenses, and vulnerabilities, then exports SBOMs for compliance and customer requests. The Free plan is free forever, with 5 projects, 10 contributing developers, and 5 imported SBOMs. The Business plan starts at $20 per project per month when billed annually, with 10 projects, 10 contributing developers, unlimited dependency levels, and unlimited imported SBOMs.
- The pricing detail that changes the choice is the billing basis.
- FOSSA lists $20 per project per month, yet its pricing page says pricing is primarily based on the number of contributing developers, and its calculat
- Choose FOSSA when license compliance and SBOM export are the main need and your project count fits the Business limits.
Pros
- Free plan covers 5 projects and 10 contributing developers
- Business plan exports SBOMs and adds license and vulnerability scanning
- Enterprise adds SSO and RBAC
Cons
- Free plan is limited to 5 projects, 10 contributing developers, and 5 imported SBOMs
- Business plan is limited to 10 projects and 10 contributing developers
Mend
Best for: Enterprise license and vulnerability policy
Mend, formerly WhiteSource, is an application security platform built around software composition analysis, license compliance, and policy enforcement. It generates SBOMs in CycloneDX and SPDX formats as part of its dependency scanning, and it links each component to license data and known vulnerability data. Mend.io Free gives individual developers basic SCA scanning at $0.
- Mend states on its own site that Mend AppSec delivers full platform coverage across code, open source, containers, and AI inventory for up to $1,000 p
- Mend AI Premium adds up to $300 per developer per year.
- A 20 developer team therefore faces up to $20,000 per year for Mend AppSec before any AI add on.
Pros
- Mend AppSec covers code, open source, containers, and AI inventory for up to $1,000 per developer per year
- SBOM generation in CycloneDX and SPDX formats
- Mend.io Free covers basic SCA for individual developers
Cons
- Cost scales with every developer at up to $1,000 per developer per year
- Mend AI Premium adds up to $300 per developer per year on top of the platform
Anchore Enterprise
Best for: Policy enforcement for containers at scale
Anchore Enterprise takes the open source Syft generator and Grype scanner and adds the management layer that large organizations ask for: persistent SBOM storage, continuous re matching against updated vulnerability feeds, policy enforcement that can stop a non compliant image, centralized reporting, role based access, and vendor support. Anchore SBOM is included in all Anchore Enterprise subscriptions. Anchore does not list a price on its site, so the starting price here is quote only, and the free plan is a 15 day trial.
- Use the trial to test policy packs and registry connections in one pipeline before you commit.
Pros
- Built on the same Syft and Grype engines as the free tools
- SBOM support for CycloneDX JSON versions 1.2 to 1.6 and SPDX JSON versions 2.2 to 2.3
- air gapped deployment is supported
Cons
- No listed price, so budgeting needs a sales quote
- enterprise setup needs planning around registries, pipelines, and policy rules
JFrog Xray
Best for: Artifact and container scanning inside JFrog
JFrog Xray is the security scanner for the JFrog Platform. It analyzes Artifactory repositories, binary artifacts, build data, package relationships, dependencies, and container images, and it generates SBOM data for the artifacts it scans. It fits teams that already store artifacts in Artifactory, because the scan runs where the artifacts live.
- Pricing needs care.
- The JFrog pricing page lists Pro at $50 per month with 25 GB base consumption, and Enterprise X starting at $950 per month with 125 GB base consumptio
- Xray as a stand alone add on has no listed price on that page, so the starting price here is quote only.
- Enterprise X is the tier that lists Code and Binary SCA, so budget from $950 per month for the full Xray set.
Pros
- Scans Artifactory repositories, builds, and container images continuously
- Code and Binary SCA is included in Enterprise X
- JFrog Advanced Security adds contextual analysis and leaked secrets detection
Cons
- Xray alone has no standalone listed price
- the full SCA set sits in Enterprise X, which starts at $950 per month
Black Duck
Best for: Audit grade SBOMs for regulated suppliers
Black Duck is an enterprise software composition analysis platform, now an independent company after Synopsys sold its software integrity business. It scans source code, binaries, and containers, builds an SBOM for each, and checks components against its KnowledgeBase for vulnerabilities and license obligations. Binary scanning sets it apart: it can find open source components in a compiled artifact when the supplier will not share source code.
- Black Duck does not list a price on its site, and it has no free plan, so the starting price here is quote only and a sales quote is needed before bud
- Choose Black Duck when a customer, a regulator, or an auditor asks for an audit grade SBOM with license evidence and binary coverage.
Pros
- SBOM generation in CycloneDX and SPDX formats with deep component metadata
- binary scanning when source code is not available
- license and policy reporting for audits and supplier exchanges
Cons
- No listed price and no free plan, so budgeting needs a sales quote
- audit depth and policy setup add work for small teams
How we chose
We included tools that generate, store, or check a real SBOM in CycloneDX or SPDX format, with a live official homepage and a pricing page or product page opened on 2026-11-12. Prices and plan limits in this article come from those official vendor pages and docs opened on that date. We did not test any tool hands-on. We did not install, run, or scan with any product, and we did not use customer counts, awards, or review scores to rank items. Where a vendor hid the price, we wrote quote only instead of guessing a figure.
Syft and Dependency-Track cover generation and storage at $0. Snyk and FOSSA cover small team work at listed prices. Mend, Anchore Enterprise, JFrog Xray, and Black Duck cover enterprise policy and audit, and three of those four are quote only.
Which tool fits your team size and budget
| Team size and budget | Pick | What the numbers say |
|---|---|---|
| One developer, $0 budget | Syft plus Dependency-Track | Both cost $0, and Syft writes CycloneDX and SPDX SBOMs |
| Small team, 5 to 10 developers | Snyk Team | $25 per contributing developer per month, minimum 5 developers, cap 10 developers |
| Small team, 5 to 10 projects | FOSSA Business | $20 per project per month when billed annually, with a 10 project and 10 developer limit |
| Compliance team, license policy first | FOSSA Business or Mend | FOSSA starts at $20 per project per month; Mend AppSec is up to $1,000 per developer per year |
| Enterprise, containers at scale | Anchore Enterprise | Quote only, with a 15 day trial and CycloneDX 1.2 to 1.6 support |
| JFrog shop, artifacts in Artifactory | JFrog Xray in Enterprise X | Enterprise X starts at $950 per month; Xray alone is quote only |
| Regulated supplier, audit evidence first | Black Duck | Quote only, no free plan, binary scanning included |
Frequently asked questions
What is an SBOM?
An SBOM is a list of every component, library, and dependency in a piece of software, with versions and licenses. It is usually shared in CycloneDX or SPDX format. Security teams use it to find which products contain a vulnerable component, and buyers use it to check license and supply chain risk before they accept a release.
Which SBOM tool is best for most teams?
Syft is the best start for most teams, because it costs $0 and writes CycloneDX and SPDX SBOMs from images and filesystems with one command. Pair it with OWASP Dependency-Track, also $0, to store SBOMs and watch them against vulnerability data. Add Snyk or FOSSA when you need developer fixes or license policy in a hosted product.
How much does an SBOM tool cost?
Costs range from $0 to quote only. Syft and Dependency-Track cost $0. Snyk Team starts at $25 per contributing developer per month, with a minimum of 5 developers. FOSSA Business starts at $20 per project per month when billed annually. Mend AppSec is up to $1,000 per developer per year, while Anchore Enterprise, JFrog Xray, and Black Duck are quote only.
Which SBOM tool is best for license compliance?
FOSSA is the best listed price choice for license compliance, with SBOM export, license scanning, and a Free plan covering 5 projects and 10 contributing developers. Mend is the best enterprise choice when license policy, audit reporting, and AI component inventory matter, at up to $1,000 per developer per year for Mend AppSec.
Do I need a commercial SBOM tool, or are free tools enough?
Free tools are enough when you generate SBOMs in CI, store them in Dependency-Track, and have staff to host that service. A commercial tool is worth the cost when you need vendor support, audit reporting, policy enforcement that blocks a release, binary scanning, or air gapped deployment.
What is the difference between CycloneDX and SPDX?
CycloneDX is an OWASP standard format built for security and supply chain use, while SPDX is an ISO standard format built for license and provenance use. Most tools in this list, including Syft, Snyk, Mend, Anchore Enterprise, and Black Duck, support both formats. Check which version your customer or auditor asks for before you pick a tool.
Sources
- https://github.com/anchore/syft
- https://dependencytrack.org/
- https://snyk.io/
- https://snyk.io/plans/
- https://fossa.com/
- https://fossa.com/pricing/
- https://www.mend.io/
- https://www.mend.io/mend-vs-sonatype/
- https://anchore.com/
- https://anchore.com/platform/sbom/
- https://jfrog.com/
- https://jfrog.com/pricing/
- https://www.blackduck.com/
- https://www.blackduck.com/software-composition-analysis-tools/demo.html
Prices and features were read on each company’s own website in November 2026. They change often, so confirm the current offer on the official site before you sign up or buy.