SBOM generation is the process of inspecting a software artifact, container image, or filesystem to create a software bill of materials (SBOM)—a machine-readable inventory of components and related metadata. Tools may identify packages and dependencies, then export the inventory in formats such as CycloneDX or SPDX.
In cybersecurity, an SBOM helps teams determine which software components are present and assess exposure when a vulnerability affects a dependency. Its usefulness depends on scanning the correct build or deployed artifact and linking the result to the relevant release. Generation creates the inventory; it does not by itself keep records updated, manage them over time, or ensure they are used in incident response. Defenders should validate scan coverage and integrate generated SBOMs into their software supply-chain processes.