CycloneDX

CycloneDX 2.0 Goes Past the SBOM to Threat Models, Agent Behavior and Post-Quantum Crypto: Steve Springett at Global AppSec USA 2026 CycloneDX, the software bill of materials (SBOM) standard behind more than 300 tools, is due for version 2.0 this fall, with Ecma approval expected in December 2026. For eight years, CycloneDX has answered one question about software: what is in it? Regulators, customers or security teams now also ask what software does, what could go wrong, which controls are in place and how anyone can verify it. Version 2.0 moves CycloneDX from a bill of materials to what its maintainers call a Transparency Exchange Language. It links components, threats, risks, controls, behaviors and evidence into one graph, exchanged as a file or through an API. In his Global AppSec USA 2026 project showcase, "CycloneDX 2.0: From SBOMs to Verifiable Assurance", on Friday, November 6 at 10:30 a.m. in Seacliff CD, Steve Springett tours what 2.0 delivers and what is still in development. Speaker: Steve Springett, Creator of OWASP Dependency-Track and Chair of CycloneDX SBOM Core Working Group and Ecma TC54, ServiceNow The session traces the shift from assertions to claims to evidence, showing how 2.0 encodes each step so assurance can be verified. Hardware and material inventories can carry provenance down to the region where each material was mined. Threat models include threat scenarios, attack trees or attack paths across STRIDE, LINDDUN, MAESTRO and MITRE ATT&CK. Weaknesses are recorded as the source of risk. The risk model carries FAIR, the OWASP Risk Rating Methodology, FMEA, NIST SP 800-30 or a custom method without translation. Controls become first-class objects, so GRC teams can prescribe controls as data and publish verified control inventories. Blueprints compare an AI agent's declared behavior with its observed behavior, which exposes shadow AI activity that no inventory can see. The same approach turns a cryptographic inventory into post-quantum readiness, by showing how keys are used and whether algorithms can be swapped. Steve Springett created OWASP Dependency-Track, a platform for tracking vulnerable components across a software portfolio, and he chairs the CycloneDX Core Working Group. He leads the OWASP Software Component Verification Standard and serves on the OWASP Foundation Board. He opened the CycloneDX proposal for threat modeling in May 2024, which became the TM-BOM threat model format. He also speaks regularly on SBOM adoption, including a 66-minute BrightTALK webcast on using the standard. The OWASP announcement of CycloneDX 2.0 lists further additions. VEX data gets an eight-point exploitability scale, while a post-quantum migration program tracks the risk and owner of each crypto asset. Documents can also carry "perspectives" for 82 named domains. Existing 1.x SBOMs stay valid under 2.0. The current release is 1.7, published as the second edition of the ECMA-424 standard in December 2025. CycloneDX Attestations already let organizations publish machine-readable claims, evidence and counter-evidence against a standard. To go deeper on the topic, start here: - Steve Springett: Understanding and Using the CycloneDX SBOM Standard (BrightTALK, 66 min) - Application Security Weekly: The Future of CycloneDX and Software Transparency with Steve Springett - CycloneDX 2.0 announcement - CycloneDX Attestations (CDXA) - CycloneDX Transparency Exchange API (TEA) repository Teams that already produce SBOMs for compliance will see what else the format can carry once 2.0 ships. Beyond a component list, what would your customers or auditors want to see in machine-readable form?

Can One Format Carry Every Threat Model? Steve Springett and Petra Vukmirovic at Global AppSec USA 2026 Steve Springett opened the CycloneDX proposal that became TM-BOM in May 2024, and Petra Vukmirovic co-leads the OWASP Threat Model Library, whose data has to fit inside that format. TM-BOM, the Threat Model Bill of Materials in CycloneDX 2.0, aims to make threat models portable between tools. Ecma TC54, the standards committee that maintains CycloneDX, accepted the feature in August 2026. The OWASP Threat Model Library is a peer-reviewed, open dataset of structured threat models with its own JSON schema. Its project page plans a new schema version for TM-BOM compatibility. In their Global AppSec USA 2026 debate, "OWASP by Design: Debate/panel for Portable Threat Models", on Thursday, November 5 at 11:00 a.m. in Bayview A, Steve Springett and Petra Vukmirovic discuss portable threat models in a 15-minute session. Speakers: - Steve Springett, Creator of OWASP Dependency-Track and Chair of CycloneDX SBOM Core Working Group and Ecma TC54, ServiceNow - Petra Vukmirovic, Director of Security, AI and Internal Technology, Flagstone The debate follows Vikramaditya Narayan's TM-BOM talk in the same room at 10:15 a.m. Narayan's session covers the format's architecture along with lessons from implementing it in OWASP Precogly. Vukmirovic opened a CycloneDX 2.0 discussion in August 2026 asking where Threat Model Library fields belong in the new format. Those fields include scope, lifecycle, risk matrices and attacker intent. Steve Springett created OWASP Dependency-Track, a platform for tracking vulnerable components across a software portfolio. He chairs the CycloneDX SBOM Core Working Group along with Ecma TC54. He leads the OWASP Software Component Verification Standard and serves on the OWASP Foundation Board of Directors. He also presents "CycloneDX 2.0: From SBOMs to Verifiable Assurance" at the conference. CycloneDX began in 2017 out of an issue in the Dependency-Track repository, then joined OWASP as a Flagship Project in June 2021. It is standardized as ECMA-424. Petra Vukmirovic is Director of Security, AI and Internal Technology at Flagstone. She worked as an emergency medicine doctor before moving into cybersecurity, starting as an intern at Glasswall. At Glasswall she helped develop machine learning capabilities behind a patent for using content disarm and reconstruction to detect unknown malware. She later served as Director of Cyber Security at Jobandtalent and Head of Information Security at Numan. She co-leads the OWASP Threat Model Library with Julian Mehnle. She is also an Advisor at DevArmor, which works on automated threat modeling. She leads the conference's opening debate on whether vulnerability auto-remediation breaks "you build it, you own it." She also presents "Modelling for Agentic Failure; when attack trees meet safety engineering." To go deeper on the topic, start here: - The Security Table podcast with Petra Vukmirovic: Building the World's Largest Threat Model Library - CycloneDX issue #462: TM-BOM proposal - CycloneDX discussion #1039: mapping the Threat Model Library into CycloneDX 2.0 - OWASP Threat Model Library - CycloneDX v2.0 Coming Soon Threat modelers deciding whether to adopt TM-BOM, or to wait for tool support, can hear directly from the people shaping the format. Would your team adopt a standard threat model format if your current tool could not export to it?

Breaking Threat Models Out of Their Tools With CycloneDX 2.0's TM-BOM: Vikramaditya Narayan at Global AppSec USA 2026 CycloneDX 2.0 adds TM-BOM, a Threat Model Bill of Materials format that lets a threat model move between tools, live in Git and run through CI/CD like any other build artifact. A threat model maps how a system could be attacked and which controls address each threat. Most of them go stale soon after they are drawn, because they stay locked inside the tool that produced them. Developers who lack that tool never open the model, while compliance teams cannot reuse it elsewhere. The result is a static diagram that nobody can share, diff or wire into an engineering workflow. TM-BOM is a tool-neutral, machine-readable format for those models. It lets teams exchange threat models with customers, auditors or regulators, and it lets AI agents generate or consume them while the output stays readable by a human reviewer. In his Global AppSec USA 2026 talk, "Portable Threat Models: TM-BOM as a Lingua Franca for Threat Modeling", on Thursday, November 5 at 10:15 a.m. in Bayview A, Vikramaditya Narayan walks through the format's architecture and what it takes to adopt. Speaker: Vikramaditya Narayan, Creator of OWASP Precogly The core of the session is how TM-BOM keeps three kinds of threat modeling concepts in separate layers rather than forcing them into one abstraction. Process methodologies such as PASTA record how a model was produced. Classification frameworks such as STRIDE, LINDDUN, MAESTRO or MITRE ATT&CK categorize threats, and a single threat can carry several classifications at once. Attack trees and kill chains are first-class structures in the format, with their own internal relationships. They are not reduced to labels attached to a threat. Narayan implemented TM-BOM import and export in OWASP Precogly while the specification was still being written. The talk covers where real threat modeling concepts resist the schema, along with the practical trade-offs of adopting it. Vikramaditya Narayan created OWASP Precogly, an open-source threat modeling platform that pairs human judgment with AI. Precogly has a data flow diagram editor with trust zones, threat libraries linked to MITRE ATT&CK, CAPEC, LINDDUN or STRIDE, and a REST API meant as a base for AI threat modeling assistants. He leads the Bangalore chapter of Threat Modeling Connect. He says conversations with more than 100 AppSec leaders shaped how Precogly splits work between people and AI. He has presented at ThreatModCon, OWASP events and VulnCon, including a ThreatModCon DC talk on risks that emerge in multi-agent systems. He holds an MS from Carnegie Mellon and is a Certified Threat Modeling Professional. He also runs two Precogly sessions at the conference: a project talk and a live demo. A 15-minute debate on portable threat models with Steve Springett and Petra Vukmirovic follows this talk in the same room at 11:00 a.m. Steve Springett opened the original CycloneDX proposal for threat model support in May 2024. It went to public comment in July 2026, Ecma TC54 accepted it, and it closed as completed on August 20, 2026. CycloneDX PR #678 adds the threat schema to version 2.0. The CycloneDX 2.0 announcement describes threat models as standalone documents covering zones, trust boundaries, data flows, inherent or residual risk and controls kept separate from threats. To go deeper on the topic, start here: - CycloneDX v2.0 Coming Soon (threat modeling section) - CycloneDX issue #462: TM-BOM proposal and RFC history - CycloneDX PR #678: threat modeling schema for 2.0 - OWASP Precogly project page - Precogly GitHub repository Threat modelers whose diagrams never leave the tool that drew them will see what a portable, version-controlled model looks like. Where do your threat models live today, and who besides the security team ever opens them?