CycloneDX 2.0 Goes Past the SBOM to Threat Models, Agent Behavior and Post-Quantum Crypto: Steve Springett at Global AppSec USA 2026
CycloneDX, the software bill of materials (SBOM) standard behind more than 300 tools, is due for version 2.0 this fall, with Ecma approval expected in December 2026.
For eight years, CycloneDX has answered one question about software: what is in it? Regulators, customers or security teams now also ask what software does, what could go wrong, which controls are in place and how anyone can verify it.
Version 2.0 moves CycloneDX from a bill of materials to what its maintainers call a Transparency Exchange Language. It links components, threats, risks, controls, behaviors and evidence into one graph, exchanged as a file or through an API.
In his Global AppSec USA 2026 project showcase, "CycloneDX 2.0: From SBOMs to Verifiable Assurance", on Friday, November 6 at 10:30 a.m. in Seacliff CD, Steve Springett tours what 2.0 delivers and what is still in development.
Speaker: Steve Springett, Creator of OWASP Dependency-Track and Chair of CycloneDX SBOM Core Working Group and Ecma TC54, ServiceNow
The session traces the shift from assertions to claims to evidence, showing how 2.0 encodes each step so assurance can be verified. Hardware and material inventories can carry provenance down to the region where each material was mined.
Threat models include threat scenarios, attack trees or attack paths across STRIDE, LINDDUN, MAESTRO and MITRE ATT&CK. Weaknesses are recorded as the source of risk.
The risk model carries FAIR, the OWASP Risk Rating Methodology, FMEA, NIST SP 800-30 or a custom method without translation. Controls become first-class objects, so GRC teams can prescribe controls as data and publish verified control inventories.
Blueprints compare an AI agent's declared behavior with its observed behavior, which exposes shadow AI activity that no inventory can see. The same approach turns a cryptographic inventory into post-quantum readiness, by showing how keys are used and whether algorithms can be swapped.
Steve Springett created OWASP Dependency-Track, a platform for tracking vulnerable components across a software portfolio, and he chairs the CycloneDX Core Working Group. He leads the OWASP Software Component Verification Standard and serves on the OWASP Foundation Board.
He opened the CycloneDX proposal for threat modeling in May 2024, which became the TM-BOM threat model format. He also speaks regularly on SBOM adoption, including a 66-minute BrightTALK webcast on using the standard.
The OWASP announcement of CycloneDX 2.0 lists further additions. VEX data gets an eight-point exploitability scale, while a post-quantum migration program tracks the risk and owner of each crypto asset. Documents can also carry "perspectives" for 82 named domains.
Existing 1.x SBOMs stay valid under 2.0. The current release is 1.7, published as the second edition of the ECMA-424 standard in December 2025.
CycloneDX Attestations already let organizations publish machine-readable claims, evidence and counter-evidence against a standard.
To go deeper on the topic, start here:
- Steve Springett: Understanding and Using the CycloneDX SBOM Standard (BrightTALK, 66 min)
- Application Security Weekly: The Future of CycloneDX and Software Transparency with Steve Springett
- CycloneDX 2.0 announcement
- CycloneDX Attestations (CDXA)
- CycloneDX Transparency Exchange API (TEA) repository
Teams that already produce SBOMs for compliance will see what else the format can carry once 2.0 ships.
Beyond a component list, what would your customers or auditors want to see in machine-readable form?
2 points · 1 comment
Mentions
CycloneDX 2.0 Goes Past the SBOM to Threat Models, Agent Behavior and Post-Quantum Crypto: Steve Springett at Global AppSec USA 2026 CycloneDX, the software bill of materials (SBOM) standard behind more than 300 tools, is due for version 2.0 this fall, with Ecma approval expected in December 2026. For eight years, CycloneDX has answered one question about software: what is in it? Regulators, customers or security teams now also ask what software does, what could go wrong, which controls are in place and how anyone can verify it. Version 2.0 moves CycloneDX from a bill of materials to what its maintainers call a Transparency Exchange Language. It links components, threats, risks, controls, behaviors and evidence into one graph, exchanged as a file or through an API. In his Global AppSec USA 2026 project showcase, "CycloneDX 2.0: From SBOMs to Verifiable Assurance", on Friday, November 6 at 10:30 a.m. in Seacliff CD, Steve Springett tours what 2.0 delivers and what is still in development. Speaker: Steve Springett, Creator of OWASP Dependency-Track and Chair of CycloneDX SBOM Core Working Group and Ecma TC54, ServiceNow The session traces the shift from assertions to claims to evidence, showing how 2.0 encodes each step so assurance can be verified. Hardware and material inventories can carry provenance down to the region where each material was mined. Threat models include threat scenarios, attack trees or attack paths across STRIDE, LINDDUN, MAESTRO and MITRE ATT&CK. Weaknesses are recorded as the source of risk. The risk model carries FAIR, the OWASP Risk Rating Methodology, FMEA, NIST SP 800-30 or a custom method without translation. Controls become first-class objects, so GRC teams can prescribe controls as data and publish verified control inventories. Blueprints compare an AI agent's declared behavior with its observed behavior, which exposes shadow AI activity that no inventory can see. The same approach turns a cryptographic inventory into post-quantum readiness, by showing how keys are used and whether algorithms can be swapped. Steve Springett created OWASP Dependency-Track, a platform for tracking vulnerable components across a software portfolio, and he chairs the CycloneDX Core Working Group. He leads the OWASP Software Component Verification Standard and serves on the OWASP Foundation Board. He opened the CycloneDX proposal for threat modeling in May 2024, which became the TM-BOM threat model format. He also speaks regularly on SBOM adoption, including a 66-minute BrightTALK webcast on using the standard. The OWASP announcement of CycloneDX 2.0 lists further additions. VEX data gets an eight-point exploitability scale, while a post-quantum migration program tracks the risk and owner of each crypto asset. Documents can also carry "perspectives" for 82 named domains. Existing 1.x SBOMs stay valid under 2.0. The current release is 1.7, published as the second edition of the ECMA-424 standard in December 2025. CycloneDX Attestations already let organizations publish machine-readable claims, evidence and counter-evidence against a standard. To go deeper on the topic, start here: - Steve Springett: Understanding and Using the CycloneDX SBOM Standard (BrightTALK, 66 min) - Application Security Weekly: The Future of CycloneDX and Software Transparency with Steve Springett - CycloneDX 2.0 announcement - CycloneDX Attestations (CDXA) - CycloneDX Transparency Exchange API (TEA) repository Teams that already produce SBOMs for compliance will see what else the format can carry once 2.0 ships. Beyond a component list, what would your customers or auditors want to see in machine-readable form?