CBOM excerpt — CycloneDX 1.7
Machine-readable inventory: every algorithm bound to where it was seen negotiating, scored with its NIST quantum security level, dependencies mapped.
{
"bomFormat": "CycloneDX",
"specVersion": "1.7",
"serialNumber": "urn:uuid:████",
"version": 4,
"metadata": {
"timestamp": "2026-07-14T02:11:09Z",
"component": { "type": "application",
"name": "core-banking-gw" }
},
"components": [
{ "type": "cryptographic-asset",
"name": "TLS1.2 · RSA-2048 · AES-128-CBC",
"cryptoProperties": {
"assetType": "protocol",
"protocolProperties": { "type": "tls" },
"nistQuantumSecurityLevel": 0 },
"evidence": { "occurrences": [
{ "location": "10.█.█.█:443" },
{ "location": "10.█.█.█:8443" } ] } },
{ "type": "cryptographic-asset",
"name": "SSH · sntrup761x25519",
"cryptoProperties": {
"assetType": "algorithm",
"algorithmProperties": {
"primitive": "kem" },
"nistQuantumSecurityLevel": 3 } }
],
"dependencies": [
{ "ref": "svc-payments",
"dependsOn": [ "TLS1.2 · RSA-2048" ] } ]
}