BomLens review
A free, local-first tool for generating SBOMs and reviewing supplier risk.
Reviewed by iTechGuides Editors · Editorial team · Updated Nov 2026
BomLens is an open-source supply-chain security tool from SK Telecom for creating software bills of materials and assessing supply-chain risk. It suits teams that need to scan different kinds of inputs, including source folders, GitHub repositories, ZIP archives, container images, binaries, firmware, and existing SBOMs. Its local-first approach makes it relevant to organizations that want to run scans in their own environment rather than use a hosted SaaS service.
The breadth of inputs is a central strength. BomLens generates CycloneDX 1.6 SBOMs and can emit SPDX 2.3 copies with the --spdx option. It can also produce open-source notices and vulnerability and security reports, and assess supplier-provided SBOMs for license and vulnerability risk. A browser-based interface provides live logs and downloadable results; a command-line interface supports CI/CD pipeline integration. These options make it useful both for reviewing individual artifacts and for incorporating SBOM generation into a build process. TRUSCA and Dependency-Track are listed integrations.
BomLens is described as open source under Apache License 2.0, with a free plan. It runs locally using Docker, and desktop installers are available for Windows and macOS. That deployment model favors teams comfortable operating local tooling, but it is not a fit for buyers seeking a hosted SaaS service. Support channels are community and documentation, so organizations that require a different support model should weigh that before adopting it. Choose BomLens when broad input coverage, multiple SBOM formats, and local execution matter; consider an alternative if hosted delivery is a requirement.
BomLens pros and cons
- Where it wins
- Scans source, containers, binaries, firmware, and existing SBOMs
- Generates CycloneDX 1.6 and can emit SPDX 2.3 copies
- Offers browser, CLI, and desktop interfaces for local workflows
- Where it doesn't
- Runs locally with Docker rather than as hosted SaaS
- Desktop installers are available for Windows and macOS only
- Listed support channels are community and documentation
BomLens fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update