CalcEngine All Calculators

SBOM Coverage Calculator

General

Enter your component counts to get a weighted SBOM coverage score in seconds. Built for security engineers, compliance teams, and DevSecOps pipelines.

Last updated: April 2026

This calculator is designed for real-world usage based on typical engineering scenarios and publicly available documentation.

The SBOM coverage calculator measures how complete your software bill of materials is across three dimensions: component documentation, metadata quality, and vulnerability assessment coverage. Security teams use it to quantify SBOM gaps before an audit, compliance review, or customer due diligence request. A high component coverage score means you have captured most of your supply chain, but it does not tell the full story. Entries without license, version, and hash data are functionally useless during an incident — that is why metadata completeness is weighted into the score. VEX (Vulnerability Exploitability eXchange) coverage shows what fraction of your SBOM entries have an explicit vulnerability status, a requirement under CRA, NTIA, and NIST SSDF frameworks. The weighted score (60% component coverage, 25% metadata completeness, 15% VEX coverage) reflects industry prioritisation: getting components into the SBOM is the hardest step and drives the most value. Use the breakdown to identify your biggest gap and target tooling investment accordingly. Most organisations start below 60% on their first SBOM audit. Scores above 80% are considered strong for complex polyglot codebases. Perfect 100% coverage is rare but achievable with automated SBOM generation integrated into CI/CD.

How to Calculate SBOM Coverage Score

SBOM Coverage — how it works diagram

1. Count your total known components — all direct and transitive dependencies across all repos and container images in scope. 2. Count how many of those components appear in your SBOM. This is your component coverage numerator. 3. Of the documented components, count those with complete metadata: a known license, pinned version, and cryptographic hash. 4. Of the documented components, count those with a VEX statement — either known-not-affected, fixed, or under-investigation status. 5. The calculator applies the weighted formula: Coverage (60%) + Metadata (25%) + VEX (15%) to produce your overall SBOM score.

Formula

Component Coverage    = (SBOM Documented ÷ Total Components) × 100
Metadata Completeness = (Complete Metadata ÷ SBOM Documented) × 100
VEX Coverage          = (VEX Assessed ÷ SBOM Documented) × 100

SBOM Score = (Component Coverage × 0.60)
           + (Metadata Completeness × 0.25)
           + (VEX Coverage × 0.15)

SBOM Documented   — components captured in your SBOM out of all known components
Complete Metadata — SBOM entries with license, pinned version, and cryptographic hash
VEX Assessed      — SBOM entries with an explicit vulnerability exploitability statement
SBOM Score        — weighted quality score from 0–100

Example SBOM Coverage Calculations

Example 1 — Mid-size SaaS product, first SBOM audit

Total components: 200   SBOM documented: 160   Complete metadata: 120   VEX assessed: 80

Component Coverage    = 160 ÷ 200 × 100 = 80.0%
Metadata Completeness = 120 ÷ 160 × 100 = 75.0%
VEX Coverage          =  80 ÷ 160 × 100 = 50.0%

SBOM Score = (80.0 × 0.60) + (75.0 × 0.25) + (50.0 × 0.15)
           = 48.0 + 18.75 + 7.5 = 74.3%

Example 2 — Mature DevSecOps pipeline with automated SBOM generation

Total components: 500   SBOM documented: 490   Complete metadata: 460   VEX assessed: 420

Component Coverage    = 490 ÷ 500 × 100 = 98.0%
Metadata Completeness = 460 ÷ 490 × 100 = 93.9%
VEX Coverage          = 420 ÷ 490 × 100 = 85.7%

SBOM Score = (98.0 × 0.60) + (93.9 × 0.25) + (85.7 × 0.15)
           = 58.8 + 23.5 + 12.9 = 95.1%

Example 3 — Legacy monolith, partial inventory

Total components: 350   SBOM documented: 175   Complete metadata: 105   VEX assessed: 35

Component Coverage    = 175 ÷ 350 × 100 = 50.0%
Metadata Completeness = 105 ÷ 175 × 100 = 60.0%
VEX Coverage          =  35 ÷ 175 × 100 = 20.0%

SBOM Score = (50.0 × 0.60) + (60.0 × 0.25) + (20.0 × 0.15)
           = 30.0 + 15.0 + 3.0 = 48.0%
Action: prioritise automated dependency scanning to close the 50% component gap first.

Tips to Improve Your SBOM Coverage Score

Notes

Frequently Asked Questions

What is a good SBOM coverage score? +
Scores above 80% are considered strong for complex, polyglot codebases. Most organisations score between 50–70% on their first automated audit. Scores above 90% typically require CI/CD-integrated SBOM generation with automated VEX tooling. Regulated sectors (medical devices, critical infrastructure) should target 90%+ to satisfy CRA and NTIA minimum element requirements.
What does SBOM coverage measure exactly? +
SBOM coverage measures how completely your software bill of materials documents your actual supply chain. It has three dimensions: what fraction of known components are listed (component coverage), how many listed components have full metadata — license, version, hash — and how many have a vulnerability exploitability statement (VEX). This calculator combines all three into a single weighted score.
Why is component coverage weighted more than metadata and VEX? +
You cannot improve metadata or VEX data for components you have not documented yet — component coverage is the prerequisite for everything else, which is why it carries 60% of the score. Metadata completeness gets 25% because license and version data is required by most regulatory frameworks. VEX gets 15% — valuable but typically the last thing organisations automate. If you use the CVE Exposure Calculator, good VEX coverage is needed for accurate results.
How do I count total known components for my SBOM? +
Run a dependency scanner (Syft, Trivy, OWASP Dependency-Check) across all source repos, container images, and build artefacts. The union of unique package identifiers — name, version, and ecosystem — is your total. Include both direct and transitive dependencies; transitive deps account for 80%+ of real-world vulnerability exposure. Cross-check against your Patch SLA Calculator to prioritise remediation of documented CVEs.
What is VEX and why does it matter for SBOM coverage? +
VEX (Vulnerability Exploitability eXchange) is a structured statement that says whether a known vulnerability actually affects your product. Without VEX, every CVE scanner match is a false positive until manually triaged. Adding VEX statements to your SBOM turns it from a static inventory into an active risk document. CISA, NTIA, and the EU Cyber Resilience Act all reference VEX as a key SBOM quality enhancement.