We use BlackDuck for SBOM at my workplace and let me tell you, the false positives are driving me up a wall. Also, the binary tool seems very primitve (basically just takes a SHA1 hash of all your files and compares them to a database).