Citadel Invites Software Manufacturers to Step Up to the Challenge and Identify the ''Best of the Best'' Enterprise Vulnerability Management Capabilities.

DALLAS -- $100,000 Prize to be Awarded to Heavyweight Champion; Contenders Will Be Judged by Independent Test Lab

Citadel Security Software Inc. (Nasdaq:CDSS), a leader in enterprise vulnerability management and policy enforcement through its automated vulnerability remediation (AVR) solution, Hercules(R), today sent letters challenging software manufacturers providing software for automating the resolution of security vulnerabilities to defend their product claims of enterprise vulnerability management in a fair fight. Citadel is offering $100,000 to the company participating in the challenge that offers the best product with the highest score that meets a defined set of Enterprise Vulnerability Management (EVM) criteria as evaluated by an independent test lab.

To capitalize on the daily bombardment of vulnerabilities continually degrading organizations' security posture, a myriad of software vendors have begun to claim "vulnerability remediation" capabilities to address this critical security need. While the phrase "vulnerability remediation" is in wide use, it is still largely undefined and as a result, many enterprises remain confused about how to best mitigate vulnerabilities before they are exploited by rapidly spreading threats. The letters sent by Citadel invited vendors to have their products tested by an independent test lab following defined test criteria. This independent testing will clarify the requirements for enterprise vulnerability management and enable enterprises to easily select the best vendor.

"As a pioneer of automated vulnerability remediation, we believe that we are the reigning champion of enterprise vulnerability management and we challenge our competitors to put their products to the test," said Citadel Executive Vice President of Marketing, Mike Jones. "The goal of this challenge is to demonstrate real substance over marketing spin about enterprise vulnerability management solutions and insist that products perform as marketed. At the conclusion of this test, enterprises will have a better understanding of how to select the best solution for comprehensive risk mitigation of network vulnerabilities. We believe we will remain undefeated, and are happy to put our money where our mouth is."

Requirements for Enterprise Vulnerability Management

Challenge participants will be tested on the following critical risk mitigation criteria by an independent test lab in January 2005. For each invited participant, the test lab expenses will be paid by Citadel. For further details on The Citadel Challenge, including a white paper on Enterprise Vulnerability Management, EVM product requirements and other Challenge details, visit www.citadel.com/100Kchallenge.

Remediate All Classes of Vulnerabilities -- Today corporate networks are plagued with software defects that require patching, as well as many other types of vulnerabilities such as misconfigurations and unnecessary services. For comprehensive protection, an enterprise vulnerability management solution must address all classes of vulnerabilities.

Remediation Library -- With so many new vulnerabilities being discovered every day, remedies must be available on a timely basis. An enterprise vulnerability management solution must provide a comprehensive library of proven and tested remedies, with support from a team of security experts continually writing and distributing new remedies.

Support an Enterprise Environment -- With enterprises containing mixed environments and vulnerabilities pervasive in all operating systems, it is critical to support Unix, Linux as well as Windows operating systems.

Set and Enforce IT Security Policy -- As systems tend to shift in and out of compliance, an enterprise vulnerability management solution must be able to assess the security state of devices and keep them in line with corporate security policies.

Rapid Mitigation -- The fear of zero-day exploits is exploding with new threats quickly entering the enterprise often before they have been identified. A true EVM solution must provide capabilities for rapid respond to breaking threats and automate the remediation process.

Endpoint Security -- Enterprises suffer when remote employees reconnect to the network, bringing with them viruses, worms, spyware and other cyber security issues. Organizations must have the ability to check each device's security state, quarantine if necessary and bring the device back into a secure state with minimal impact to the end-user.

Bridge Organizational Boundaries -- With both Security and IT Operations responsible for IT risk management, an EVM solution must provide a working platform to integrate with multiple vulnerability assessment security tools to seamlessly prioritize, test, audit and apply fixes to reduce risk and comply with internal and external mandates.

Asset Discovery and Classification -- Many organizations are unaware of their inventory let alone the risk of each asset. An EVM solution should search inventory information to determine exposure and classify assets for prioritization of threats.

Vendors not invited to participate may request participation by sending email to [e-mail].

About Citadel

Citadel Security Software Inc., a leader in enterprise vulnerability management solutions powered by AVR technology, helps enterprises effectively neutralize security vulnerabilities. Citadel's patent-pending, Common Criteria EAL 3 certified Hercules(R) technology provides users with full control over the automated remediation process, enabling efficient aggregation, prioritization and resolution of vulnerabilities detected by industry-standard vulnerability assessment tools. SecurePC(TM) and NetOFF(TM) products enable companies to enforce security policies from a single point of control. Citadel's solutions enable organizations to ensure the confidentiality of information, reduce the time and costs associated with the inefficient manual remediation process, and facilitate compliance with organizational security policies and government mandates such as FISMA, HIPAA and Gramm-Leach-Bliley legislation. For more information on Citadel, visit www.citadel.com, or contact the company at [phone].

Safe Harbor/Forward-looking Statements:

This press release may contain forward-looking statements that are intended to be subject to the safe harbor protection provided by Section 27A of the Securities Act of 1933 and Section 21E of the Securities Exchange Act of 1934. These statements relate to future events or future financial performance and involve known and unknown risks and uncertainties that may cause actual results or performance to be materially different from those indicated by any forward-looking statements. In some cases, you can identify forward-looking statements by terminology such as "forecast," "may," "will," "could," "should," "anticipate," "expect," "plan," "believe," "potential" or other similar words indicating future events or contingencies. Some of the things that could cause actual results to differ from expectations are: revenue recognition policies that may delay recognition of revenues; the ability of government entities to terminate licenses of our products for convenience; the current economic and geopolitical environment; current information technology spending trends; the uncertainty of funding of government information technology security projects; a lack of Citadel operating history; uncertainty of product acceptance; uncertainty of ability to compete effectively in a new market; the uncertainty of profitability and cash flow of Citadel; intellectual property rights and dependence on key personnel; economic conditions; the continued impact of terrorist attacks, global instability and potential U.S. military involvement; the competitive environment and other trends in the company's industry; changes in laws and regulations; changes in the company's business plans; interest rates and the availability of financing; liability and other claims asserted against the company; labor disputes; the company's ability to attract and retain qualified personnel; and inflation. For a discussion of these and other risk factors, see the company's Annual Report on Form 10-KSB for the year ended December 31, 2003 and its Quarterly Report on Form 10-QSB for the quarter ended September 30, 2004. All of the forward-looking statements are qualified in their entirety by reference to the risk factors discussed therein. These risk factors may not be exhaustive. The company operates in a continually changing business environment, and new risk factors emerge from time to time. Management cannot predict such new risk factors, nor can it assess the impact, if any, of such new risk factors on the company's business or events described in any forward-looking statements. The company disclaims any obligation to publicly update or revise any forward-looking statements after the date of this report to conform them to actual results.

Editors Note: Citadel is a trademark and Hercules is a registered trademark of Citadel Security Software.