Citadel Partners with Foundstone to Provide More Comprehensive Enterprise-Wide Security Solution Including Automated Vulnerability Remediation.

Business Editors/High-Tech Writers

DALLAS--(BUSINESS WIRE)--June 2, 2003

Interoperability with Foundstone Enterprise Security Software

Grows Citadel's Market Opportunity and Offers Customers

Asset-Centric Protection

Citadel Security Software, Inc. (OTCBB:CDSS), a leader in automated vulnerability remediation (AVR) and policy compliance solutions, today announced a partnership with Foundstone, experts in strategic security, that enables interoperability between Foundstone Enterprise security software and Citadel's Hercules automated vulnerability remediation (AVR) solution.

The combination provides a scalable, flexible and comprehensive enterprise risk security solution from vulnerability discovery through remediation, helping government agencies and corporations in a variety of industries to become compliant with organizational security policies and government mandates in just days. The combined security solution also leverages existing security investments and human capital by proactively managing network vulnerabilities, correlating threats, fully automating the remediation process, and enabling all levels of security professionals to check the status of their network security health in real-time.

Foundstone Enterprise is the only closed loop, true enterprise-class security system engineered to mitigate the business risks associated with digital vulnerabilities through proactive asset discovery, inventory and prioritization; threat intelligence and correlation, and remediation tracking and reporting. Hercules, the first automated vulnerability remediation tool, can import the vulnerability data discovered by Foundstone Enterprise's award-winning FoundScan Engine and automatically resolve the vulnerabilities discovered.

According to the CERT Coordination Center, part of Carnegie Mellon's Software Engineering Institute, more than 95 percent of intrusions resulted from exploitation of known vulnerabilities or configuration errors where countermeasures were available. Citadel estimates that 6-10 new vulnerabilities are discovered every day. According to Foundstone, large organizations, with their urban sprawl of networks, can face hundreds or thousands of fixes daily, making manual remediation highly impractical.

"We recognize that our Fortune 1000 and U.S. government customers have the heaviest vulnerability remediation workloads, and they are looking for enterprise-class security solutions that help drive efficiency and reduce the level of risk," said Stuart McClure, president/CTO of Foundstone, a leading provider of enterprise risk security software, hardware and education. "The interoperability of Citadel's Hercules AVR with Foundstone Enterprise security software gives companies a greater opportunity to reduce their risk and rapidly become compliant cost-effectively, strategically and more efficiently by building in as much automation as possible to proactively protect the most critical assets enterprise-wide."

With Hercules, security professionals have the control, flexibility and scalability needed to quickly and effectively prioritize, and fully automate and resolve all five classes of vulnerabilities within an enterprise network -- software defects, unnecessary services, unsecure accounts, backdoors, and misconfigurations. Automating remediation further reduces the time from discovery to remediation and increases the number of critical fixes possible -- beginning with the most important assets. Additionally, Hercules facilitates compliance with organizational security policies and even government mandates such as the Health Insurance Portability and Accountability Act (HIPAA), Gramm-Leach-Bliley Act, Sarbanes-Oxley Act, and The National Strategy to Secure Cyberspace.

Additionally, with Foundstone Enterprise's Security Factors, companies can track and measure network security improvements across the enterprise in real-time, compare them to external industry standards and weigh potential results of security decisions, enabling security professionals to quantify the return on their security investments.

"Partnering with Foundstone builds on our corporate strategy of providing our enterprise and government customers with flexible and customizable security solutions that give them the control to proactively manage the vulnerability remediation process," said Citadel CEO Steve Solomon. "Foundstone's highly regarded pool of security talent, knowledge and experience in prioritizing digital vulnerabilities complements our focus of helping organizations reduce risk by proactively resolving identified vulnerabilities before they are exploited."

With the largest library of remediation signatures across Windows, Sun Solaris, and Linux platforms, Hercules combines flexible automation with remediation best practices to ensure up-to-the-minute protection. Hercules' scalable architecture allows enterprise users to maximize current security investments and IT resources.

About Foundstone

Foundstone(R) Inc., experts in strategic security, offers a unique combination of software, services, and education to help organizations continuously and measurably protect the most important assets from the most critical threats. Through a strategic approach to security, Foundstone identifies and implements the right balance of technology, people, and process to manage digital risk and leverage security investments more effectively. The company has one of the most dominant security talent pools ever assembled, and has authored ten books, including the best-seller Hacking Exposed. Foundstone is headquartered in Orange County, CA, and has offices in New York, Washington, D.C., and Seattle. For more information about Foundstone, visit www.foundstone.com, or call 877.91.FOUND within the U.S., and 949.297.5600 outside the U.S.

About Citadel

Citadel Security Software, Inc., a leader in automated vulnerability remediation and policy enforcement solutions, helps enterprises effectively neutralize security vulnerabilities. Citadel's patent-pending Hercules(R) technology provides users with full control over the automated remediation process, enabling efficient aggregation, prioritization and resolution of vulnerabilities detected by industry-standard vulnerability assessment tools. Winshield(R) SecurePC(TM) and NetOFF(TM) products enable companies to enforce security policies from a single point of control. Citadel's solutions enable organizations to ensure the confidentiality of information, reduce the time and costs associated with the inefficient manual remediation process, and facilitate compliance with organizational security policies and government mandates such as HIPAA and Gramm-Leach-Bliley legislation. For more information on Citadel, visit www.citadel.com, or contact the company at [phone].

Except for the historical information contained herein, this press release contains forward looking statements that are subject to risks and uncertainties, including the current economic and geopolitical environment, information technology spending trends, lack of Citadel operating history, uncertainty of product acceptance, uncertainty of ability to compete effectively in a new market and the uncertainty of profitability and cash flow of Citadel. These risks and uncertainties may cause actual outcomes and results to differ materially from expectations in this presentation. These and other risks are detailed in Citadel's current report on Form 10-QSB for the quarter ended March 31, 2003 and on Form 10-KSB for the year ended December 31, 2002 on file with the SEC.

Editors Note: Citadel is a trademark and Hercules is a registered trademark of Citadel Security Software. Foundstone, Enterprise, FoundScan Engine and Security Factors are trademarks of Foundstone.