Citadel Security's Hercules Sets the Standard for Multibillion Dollar Automated Vulnerability Remediation Market Category.

Business Editors/High-Tech Writers

DALLAS--(BUSINESS WIRE)--Dec. 9, 2002

Category Validated by Aberdeen Group Provides Solution to Problem

Claiming in Excess of $2 Billion in IT Operational Expense Annually

In the November 2002 white paper released today, Aberdeen names Citadel Security Software Inc. (OTCBB:CDSS) as the first and only supplier to deliver an open and extensible automated vulnerability remediation solution. "Automated Vulnerability Remediation--the Cure for Security's Common Cold" identifies a costly problem for IT organizations today: the inability to fix the overwhelming number of security vulnerabilities in a timely fashion. Worldwide, enterprises currently spend in excess of $2 billion annually just for the deployment of security patches, representing a fraction of the vulnerabilities facing the enterprise. The paper identifies products in the Automated Vulnerability Remediation (AVR) category that are the first to enable IT managers to actually resolve the thousands of vulnerabilities identified by assessment tools, and provide an efficient and effective answer to a multibillion dollar problem.

"Using manual approaches to deal with the growing number of IT security vulnerabilities is a recipe for disaster for all but the smallest organizations," said Eric Hemmendinger, research director for security and privacy at Aberdeen Group. "Automated vulnerability remediation is the only way to close the resulting windows of vulnerability quickly enough to protect the enterprise. Citadel's Hercules is a stellar example of a comprehensive, automated vulnerability remediation solution that provides flexibility for IT administrators through the use of flexible automation instead of brute force automation."

Vulnerability remediation is not limited to installing patches, but rather encompasses the entire scope of IT vulnerabilities, including software defects, insecure user accounts, unnecessary services such as telnet, backdoors such as BackOrifice and SubSeven, as well as misconfigurations.

Organizations have invested heavily in assessment tools that identify vulnerabilities across their networks. However, with the number of vulnerabilities growing exponentially each year, administrators do not have the time or resources to resolve the excess of vulnerabilities as soon as they are identified, let alone on a routine basis for ongoing security.

In the paper, Aberdeen recommends the following best practices for achieving comprehensive security:

-- Find the vulnerabilities,

-- Assess the exposure caused by the vulnerabilities,

-- Prioritize the response to the vulnerabilities,

-- Remediate the vulnerabilities, and,

-- Repeat regularly.

Executed manually, this process is impractical. Citadel raises the bar on security best practices, providing users with the technology to assess and remediate vulnerabilities quickly and effectively. For the full Executive White Paper report, visit www.citadel.com/aberdeen.

"This report validates our assessment of the market opportunity for Hercules as the only viable technology that meets all the needs of enterprise users, government agencies and healthcare organizations who have no choice but to automate their vulnerability remediation processes," said Steve Solomon, CEO of Citadel. "Hercules users will realize immediate time and cost savings as they integrate our automated vulnerability remediation technology into their best practices for taking action on security vulnerabilities. Citadel is well positioned to lead adoption of this new class of security products and spearhead the growth of this multibillion dollar market."

Citadel's patent-pending Hercules technology provides users with full control over the automated remediation process, enabling efficient aggregation, prioritization and trusted resolution of vulnerabilities. Interoperable with industry-standard scanners such as eEye Digital Security (Retina Scanner), Harris Corporation (STAT Scanner), Internet Security Systems (Internet and Systems Scanners), Microsoft, Nessus, Network Associates (CyberCop Scanner), and Qualys (QualysGuard), Hercules remediates all classes of security vulnerabilities, from internal policy breaches to software defects and external perimeter threats.

About Citadel

Citadel Security Software Inc. (OTCBB:CDSS) develops, markets and licenses computer security and privacy software for one of the fastest growing software industry segments today--security inside the firewall. Citadel's Winshield(R) SecurePC(TM) and NetOFF(TM) products enable companies to enforce security policies from a single point of control. Citadel's Hercules' product remediates vulnerabilities from the five classes of security vulnerabilities: insecure accounts, unnecessary services, mis-configurations, back doors and software defects. Hercules' open architecture design allows the import and aggregation of assessment data from many sources. Hercules is interoperable with industry leading vulnerability assessment tools, allowing customers to address the real world issues of vulnerability assessment and remediation. Citadel's products also address the initiatives of the President's National Strategy to Secure Cyberspace and the mandates of HIPAA and Gramm-Leach-Bliley legislation for the healthcare and financial industries. Further information about Citadel Security Software and its products can be accessed at its website, www.citadel.com.

Safe Harbor/Forward-looking Statements:

Except for the historical information contained herein, this news release contains forward-looking statements that are subject to risks and uncertainties, including lack of Citadel operating history, uncertainty of product acceptance, uncertainty to compete effectively in a new market category and the uncertainty of profitability and cash flow of Citadel. These risks and uncertainties may cause actual outcomes and results to differ materially from expectations in this press release. The research performed by Aberdeen was underwritten by Citadel. These and other risks are detailed from time to time in CT Holdings' and Citadel's SEC reports, including CT's report on Form 1O-KSB for the year ended December 31, 2001 and most recent Form 10-QSBs, as well as Citadel's Registration Statement on Form 10-SB and amendments and most recent Form 10-QSBs.