Citadel Security Software Announces General Availability of Hercules 2.0.

Business Editors/High-Tech Writers

DALLAS--(BUSINESS WIRE)--May 20, 2003

Industry's First Vulnerability Remediation Product Extends Power

across Microsoft Windows, Sun Solaris and Red Hat Linux 

Platforms to Resolve All Classes of Vulnerabilities

Citadel Security Software, Inc. (OTCBB:CDSS), a leader in automated vulnerability remediation (AVR) and policy compliance solutions, today announced the general availability of Hercules 2.0. As the first and only automated vulnerability remediation solution available to resolve all five classes of vulnerabilities, Hercules 2.0 provides users with the control, flexibility and scalability needed to quickly and effectively resolve vulnerabilities within an enterprise network across major platforms including Microsoft Windows, Sun Solaris and Red Hat Linux.

"We installed Hercules 2.0 and quickly imported the data from our scanners and then selected several vulnerabilities to remediate. Hercules quietly and quickly went about the business of automatic vulnerability remediation -- immediately applying remediation signatures to the selected clients and devices," said Scott Millis, CTO of Trinity. "With cross-platform functionality and the ability to run the Hercules administrator remotely, our initial testing with the product demonstrated that managing a larger network with many more machines would be just as easy; we are looking forward to the full deployment of Hercules."

"Most companies found remediating vulnerabilities a daunting task in the past and the future holds a significant increase in not only the volume of vulnerabilities, but also the complexity of vulnerabilities," said Diana Kelley of Baroudi Group. "Security administrators are throwing their hands up in frustration because they know that manual remediation is too time consuming and not efficient. In order to keep up with the constant flood of patches, many companies save resources by delaying patch application or patching only the most significant vulnerabilities. Unfortunately this can lead to windows of security vulnerability on un-patched systems. Automating the process intelligently provides a way to address the problem and reduce risk."

In today's enterprise, security administrators are facing an increasing number of vulnerabilities; in 2002 there were over 4,000 new vulnerabilities reported (CERT(R)/CC Statistics). According to a sampling of Citadel customers and prospects, software defects account for approximately 20% of the identified vulnerabilities, making applying patches alone an ineffective solution. In addition, manual remediation can take weeks or even months. Hercules 2.0 brings current vulnerability remediation practices to the next level by eliminating the ineffective manual remediation process and giving security administrators the first solution that provides the flexibility and control necessary to resolve all five classes of vulnerabilities including unsecured accounts, unnecessary services, mis-configurations, back doors and software defects, ensuring that their networks and devices are secure.

Hercules 2.0 combines the largest library of remediation signatures across Windows, Sun Solaris and Linux Red Hat platforms, with the best practices for vulnerability remediation ensuring up-to-the-minute protection. Hercules' scalable architecture and interoperability with industry-standard network scanners allows enterprise users to import and aggregate vulnerability assessment data from multiple sources, simplifying the research, review and prioritization process. Instead of manually resolving vulnerabilities one-at-a-time, Hercules allows administrators to customize remediation within individual environments and systematically fix scanner-identified vulnerabilities and rapidly emerging threats such as zero-day exploits.

"With a growing industry concern about loss of data and customer privacy, as well as the emergence of stringent federal regulations, enterprises may be held accountable if they are negligent in remediation," said Steve Solomon, CEO of Citadel. "Despite growing awareness of the potential liability, without an automated remediation system, enterprises simply do not have the resources or a consistent methodology to ensure that their networks are secure. With Hercules, the manual, time-consuming remediation practice is no longer necessary. Citadel is placing a solution in the hands of enterprise users allowing them to efficiently and systematically remediate, ensuring that an effective remediation process is in place across their enterprise."

Pricing and Availability

Hercules 2.0 is available immediately at www.citadel.com. Hercules 2.0 has a starting retail price of $995 per server and $129 per workstation. For more information please call 800/962-0701.

About Citadel

Citadel Security Software, Inc., a leader in automated vulnerability remediation and policy enforcement solutions, helps enterprises effectively neutralize security vulnerabilities. Citadel's patent-pending Hercules(R) technology provides users with full control over the automated remediation process, enabling efficient aggregation, prioritization and resolution of vulnerabilities detected by industry-standard vulnerability assessment tools. Winshield(R), SecurePC(TM) and NetOFF(TM) products enable companies to enforce security policies from a single point of control. Citadel's solutions enable organizations to ensure the confidentiality of information, reduce the time and costs associated with the inefficient manual remediation process, and facilitate compliance with organizational security policies and government mandates such as HIPAA and Gramm-Leach-Bliley legislation. For more information on Citadel, visit www.citadel.com, or contact the company at 214/520-9292.

Safe Harbor/Forward-looking Statements:

Except for the historical information contained herein, this news release contains forward looking statements that are subject to risks and uncertainties, including the current economic and geopolitical environment, information technology spending trends, lack of Citadel operating history, uncertainty of product acceptance, uncertainty of ability to compete effectively in a new market and the uncertainty of profitability and cash flow of Citadel. These risks and uncertainties may cause actual outcomes and results to differ materially from expectations in this press release. These and other risks are detailed in Citadel's reports on Form 10-QSB for the quarter ended March 31, 2003 and Form 10-KSB for the year ended December 31, 2002 on file with the SEC.