Citadel Security Software Inc. Reports Preliminary Third Quarter Results; Record Revenue Expected to Be between $7.4 and $7.8 Million; Expects to Report Quarterly Net Income.

DALLAS -- Citadel Security Software Inc. (Nasdaq:CDSS), a leader in vulnerability management and policy enforcement solutions through automated vulnerability remediation (AVR) technology, today announced preliminary results for its third quarter ended September 30, 2004. The Company expects to report record revenue for the third quarter of between $7.4 million to $7.8 million and its first quarterly net income.

"This quarter was a huge success for our customers and employees as we were awarded significant new business in both the public and commercial sectors," said Steve Solomon's Citadel Security Software's CEO. "Some of the deals we won included a $1.7 million commercial enterprise license with a global communications and services company, reflecting growing interest in Hercules(R) in the commercial sector, and an $8.6 million enterprise license and services subcontract for the Department of Defense."

"The third quarter's results, and our new business pipeline, reflect the growing recognition by businesses and government agencies for the need to adopt a proactive approach for vulnerability management. Blind reliance on reactive measures is no longer sufficient. We are aggressively addressing this market opportunity by broadening our product offerings with the new 3.5 release of Hercules AVR, the addition of ConnectGuard for endpoint security and AssetGuard for full device inventory capability. This suite of products offers our customers a cradle-to-grave vulnerability management solution unsurpassed in the market today. I am very proud of our employees and their continuing commitment to the company's success as demonstrated by our third quarter results."

The company expects to release its third quarter results on Tuesday, November 2nd after the market closes. At that time, it plans to update investors on its business forecast. The company will hold a conference call to discuss the final financial results at 4:30 PM Eastern Time that day. This call will be webcast by CCBN and will be available from the Investor Relations section of the company's corporate website. A replay of the webcast will be available beginning two hours after the completion of the call. The webcast will also be distributed over CCBN's Investor Distribution Network to both institutional and individual investors. Individual investors can listen to the call through CCBN's individual investor center at www.fulldisclosure.com or by visiting any of the investor sites in CCBN's Individual Investor Network. Institutional investors can access the call via CCBN's password-protected event management site, StreetEvents (www.streetevents.com).

Please visit the Company's website during the week before the webcast for instructions on how to register for the webcast.

About Citadel

Citadel Security Software Inc., a leader in enterprise vulnerability management solutions powered by AVR technology, helps enterprises effectively neutralize security vulnerabilities. Citadel's patent-pending, Common Criteria EAL 3 certified Hercules(R) technology provides users with full control over the automated remediation process, enabling efficient aggregation, prioritization and resolution of vulnerabilities detected by industry-standard vulnerability assessment tools. SecurePC(TM) and NetOFF(TM) products enable companies to enforce security policies from a single point of control. Citadel's solutions enable organizations to ensure the confidentiality of information, reduce the time and costs associated with the inefficient manual remediation process, and facilitate compliance with organizational security policies and government mandates such as FISMA, HIPAA and Gramm-Leach-Bliley legislation. For more information on Citadel, visit www.citadel.com, or contact the company at [phone].

Safe Harbor/Forward-looking Statements:

This press release may contain forward-looking statements that are intended to be subject to the safe harbor protection provided by Section 27A of the Securities Act of 1933 and Section 21E of the Securities Exchange Act of 1934. These statements relate to future events or future financial performance and involve known and unknown risks and uncertainties that may cause actual results or performance to be materially different from those indicated by any forward-looking statements. In some cases, you can identify forward-looking statements by terminology such as "forecast," "may," "will," "could," "should," "anticipate," "expect," "plan," "believe," "potential" or other similar words indicating future events or contingencies. Some of the things that could cause actual results to differ from expectations are: revenue recognition policies that may delay recognition of revenues; the ability of government entities to terminate licenses of our products for convenience; the current economic and geopolitical environment; current information technology spending trends; the uncertainty of funding of government information technology security projects; a lack of Citadel operating history; uncertainty of product acceptance; uncertainty of ability to compete effectively in a new market; the uncertainty of profitability and cash flow of Citadel; intellectual property rights and dependence on key personnel; economic conditions; the continued impact of terrorist attacks, global instability and potential U.S. military involvement; the competitive environment and other trends in the company's industry; changes in laws and regulations; changes in the company's business plans; interest rates and the availability of financing; liability and other claims asserted against the company; labor disputes; the company's ability to attract and retain qualified personnel; and inflation. For a discussion of these and other risk factors, see the company's Annual Report on Form 10-KSB for the year ended December 31, 2003 and its Quarterly Report on Form 10-QSB for the quarter ended June 30, 2004. All of the forward-looking statements are qualified in their entirety by reference to the risk factors discussed therein. These risk factors may not be exhaustive. The company operates in a continually changing business environment, and new risk factors emerge from time to time. Management cannot predict such new risk factors, nor can it assess the impact, if any, of such new risk factors on the company's business or events described in any forward-looking statements. The company disclaims any obligation to publicly update or revise any forward-looking statements after the date of this report to conform them to actual results.

Editors Note: Citadel is a trademark and Hercules is a registered trademark of Citadel Security Software Inc.