Citadel Security Software Receives $2.4 Million Order From Major U.S. Government Agency; Commitment Expands Use of Hercules(R) Enterprise Vulnerability Management Solution.

DALLAS -- Citadel Security Software Inc. (NASDAQ:CDSS), a leader in enterprise vulnerability management and policy enforcement solutions, announced today that the company has received an order from a government system integrator requesting additional content software and services related to an existing major U.S. government contract. The order is valued at approximately $2,400,000 and expands the agency's utilization of Citadel's Hercules(R) capabilities for vulnerability remediation.

"We see this expansion of our existing relationship with our largest government customer as strong indication of the success to date of our Hercules vulnerability management solution as well as our training and support services," said Jeff Kidwell, Director, DoD Operations of Citadel Security Software. "We are pleased to have received this continuing vote of confidence from this vital organization, and look forward to future contributions to the security of its worldwide systems."

Government organizations are becoming ever more vigilant in minimizing security risks and ensuring an efficient way to audit policies and track compliance. The recent release by the National Institute for Standards and Technology (NIST) and U.S. Department of Homeland Security (DHS) of a National Vulnerability Database validates the importance of identifying and tracking the wide range of existing and known vulnerabilities. The use of Hercules automated technology for vulnerability management and remediation, policy compliance and reporting and can help protect an organization's network against all five classes of vulnerabilities -- software defects, unsecured accounts, unnecessary services, mis-configurations and backdoors -- across a multi-platform, multi-device environment.

With the largest library of tested vulnerability remedies across Windows and UNIX platforms and interoperability with industry leading network scanners and vulnerability assessment tools, Citadel gives government organizations the ability to avoid problems, resolve issues in real time, and cut down on its remediation effort. Hercules allows the organization to import and aggregate data from multiple sources, review, approve and customize resolutions, and systematically deploy vulnerability fixes.

About Citadel

Citadel Security Software (NASDAQ:CDSS) delivers security solutions that enable organizations to manage risk, reduce threats and enforce compliance with security policies and regulations. Citadel's proven architecture provides a business process to manage the increasing volume, frequency, and complexity of cyber security attacks. Citadel combines the world's largest active library of remediations spanning all classes of vulnerabilities with a proven delivery methodology to dramatically streamline vulnerability management and security compliance and provide ROI from the first use. Citadel solutions are used across the Department of Defense, at the Veterans Administration, and within other government and commercial organizations. For more information on Citadel, visit www.citadel.com, or call 888-8CITADEL.

Safe Harbor/Forward-looking Statements:

This press release may contain forward-looking statements that are intended to be subject to the safe harbor protection provided by Section 27A of the Securities Act of 1933 and Section 21E of the Securities Exchange Act of 1934. These statements relate to future events or future financial performance and involve known and unknown risks and uncertainties that may cause actual results or performance to be materially different from those indicated by any forward-looking statements. In some cases, you can identify forward-looking statements by terminology such as "forecast," "may," "will," "could," "should," "anticipate," "expect," "plan," "believe," "potential" or other similar words indicating future events or contingencies. Some of the things that could cause actual results to differ from expectations are: the economic and geopolitical environment; changes in the information technology spending trends; the uncertainty of funding of government and corporate information technology security projects; the variability of the product sales cycle, including longer sales cycles for government and large commercial contracts; the uncertainty that the company's prospective deals will result in final contracts; the potential changes in the buying decision makers during a customer purchasing cycle; the complexities in scope and timing for finalization of contracts; the fluctuations in product delivery schedules; a lack of Citadel operating history; uncertainty of product development and acceptance; uncertainty of ability to compete effectively in a new market; the uncertainty of profitability and cash flow of Citadel; intellectual property rights and dependence on key personnel; economic conditions; the continued impact of terrorist attacks, global instability and potential U.S. military involvement; the competitive environment and other trends in the company's industry; the effects of inflation; changes in laws and regulations; changes in the company's business plans, including shifts to new pricing models that may cause delays in licenses; interest rates and the availability of financing; liability, legal and other claims asserted against the company; labor disputes; and the company's ability to attract and retain qualified personnel. For a discussion of these and other risk factors, see the company's Annual Report on Form 10-KSB for the year ended December 31, 2004 and the company's Quarterly Report on Form 10-Q for the quarter ended June 30, 2005. All of the forward-looking statements are qualified in their entirety by reference to the risk factors discussed therein. These risk factors may not be exhaustive. The company operates in a continually changing business environment, and new risk factors emerge from time to time. Management cannot predict such new risk factors, nor can it assess the impact, if any, of such new risk factors on the company's business or events described in any forward-looking statements. The company disclaims any obligation to publicly update or revise any forward-looking statements after the date of this report to conform them to actual results.

Editors Note: Citadel is a trademark and Hercules(R) is a registered trademark of Citadel Security Software.