Citadel Security Software Reports Third Quarter 2002 Results; Sequential Revenue Growth Driven by Sales of Hercules Remediation Solution.

Business Editors

DALLAS--(BUSINESS WIRE)--Nov. 13, 2002

Citadel Security Software Inc. (OTCBB: CDSS), a leading provider of vulnerability remediation and security software solutions, today announced financial results for the third quarter ended September 30, 2002.

"I am pleased with the sequential improvement in revenue and the market acceptance of our Hercules remediation solution," said Steven B. Solomon, CEO and President of Citadel. "The Company is highly focused to leverage the initiatives in the draft report on the National Strategy to Secure Cyberspace and is actively engaged in demonstrations and pilots in a number of corporations, healthcare facilities and government agencies. These pilots currently represent over 300,000 potential seats for the Hercules product if deployed throughout these customers' networks. We believe market conditions and broader distribution will lead to strong revenue growth for Citadel in 2003."

Revenue was $483,000 for the third quarter of 2002 compared with revenue of $141,000 for the third quarter of 2001. Revenue for the nine months ended September 30, 2002 was $1,030,000 compared to $322,000 for the nine months ended September 30, 2001. The backlog of deferred revenue increased to $179,000 at September 30, 2002 and is directly attributable to the deferral of revenue from customer support contracts included in total year-to-date orders of approximately $1.2 million.

The net loss for the quarter was $568,000, a $0.04 loss per share compared to $404,000, or a $0.03 loss per share for the third quarter of 2001. For the nine months ended September 30, 2002 the net loss was $1,652,000 a $0.12 loss per share compared to $1,433,000 or a $0.12 loss per share for the nine months ended September 30, 2001.

"Our Hercules product is gaining market awareness and acceptance by corporations, government agencies and organizations that are recognizing that their current manual remediation process is not reducing the number of network vulnerabilities in a timely, efficient and cost effective manner. We believe Hercules is the only enterprise software solution available in the market today that will replace this manual remediation process and truly mitigate the risk of network security breaches."

The vulnerability assessment and remediation market is being driven in part by the increase in the number of identified vulnerabilities and the need to proactively remediate those vulnerabilities. CERT/CC(R) at Carnegie Mellon University reports 3,222 newly identified vulnerabilities in the first nine months of 2002 and 8,355 since 1988. The President's Critical Infrastructure Protection Board's draft report on the National Strategy to Secure Cyberspace issued in September 2002 recommends as part of actions and best practices that organizations "Create a regular process to assess, remediate and monitor vulnerabilities of the network."

"Our Hercules remediation solution along with our partners' vulnerability assessment solutions directly address the report's best practice recommendation," said Mr. Solomon. "In fact, the interoperability of Hercules with several of the leading assessment scanning products makes Citadel the logical vendor of choice for a network remediation solution by our customers," added Mr. Solomon.

About Citadel Security Software Inc.

Citadel Security Software Inc. (OTCBB:CDSS) develops, markets and licenses computer security and privacy software for one of the fastest growing software industry segments today -- security inside the firewall. Citadel's Winshield(R) SecurePC(TM) and NetOFF(TM) products enable companies to enforce security policies from a single point of control. Citadel's Hercules' product remediates vulnerabilities from the five classes of security vulnerabilities: insecure accounts, unnecessary services, mis-configurations, back doors and software defects. Hercules' open architecture design allows the import and aggregation of assessment data from many sources. Hercules is interoperable with industry leading vulnerability assessment tools allowing customers to address the real world issues of vulnerability assessment and remediation. Citadel's products also address the mandates of HIPAA and Gramm-Leach-Bliley legislation for the health care and financial industries.

Further information about Citadel Security Software and its products can be accessed at its website, www.citadel.com.

Safe Harbor/Forward-looking Statements:

Except for the historical information contained herein, this news release contains forward looking statements that are subject to risks and uncertainties, including lack of Citadel operating history, uncertainty of product acceptance and the uncertainty of profitability and cash flow of Citadel. These and other risks are detailed from time to time in CT Holdings' and Citadel's SEC reports, including CT's report on Form 1O-KSB for the year ended December 31, 2001 and most recent Form 10-QSBs, as well as Citadel's Registration Statement on Form 10-SB and amendments and most recent Form 10-QSBs.