Citadel Security Software Representative Named as Co-Chair to OASIS Web Application Security Technical Committee.

Business Editors/High-Tech Writers

DALLAS--(BUSINESS WIRE)--April 14, 2004

Dave Raphael Joins Leadership Team for XML-Based

Vulnerability Language Standard

Citadel Security Software Inc. (OTCBB:CDSS), a leader in vulnerability management solutions through automated vulnerability remediation (AVR) and policy enforcement, today announced that Dave Raphael, Senior Infrastructure Developer, has been named co-chair of the OASIS Web Application Security (WAS) Technical Committee. Together with Mark Curphey of Foundstone, Raphael will lead a team of OASIS members developing standards that improve interoperability among security software solutions.

WAS will have a significant impact on how people develop risk management technology and processes in the application security arena. With its ability to describe not only vulnerabilities and their impacts in a consistent and unambiguous manner, and its vendor-agnostic test cases and intrusion prevention signatures, WAS will allow people to build more effective solutions to manage the growing application security problem.

"Having worked with him in the past, I am very pleased that Dave will be jointly chairing this technical committee. WAS development will benefit from his unique skills and experience," said Curphey in his role as co-chair of the OASIS WAS Technical Committee. "I am also excited to see strategic support from companies like Citadel and other important organizations that have recently joined our work and are committed to building future technology using WAS."

The purpose of the OASIS WAS Technical Committee is to produce a classification scheme for security vulnerabilities, a model to provide guidance for initial threat, impact and therefore risk ratings, and an XML schema to describe security conditions that can be used by both assessment, protection and remediation tools.

"It is a great privilege for one of Citadel's security team to be named co-chair to this prestigious OASIS Technical Committee. As a leading provider of security solutions, Citadel's goal is to establish the highest quality staff, and Dave is one of our best," said Citadel CTO, Carl Banzhof. "We support the OASIS WAS Technical Committee and its development of an XML-based vulnerability language standard, and we extend our commitment to provide interoperability between industry-leading network and application security technologies and our vulnerability management solutions. Organizations will benefit enormously from the greater flexibility and consistency for managing security technologies with a standard approach to managing vulnerability data."

"It is an honor to be named co-chair to the OASIS WAS Technical Committee," said Raphael. "I look forward to working with Mark Curphey and the other members of the committee to help enterprises build better processes around vulnerability management."

Raphael's role as a director of the Open Web Application Security Project (OWASP) and extensive security experience will assist him in the position of co-chair. Raphael will be responsible for general administration of documentation and co-authoring the WAS Classification Scheme and co-authoring portions of the WAS Schema.

For details on the OASIS WAS Technical Committee, see http://www.oasis-open.org/committees/was.

About Citadel

Citadel Security Software Inc., a leader in vulnerability management solutions through automated vulnerability remediation and policy enforcement solutions, helps enterprises effectively neutralize security vulnerabilities. Citadel's patent-pending Hercules(R) technology provides users with full control over the automated remediation process, enabling efficient aggregation, prioritization and resolution of vulnerabilities detected by industry-standard vulnerability assessment tools. SecurePC(TM) and NetOFF(TM) products enable companies to enforce security policies from a single point of control. Citadel's solutions enable organizations to ensure the confidentiality of information, reduce the time and costs associated with the inefficient manual remediation process, and facilitate compliance with organizational security policies and government mandates such as FISMA, HIPAA and Gramm-Leach-Bliley legislation. For more information on Citadel, visit www.citadel.com, or contact the company at [phone].

Safe Harbor/Forward-looking Statements:

This press release contains forward looking statements that are subject to risks and uncertainties, including the current economic and geopolitical environment, the current information technology spending trend, the uncertainty of funding of government information technology security projects, a lack of Citadel operating history, uncertainty of product acceptance, uncertainty of ability to compete effectively in a new market and the uncertainty of profitability and cash flow of Citadel, competition, intellectual property rights and dependence on key personnel. These risks and uncertainties may cause actual outcomes and results to differ materially from expectations in this press release. These and other risks are detailed in Citadel's annual report on Form 10-KSB filed for the year ended December 31, 2003.

Editors Note: Citadel is a trademark and Hercules is a registered trademark of Citadel Security Software.