Citadel Security Software Sponsored Poll Reveals U.S. Adults Believe Companies Are Passing on the Costs of Cleaning Up After Cyber Security Breaches.

DALLAS -- U.S. Adults (64%) Overwhelmingly Disapprove of Paying for Companies' Damaged Systems and Lost Productivity

Citadel Security Software Inc. (NASDAQ:CDSS), a leader in full life cycle vulnerability management and policy enforcement solutions, today announced the results of a nationwide poll measuring consumer attitudes toward cyber security. The poll found that a majority of U.S. adults (51%) believe that companies recoup the costs associated with an IT security breach by passing the financial burden on to consumers. The poll was conducted by Harris Interactive(R) and surveyed a total of 2,015 adults aged 18 and older, residing across the United States.

The survey defined the costs associated with a cyber security breach as including costs to fix systems, business downtime and lost or damaged information. Two-thirds (64%) of adults disapprove of companies passing these costs on to them. One in three (33%) of those surveyed would support government legislation ensuring that all companies use the same security standards to protect the security of their IT infrastructure.

Those who favor legislation have made it clear in this poll that they want severe punishment for companies that do not comply with any new laws. Ninety-four percent of adults who support legislation that would ensure that all companies use the same security standards to protect the security of their IT infrastructure favored consequences of some type. Seven in ten (70%) of those favoring legislation, or almost one in four of all respondents (23%), want to see companies fined for violating IT security legislation. Other consequences ranged from adding a company to a consumer "blacklist" that is publicly available (54%), to jail time for high-level executives, including the CEO (15%).

"I am hopeful that continuing awareness and pressure from consumers will get the attention of corporate America and that all businesses will be more proactive in addressing their cyber security responsibilities on behalf of their customers, the American people and the U. S. economy," stated Congressman Adam H. Putnam, Chairman of the House Government Reform Subcommittee on Technology, Information Policy, Intergovernmental Relations and the Census.

"I believe that cyber security is an issue that companies can resolve without government intervention, however time is running out to take pro-active measures toward securing systems," said Steve Solomon, CEO of Citadel Security Software. "This Harris Interactive survey shows that consumers are aware they are paying for companies to clean up after cyber security breaches, and they aren't happy about it. With many consumers calling for legislation and fines, companies need to regain confidence by eliminating vulnerabilities before arduous and costly legislation is mandated."

Citadel is dedicated to educating both the public and private sectors on best practices for bridging security and operations departments to develop, implement and enforce security policies. This survey was conducted as part of Citadel's contribution to National Cyber Security Awareness Month, occurring in October.

Methodology

Harris Interactive(R), via its QuickQuery(SM) online omnibus, fielded the four question survey on behalf of Citadel Security Software. The online sample consisted of 2,015 adults nationwide and was comprised of 932 men and 1,083 women - 18 years of age or older.

The data were weighted to be representative of the total U.S. adult population on the basis of region, age within gender, education, household income, race/ethnicity and propensity to be online.

Interviewing for the survey was completed on August 23-25, 2004.

In theory with probability samples of this size one can say with 95 percent certainty that the sampling error is plus or minus 2.2 percentage points. This online sample was not a probability sample.

About Harris Interactive(R)

Harris Interactive (www.harrisinteractive.com) is a global research firm that blends premier strategic consulting with innovative and efficient methods of investigation, analysis and application. Well known for The Harris Poll(R) and for pioneering Internet-based research methods, Rochester, New York-based Harris Interactive conducts proprietary and public research to help its clients around the world achieve clear, material and enduring results.

Harris Interactive combines its intellectual capital, databases and technology to advance market leadership through its U.S. offices and wholly owned subsidiaries: London-based HI Europe (www.hieurope.com), Paris-based Novatris (www.novatris.com), Tokyo-based Harris Interactive Japan, recently acquired U.S.-based WirthlinWorldwide (www.wirthlinworldwide.com) and through a global network of affiliate firms. EOE M/F/D/V

To become a member of the Harris Poll Online(SM) and be invited to participate in future online surveys, visit www.harrispollonline.com.

About Citadel

Citadel Security Software Inc., a leader in full life cycle vulnerability management solutions powered by AVR technology, helps enterprises effectively neutralize security vulnerabilities. Citadel's patent-pending, Common Criteria EAL 3 certified Hercules(R) technology provides users with full control over the automated remediation process, enabling efficient aggregation, prioritization and resolution of vulnerabilities detected by industry-standard vulnerability assessment tools. SecurePC(TM) and NetOFF(TM) products enable companies to enforce security policies from a single point of control. Citadel's solutions enable organizations to ensure the confidentiality of information, reduce the time and costs associated with the inefficient manual remediation process, and facilitate compliance with organizational security policies and government mandates such as FISMA, HIPAA and Gramm-Leach-Bliley legislation. For more information on Citadel, visit www.citadel.com, or contact the company at [phone].

Safe Harbor/Forward-looking Statements:

This press release may contain forward-looking statements that are intended to be subject to the safe harbor protection provided by Section 27A of the Securities Act of 1933 and Section 21E of the Securities Exchange Act of 1934. These statements relate to future events or future financial performance and involve known and unknown risks and uncertainties that may cause actual results or performance to be materially different from those indicated by any forward-looking statements. In some cases, you can identify forward-looking statements by terminology such as "forecast," "may," "will," "could," "should," "anticipate," "expect," "plan," "believe," "potential" or other similar words indicating future events or contingencies. Some of the things that could cause actual results to differ from expectations are: the current economic and geopolitical environment; current information technology spending trends; the uncertainty of funding of government information technology security projects; a lack of Citadel operating history; uncertainty of product acceptance; uncertainty of ability to compete effectively in a new market; the uncertainty of profitability and cash flow of Citadel; intellectual property rights and dependence on key personnel; economic conditions; the continued impact of terrorist attacks, global instability and potential U.S. military involvement; the competitive environment and other trends in the company's industry; changes in laws and regulations; changes in the company's business plans; interest rates and the availability of financing; liability and other claims asserted against the company; labor disputes; the company's ability to attract and retain qualified personnel; and inflation. For a discussion of these and other risk factors, see the company's Annual Report on Form 10-KSB for the year ended December 31, 2003 and its Quarterly Report on Form 10-QSB for the quarter ended June 30, 2004. All of the forward-looking statements are qualified in their entirety by reference to the risk factors discussed therein. These risk factors may not be exhaustive. The company operates in a continually changing business environment, and new risk factors emerge from time to time. Management cannot predict such new risk factors, nor can it assess the impact, if any, of such new risk factors on the company's business or events described in any forward-looking statements. The company disclaims any obligation to publicly update or revise any forward-looking statements after the date of this report to conform them to actual results.

Editors Note: Citadel is a trademark and Hercules is a registered trademark of Citadel Security Software Inc.