<PAGE>   1
                                                                     EXHIBIT 99


Private Securities Litigation Reform Act of 1995
Safe Harbor Compliance Statement for Forward-Looking Statements

In passing the Private Securities Litigation Reform Act of 1995 (the "Reform
Act"), Congress encouraged public companies to make "forward-looking
statements" by creating a safe-harbor to protect companies from securities law
liability in connection with forward-looking statements. ISS Group, Inc.
("ISS") intends to qualify both its written and oral forward-looking statements
for protection under the Reform Act.

In addition to the other information in this Quarterly Report on Form 10-Q,
stockholders should carefully consider the following factors in evaluating the
Company and its business, as well as the Risk Factors set forth in the
Company's Registration Statement on Form S-1 as filed with the Securities and
Exchange Commission on March 1, 1999.

To qualify oral forward-looking statements for protection under the Reform Act,
a readily available written document must identify important factors that could
cause actual results to differ materially from those in the forward-looking
statements. ISS provides the following information in connection with its
continuing effort to qualify forward-looking statements for the safe harbor
protection of the Reform Act.


RISK FACTORS

Forward-looking statements are inherently uncertain as they are based on
various expectations and assumptions concerning future events and are subject
to known and unknown risks and uncertainties. Our forward-looking statements
should be considered in light of the following important risk factors.
Variations from our stated intentions or failure to achieve objectives could
cause actual results to differ from those projected in our forward-looking
statements. We undertake no obligation to update publicly any forward-looking
statements for any reason, even if new information becomes available or other
events occur in the future.

WE ARE A YOUNG COMPANY THAT HAS INCURRED LOSSES

We began operations in April 1994 and have only achieved profitability over the
past three quarters ended September 30, 1999. We cannot be certain that we can
sustain such profitability in any future period. You should be aware that we
have only a limited operating history upon which to evaluate our business and
prospects. We operate in a new and rapidly evolving market and must, among
other things:

        o       respond to competitive developments;

        o       continue to upgrade and expand our product and services
                offerings; and

        o       continue to attract, retain and motivate our employees.

We cannot be certain that we will successfully address these risks.

OUR FUTURE OPERATING RESULTS WILL FLUCTUATE SIGNIFICANTLY

As a result of our limited operating history, we cannot predict our future
revenues and operating results. However, we do expect our future revenues and
operating results to fluctuate due to a combination of factors, including:





                                     -1-
<PAGE>   2

        o       the growth of private Internet-based networks (often referred
                to as intranets);

        o       the extent to which the public perceives that unauthorized
                access to and use of online information is a threat to network
                security;

        o       the volume and timing of orders, including seasonal trends in
                customer purchasing;

        o       our ability to develop new and enhanced products and expand our
                professional services;

        o       the growth in the acceptance of, and activity on, the Internet
                and the World Wide Web, particularly by corporate,
                institutional and government users;

        o       customer budgets which may limit their ability to purchase our
                products;

        o       foreign currency exchange rates that affect our international
                operations;

        o       the mix of distribution channels through which we sell our
                products;

        o       product and price competition in our markets; and

        o       general economic conditions, both domestically and in our
                foreign markets.

We increasingly focus our efforts on sales of enterprise-wide security
solutions, which consist of our entire product suite and related professional
services, rather than on the sale of component products. As a result, we expect
that each sale may require additional time and effort from our sales staff. In
addition, the revenues associated with particular sales vary significantly
depending on the number of products licensed by a customer, the number of
devices used by the customer and the customer's relative need for our
professional services. Large individual sales, or even small delays in customer
orders, can cause significant variation in our license revenues and results of
operations for a particular period. The timing of large orders is usually
difficult to predict and, like many software companies, our customers typically
license most of our products in the last month of a quarter.

Our future operating expenses are expected to increase in future periods as we
intend to:

        o       expand our domestic and international sales and marketing
                operations;

        o       increase our investments in product development and our
                proprietary threat and vulnerability database;

        o       expand our professional services capabilities;

        o       seek acquisition candidates that will enhance our products and
                market share; and

        o       improve our internal operating and financial systems.

We cannot predict our operating expenses based on our past results. Instead, we
establish our spending levels based in large part on our expected future
revenues. As a result, if our actual revenues in any future period fall below
our expectations, our operating results likely will be adversely affected
because very few of our expenses vary with our revenues. Because of the factors
listed above, we believe that our quarterly and annual revenues, expenses and
operating results likely will vary significantly in the future.

WE FACE INTENSE COMPETITION IN OUR MARKET

The market for network security monitoring, detection and response solutions is
intensely competitive, and we expect competition to increase in the future. We
cannot guarantee that we will compete successfully against our current or
potential competitors, especially those with significantly greater financial
resources or brand name recognition. Our chief competitors generally fall
within one of four categories:





                                     -2-
<PAGE>   3

        o       internal information technology departments of our customers
                and the consulting firms that assist them in formulating
                security systems;

        o       relatively smaller software companies offering relatively
                limited applications for network and Internet security;

        o       large companies, including Axent Technologies and Network
                Associates, that sell competitive products and offerings, as
                well as other large software companies that have the technical
                capability and resources to develop competitive products; and

        o       software or hardware companies that could integrate features
                that are similar to our products into their own products.

Mergers or consolidations among these competitors, or acquisitions of small
competitors by larger companies, would make such combined entities more
formidable competitors to us. Large companies may have advantages over us
because of their longer operating histories, greater name recognition, larger
customer bases or greater financial, technical and marketing rescues. As a
result, they may be able to adapt more quickly to new or emerging technologies
and changes in customer requirements. They can also devote greater resources to
the promotion and sale of their products than we can. In addition, these
companies have reduced, and could continue to reduce, the price of their
security monitoring, detection and response products, which increases pricing
pressures within our market. In addition, large companies with broad product
offerings, such as Network Associates, have bundled their security products
with their other products and we expect them to continue to do so in the
future. These companies may develop security monitoring, detection and response
products that are better than our current or future products and this may
render our products obsolete.

Several companies currently sell software products (such as encryption,
firewall, operating system security and virus detection software) that our
customers and potential customers have broadly adopted. Some of these companies
sell products which perform the same functions as some of our products. In
addition, the vendors of operating system software or networking hardware may
enhance their products to include the same kinds of functions that our products
currently provide. The widespread inclusion of comparable features to our
software in operating system software or networking hardware could render our
products obsolete, particularly if such features are of a high quality. Even if
security functions integrated into operating system software or networking
hardware are more limited than those of our software, a significant number of
customers may accept more limited functionality to avoid purchasing additional
software.

For the above reasons, we may not be able to compete successfully against our
current and future competitors. Increased competition may result in price
reductions, reduced gross margins and loss of market share.

WE FACE RAPID TECHNOLOGICAL CHANGE IN OUR INDUSTRY AND FREQUENT INTRODUCTIONS
OF NEW PRODUCTS

Rapid changes in technology pose significant risks to us. We do not control nor
can we influence the forces behind these changes, which include:

        o       the extent to which businesses and others seek to establish
                more secure networks;

        o       the extent to which hackers and others seek to compromise
                secure systems;

        o       evolving computer hardware and software standards;




                                      -3-
<PAGE>   4
        o       changing customer requirements; and

        o       frequent introductions of new products and product
                enhancements.

To remain successful, we must continue to change, adapt and improve our
products in response to these and other changes in technology. Our future
success hinges on our ability to both continue to enhance our current line of
products and professional services and to introduce new products that address
and respond to innovations in computer hacking, computer technology and
customer requirements. We cannot be sure that we will successfully develop and
market new products that do this. Any failure by us to timely develop and
introduce new products, to enhance our current products or to expand our
professional services capabilities in response to these changes could adversely
affect our business, operating results and financial condition.

Our products involve very complex technology, and as a consequence, major new
products and product enhancements require a long time to develop and test
before going to market. Because this amount of time is difficult to estimate,
we have had to delay the scheduled introduction of new and enhanced products in
the past and may have to delay the introduction of new products and product
enhancements in the future.

The techniques computer hackers use to gain unauthorized access to or to
sabotage networks and intranets are constantly evolving and increasingly
sophisticated. Furthermore, because new hacking techniques are usually not
recognized until used against one or more targets, we are unable to anticipate
most new hacking techniques. To the extent that new hacking techniques harm our
customers' computer systems or businesses, affected customers may believe that
our products are ineffective, which may cause them or prospective customers to
reduce or avoid purchases of our products.

RISKS ASSOCIATED WITH OUR GLOBAL OPERATIONS

The expansion of our international operations includes the maintenance of sales
offices in dispersed locations throughout the world, including throughout
Europe and the Asia/Pacific and Latin America regions. Our international
presence and expansion exposes us to risks not present in our U.S. operations,
such as:

        o       the difficulty in managing an organization spread over various
                countries located across the world;

        o       unexpected changes in regulatory requirements in countries
                where we do business;

        o       excess taxation due to overlapping tax structures;

        o       fluctuations in foreign currency exchange rates, which may be
                aggravated in European markets by the recent introduction of
                the Euro currency;

        o       export license requirements and restrictions on the export of
                certain technology, especially encryption technology;

        o       trade restrictions;

        o       changes in tariff and freight rates; and

        o       depressed regional and economic conditions, such as those
                currently affecting many regions in Asian markets.

Despite these risks, we believe that we must continue to expand our operations
in international markets to support our growth. To this end, we intend to
establish additional foreign sales operations, expand our existing offices,
hire additional personnel, expand our international sales channels and
customize our products for local markets. If we fail to execute this strategy,
our international sales growth will be limited.




                                      -4-
<PAGE>   5

To date, we have primarily denominated our revenues from international
operations in United States dollars; however, we will increasingly denominate
sales in local foreign currencies in the future. An increase in the value of
the United States dollar relative to foreign currencies would make our products
more expensive and, therefore, potentially less competitive in foreign markets.
In addition, even if we successfully expand our international operations, we
may not be able to maintain or increase international market demand for our
products.

WE RELY ON INDIRECT DISTRIBUTION CHANNELS

Although our direct sales have accounted for a majority of our revenues in this
quarter, we expect to continue to license a significant percentage of our
products to end users through indirect distribution channels in the future. Our
indirect distribution channel partners include:

        o       original equipment manufacturers that bundle our products with
                products that they sell to their customers;

        o       managed service providers, such as telecommunications companies
                and Internet service providers, that host networking and
                Internet operations for business customers; and

        o       consultants and systems integrators that incorporate our
                products into customized solutions that they have implemented
                for their customers.

Our future performance will also depend, in part, on our ability to both retain
the channel partner relationships we have built and attract new channel
partners to market and support our products effectively, especially in new
markets. We cannot assure you that revenue from channel partners that accounted
for significant revenues in past periods will continue or, if continued, will
reach or exceed past performance levels. In addition, we often depend upon our
channel partners to install and support our products for end users. If our
channel partners fail to provide adequate installation and support, end users
of our products could cease using, or improperly implement and operate, our
products. Such a failure could substantially increase our customer support
costs and adversely affect our business.

POTENTIAL FUTURE ACQUISITIONS OR INVESTMENTS

We have recently acquired Netrex, Inc. and NJH Security Consulting. As part of
our growth strategy, we may continue to acquire or may make investments in,
companies with products, technologies or professional services capabilities
complementary to our solutions. In our recent acquisitions as well as in future
acquisitions we could encounter difficulties in assimilating new personnel and
operations into our company. These difficulties may disrupt our ongoing
business, distract our management and employees, increase our expenses and
adversely affect our results of operations. These difficulties could also
include accounting requirements, such as amortization of goodwill or in-process
research and development expense. We cannot be certain that we will
successfully overcome these risks with respect to any or our recent or future
acquisitions or that we will not encounter other problems in connection with
our recent or any future acquisitions. In addition, any future acquisitions may
require us to incur debt or issue equity securities. The issuance of equity
securities could dilute the investment of our existing stockholders.





                                      -5-
<PAGE>   6

WE DEPEND ON OUR KEY PERSONNEL

Our future success also depends on our continuing ability to attract and retain
highly qualified engineers, managers and sales and professional services
personnel. The competition for employees at all levels of the software
industry, especially those with experience in the relatively new discipline of
security software, is increasingly intense.

WE DEPEND ON OUR INTELLECTUAL PROPERTY RIGHTS AND USE LICENSED TECHNOLOGY

We rely primarily on copyright and trademark laws, trade secrets,
confidentiality procedures and contractual provisions to protect our
proprietary rights. We also believe that the technological and creative skills
of our personnel, new product developments, frequent product enhancements, our
name recognition, our professional services capabilities and delivery of
reliable product maintenance are essential to establishing and maintaining our
technology leadership position. We cannot assure you that our competitors will
not independently develop technologies that are similar to ours.

We seek to protect our software, documentation and other written materials
under the trade secret and copyright laws, which afford only limited
protection. We have also submitted two United States patent applications.
Patents may not issue from these applications or, if issued, may not provide
any meaningful competitive advantages to us.

Despite our efforts to protect our proprietary rights, unauthorized parties may
attempt to copy aspects of our products or to obtain and use information that
we regard as proprietary. Policing unauthorized use of our products is
difficult. While we cannot determine the extent to which piracy of our software
products occurs, we expect software piracy to be a persistent problem. In
addition, the laws of some foreign countries do not protect our proprietary
rights to as great an extent as do the laws of the United States and many
foreign countries do not enforce these laws as diligently as U.S. government
agencies and private parties.

We are not aware that any of our products infringes the proprietary rights of
others, but it is conceivable that our current or future products may infringe
the proprietary rights of others. In fact, in July 1998 Network Associates, one
of our competitors, filed a lawsuit against us alleging that our Real Secure
product violated a patent claim for intrusion detection technology held by
Network Associates. The parties resolved this lawsuit in July 1999 without any
material affect on our business, operating results or financial condition.

We expect the number of intellectual property infringement lawsuits against
software companies to increase. Any such claims, with or without merit, could
be time consuming, result in costly litigation, cause product shipment delays
or require us to enter into royalty or licensing agreements.

WE LACK CERTAIN TRADEMARK PROTECTION

We currently cannot obtain trademark protection on the name "Internet Security
Systems" due to its general use in a variety of security-related applications.
While we have in the past taken and will continue to take action against any
use of that name in a manner that may create confusion for our products in our
current or future markets, we may not be successful in these efforts.





                                      -6-
<PAGE>   7

WE FACE POTENTIAL PRODUCT LIABILITY EXPOSURE AND PRODUCT DEFECTS

Many organizations use our products for critical functions of monitoring and
enhancing network security. As a result, we risk product liability and related
claims for our products if they do not adequately perform this function. In our
licensing agreements, we typically seek to limit our liability for special,
consequential or incidental damages, but these provisions may not in all cases
be enforceable under applicable laws. In addition, we currently have $2.0
million of product liability insurance coverage that, subject to customary
exclusions, covers claims resulting from failure of our products or services to
perform their intended function or to serve their intended purpose. A product
liability claim, to the extent not covered by our insurance, could materially
and adversely affect our business, operating results and financial condition.

Complex software products such as ours may contain undetected "bugs" that,
despite our testing, are discovered only after installation and use by our
customers. The occurrence of these bugs could result in adverse publicity, loss
of or delay in market acceptance or claims by customers against us, any of
which could have a material adverse effect upon our business, operating results
and financial condition. Customers who deploy or use our products improperly or
incompletely may experience temporary disruptions to their computer networking
systems, which could damage our relationship with them and our reputation. Our
current products may not be error-free and it is extremely doubtful that our
future products will be error-free. Furthermore, computers are manufactured in
a variety of different configurations with different operating systems (such as
Windows, Unix, Macintosh and OS/2) and embedded software. As a result, it is
very difficult to comprehensively test our software products for programming or
compatibility errors. Errors in the performance of our products, whether due to
our design or their compatibility with products of other companies, could
hinder the acceptance of our products.





                                      -7-