<PAGE>

                                                                    Exhibit 10.4

                               INDEMNITY AGREEMENT

     This INDEMNITY AGREEMENT, is dated effective as of ______, 2002 (the
"Effective Date") between Citadel Security Software Inc., a Delaware corporation
(the "Company"), and _______ (the "Indemnitee").

     WHEREAS, it is essential to the Company to retain and attract as directors
and officers the most capable persons available;

     WHEREAS, Indemnitee is a director and/or officer of the Company;

     WHEREAS, both the Company and Indemnitee recognize the increased risk of
litigation and other claims being asserted against directors and officers of
public companies in today's environment;

     WHEREAS, the Amended and Restated By-laws (the "By-laws") and Amended and
Restated Certificate of Incorporation (the "Certificate") of the Company require
the Company to indemnify and advance expenses to its directors and officers to
the fullest extent permitted by law, and the Indemnitee has agreed to serve or
to continue to serve as a director and/or an officer of the Company in part in
reliance on such provisions in the By-laws and Certificate;

     WHEREAS, in recognition of Indemnitee's need for substantial protection
against personal liability in order to enhance Indemnitee's continued service to
the Company in an effective manner and Indemnitee's reliance on the foregoing
provisions in the By-laws and Certificate, and in part to provide Indemnitee
with specific contractual assurance that the protection promised by such
provisions in the By-laws and Certificate will be available to Indemnitee
(regardless of, among other things, any amendment to or revocation of such
provisions in the By-laws or Certificate or any change in the composition of the
Company's Board of Directors (the "Board") or acquisition transaction relating
to the Company), the Company wishes to provide in this Agreement for the
indemnification of and the advancing of expenses to Indemnitee to the fullest
extent permitted by law and as set forth in this Agreement, and, to the extent
insurance is maintained, for the continued coverage of Indemnitee under Company
directors' and officers' liability insurance policies;

     NOW, THEREFORE, in consideration of the premises and of Indemnitee
continuing to serve the Company directly or, at its request, with another
enterprise, and intending to be legally bound hereby, the parties hereto agree
as follows:

1.  Certain Definitions.
    -------------------

    (a)  Change in Control:  shall be deemed to have occurred upon any of the
         -----------------
following events:

         (i)   The acquisition in one or more transactions by any "Person" (as
               the term person is used for purposes of Section 13(d) or 14(d) of
               the Securities Exchange Act of 1934, as amended (the "1934 Act"),
               of "Beneficial Ownership" (within the meaning of Rule 13d-3
               promulgated under the 1934 Act) of twenty-five percent (25%) or
               more of the combined voting power of the Company's then
               outstanding voting securities (the "Voting Securities"),
               provided, however, that for purposes of this Section 1(a)(i), the
               --------  -------
               Voting Securities acquired directly from the Company by any
               Person shall be excluded from the determination of such Person's
               Beneficial Ownership of Voting Securities (but such Voting
               Securities shall be included in the calculation of the total
               number of Voting Securities then outstanding); or

<PAGE>

                  (ii)     The individuals who, as of the Effective Date, are
                           members of the Board (the "Incumbent Board"), cease
                           for any reason to constitute at least two-thirds of
                           the Board; provided, however, that if the election,
                           or nomination for election by the Company's
                           stockholders, of any new director was approved by a
                           vote of at least two-thirds of the Incumbent Board,
                           such new director shall, for purposes of this
                           Agreement, be considered as a member of the Incumbent
                           Board; or

                  (iii)    Approval by stockholders of the Company of (A) a
                           merger or consolidation involving the Company if the
                           stockholders of the Company immediately before such
                           merger or consolidation do not own, directly or
                           indirectly immediately following such merger or
                           consolidation, more than seventy-five percent (75%)
                           of the combined voting power of the outstanding
                           voting securities of the corporation resulting from
                           such merger or consolidation in substantially the
                           same proportion as their ownership of the Voting
                           Securities immediately before such merger or
                           consolidation or (B) a complete liquidation or
                           dissolution of the Company or an agreement for the
                           sale or other disposition of all or substantially all
                           of the assets of the Company.

                  (iv)     Notwithstanding the foregoing, a Change in Control
                           shall not be deemed to occur solely because
                           twenty-five percent (25%) or more of the then
                           outstanding Voting Securities is acquired by (i) a
                           trustee or other fiduciary holding securities under
                           one or more employee benefit plans maintained by the
                           Company or any of its subsidiaries or (ii) any
                           corporation that, immediately prior to such
                           acquisition, is owned directly or indirectly by the
                           stockholders of the Company in the same proportion as
                           their ownership of stock in the Company immediately
                           prior to such acquisition;

                  (v)      Moreover, notwithstanding the foregoing, a Change in
                           Control shall not be deemed to occur solely because
                           any Person (the "Subject Person") acquired Beneficial
                           Ownership of more than the permitted amount of the
                           outstanding Voting Securities as a result of the
                           acquisition of Voting Securities by the Company
                           which, by reducing the number of Voting Securities
                           outstanding, increases the proportional number of
                           shares Beneficially Owned by the Subject Person,
                           provided that if a Change in Control would occur (but
                           for the operation of this sentence) as a result of
                           the acquisition of Voting Securities by the Company,
                           and after such share acquisition by the Company, the
                           Subject Person becomes the Beneficial Owner of any
                           additional Voting Securities which increases the
                           percentage of the then outstanding Voting Securities
                           Beneficially Owned by the Subject Person, then a
                           Change in Control shall occur.

         (b)      Claim: any threatened, pending or completed action, suit or
                  -----
                  proceedings, whether civil, criminal, administrative or
                  investigative or other, including, without limitation, an
                  action by or in the right of any other corporation of any type
                  or kind, domestic or foreign, or any partnership, joint
                  venture, trust, employee benefit plan or other enterprise,
                  whether predicated on foreign, federal, state or local law and
                  whether formal or informal.

         (c)      Expenses: include attorneys' fees and all other costs, charges
                  --------
                  and expenses paid or incurred in connection with
                  investigating, defending, being a witness in or participating
                  in (including on appeal), or preparing to defend, be a witness
                  in or participate in any Claim relating to any Indemnifiable
                  Event.

                                       2

<PAGE>

         (d)      Indemnifiable Event: any event or occurrence related to the
                  -------------------
                  fact that Indemnitee is or was or has agreed to become a
                  director, officer, employee, agent or fiduciary of the
                  Company, or is or was serving or has agreed to serve in any
                  capacity, at the request of the Company, in any other
                  corporation, partnership, joint venture, trust, employee
                  benefit plan or other enterprise, or by reason of anything
                  done or not done by Indemnitee in any such capacity.

         (e)      Voting Securities:  any securities of the Company that vote
                  -----------------
                  generally in the election of directors.

2.       Basic Indemnification Arrangement.
         ---------------------------------

         (a)      In the event Indemnitee was, is or becomes a party to or
                  witness or other participant in, or is threatened to be made a
                  party to or witness or other participant in, a Claim by reason
                  of (or arising in part out of) an Indemnifiable Event, the
                  Company shall indemnify Indemnitee (without regard to the
                  negligence or other fault of the Indemnitee) to the fullest
                  extent permitted by applicable law, as soon as practicable but
                  in no event later than thirty days after written demand is
                  presented to the Company, against any and all Expenses,
                  judgments, fines, penalties, excise taxes and amounts paid or
                  to be paid in settlement (including all interest, assessments
                  and other charges paid or payable in connection with or in
                  respect of such Expenses, judgments, fines, penalties, excise
                  taxes or amounts paid or to be paid in settlement) of such
                  Claim. If Indemnitee makes a request to be indemnified under
                  this Agreement, the Board (acting by a quorum consisting of
                  directors who are not parties to the Claim with respect to an
                  Indemnifiable Event or, if such a quorum is not obtainable,
                  acting upon an opinion in writing or independent legal counsel
                  ("Board Action")) shall, as soon as practicable but in no
                  event later than thirty days after such request, authorize
                  such indemnification. Notwithstanding anything in the
                  Certificate, the By-laws or this Agreement to the contrary,
                  following a Change in Control, Indemnitee shall be entitled to
                  indemnification pursuant to this Agreement in connection with
                  any claim initiated by Indemnitee.

         (b)      Notwithstanding anything in the Certificate, the By-laws or
                  this Agreement to the contrary, if so requested by Indemnitee,
                  the Company shall advance (within two business days of such
                  request) any and all Expenses relating to a Claim to
                  Indemnitee (an "Expense Advance"), upon the receipt of a
                  written undertaking by or on behalf of Indemnitee to repay
                  such Expense Advance if a judgment or other final adjudication
                  or determination adverse to Indemnitee establishes that
                  Indemnitee, with respect to such Claim, is not eligible for
                  indemnification.

         (c)      If there has been no Board Action or Arbitration (as defined
                  in Section 3), or if Board Action determines that Indemnitee
                  would not be permitted to be indemnified, in any respect, in
                  whole or in part, in accordance with Section 2(a) of this
                  Agreement, Indemnitee shall have the right to commence
                  litigation in the court that is hearing the action or
                  proceeding relating to the Claim for which indemnification is
                  sought or in any court in the States of Delaware or Texas
                  having subject matter jurisdiction thereof and in which venue
                  is proper seeking an initial determination by the court or
                  challenging any Board Action or any aspect thereof, and the
                  Company hereby consents to service of process and to appear in
                  any such proceeding. Notwithstanding anything in the
                  Certificate, the By-laws or this Agreement to the contrary, if
                  Indemnitee has commenced legal proceedings in a court of
                  competent jurisdiction or Arbitration to secure a
                  determination that Indemnitee should be indemnified under this
                  Agreement, the By-laws of the Company or applicable law, any
                  Board Action under which Indemnitee would not

                                       3

<PAGE>

            be permitted to be indemnified in accordance with Section 2(a) of
            this Agreement shall not be binding. Any Board Action not followed
            by such litigation or Arbitration shall be conclusive and binding on
            the Company and Indemnitee.

         3. Change in Control. The Company agrees that if there is a Change in
            -----------------
Control, Indemnitee, by giving written notice to the Company and the American
Arbitration Association (the "Notice"), may require that any controversy or
claim arising out of or relating to this Agreement, or the breach thereof, shall
be settled by arbitration (the "Arbitration") in Dallas, Texas in accordance
with the Rules of the American Arbitration Association (the "Rules"). The
Arbitration shall be conducted by a panel of three arbitrators selected in
accordance with the Rules within thirty days of delivery of the Notice. The
decision of the panel shall be made as soon as practicable after the panel has
been selected, and the parties agree to use their reasonable efforts to cause
the panel to deliver its decision within ninety days of its selection. The
Company shall pay all fees and expenses of the Arbitration. The Arbitration
shall be conclusive and binding on the Company and Indemnitee, and the Company
or Indemnitee may cause judgment upon the award rendered by the arbitrators to
be entered in any court having jurisdiction thereof.

         4. Indemnification For Additional Expenses. The Company shall indemnify
            ---------------------------------------
Indemnitee against any and all expenses (including attorneys' fees) and, if
requested by Indemnitee, shall (within two business days of such request)
advance such expenses to Indemnitee, which are incurred by Indemnitee in
connection with any claim asserted by or action brought by Indemnitee for (i)
indemnification or advance payment of Expenses by the Company under law, this
Agreement, or any other agreement or By-law of the Company now or hereafter in
effect relating to Claims for Indemnifiable Events and/or (ii) recovery under
any directors' and officers' liability insurance policies maintained by the
Company, regardless of whether Indemnitee ultimately is determined to be
entitled to such indemnification, advance expense payment or insurance recovery,
as the case may be.

         5. Partial Indemnity, Etc. If Indemnitee is entitled under any
            ----------------------
provision of this Agreement to indemnification by the Company for some or a
portion of the Expenses, judgments, fines, penalties, excise taxes and amounts
paid or to be paid in settlement of a Claim but not, however, for all of the
total amount thereof, the Company shall nevertheless indemnify Indemnitee for
the portion thereof to which Indemnitee is entitled. Moreover, notwithstanding
any other provision of this Agreement, to the extent that Indemnitee has been
successful on the merits or otherwise in defense of any or all Claims relating
in whole or in part to an Indemnifiable Event or in defense of any issue or
matter therein, including, without limitation, dismissal without prejudice,
Indemnitee shall be indemnified against any and all Expenses, judgments, fines,
penalties, excise taxes and amounts paid or to be paid in settlement of such
Claim. In connection with any determination by Board Action, Arbitration or a
court of competent jurisdiction that Indemnitee is not entitled to be
indemnified hereunder, the burden of proof shall be on the Company to establish
that Indemnitee is not so entitled.

         6. No Presumption. For purposes of this Agreement, the termination of
            --------------
any claim, action, suit or proceeding, by judgment, order, settlement (whether
with or without court approval) or conviction, or upon a plea of nolo contendere
or its equivalent, shall not create a presumption that Indemnitee did not meet
any particular standard of conduct or have any particular belief or that a court
has determined that indemnification is not permitted by applicable law or this
Agreement.

         7. Contribution. In the event that the indemnification provided for in
            ------------
this Agreement is unavailable to Indemnitee for any reason whatsoever, the
Company, in lieu of indemnifying Indemnitee, shall contribute to the amount
incurred by Indemnitee, whether for judgments, fines, penalties, excise taxes,
amounts paid or to be paid in settlement and/or for Expenses, in connection with
any Claim deemed fair and reasonable in light of all of the circumstances of
such action by Board Action or Arbitration or by the court before which such
action was brought in order to reflect (i) the relative benefits received by the

                                       4

<PAGE>

Company and Indemnitee as a result of the event(s) and/or transaction(s) giving
cause to such action; and/or (ii) the relative fault of the Company (and its
other directors, officers, employees and agents) and Indemnitee in connection
with such event(s) and/or transaction(s). Indemnitee's right to contribution
under this Paragraph 7 shall be determined in accordance with, pursuant to and
in the same manner as, the provisions in Paragraphs 2 and 3 hereof relating to
Indemnitee's right to indemnification under this Agreement.

         8.       Notice to the Company by Indemnitee. Indemnitee agrees to
                  -----------------------------------
notify the Company promptly in writing upon being served with or having actual
knowledge of any citation, summons, complaint, indictment or any other similar
document relating to any action which may result in a claim of indemnification
or contribution hereunder, but the failure of Indemnitee to give such notice
shall not relieve the Company of any liability hereunder except to the extent
the Company has been materially prejudiced thereby.

         9.       Non-exclusive, Etc. The rights of the Indemnitee hereunder
                  ------------------
shall be in addition to any other rights Indemnitee may have under the Company's
Certificate or By-laws or the Delaware General Corporation Law or otherwise, and
nothing herein shall be deemed to diminish or otherwise restrict Indemnitee's
right to indemnification under any such other provision. To the extent
applicable law or the Certificate or the By-laws of the Company, as in effect on
the date hereof or at any time in the future, permit greater indemnification
than as provided for in this Agreement, the parties hereto agree that Indemnitee
shall enjoy by this Agreement the greater benefits so afforded by such law or
provision of the Certificate or By-laws and this Agreement shall be deemed
amended without any further action by the Company or Indemnitee to grant such
greater benefits. Indemnitee may elect to have Indemnitee's rights hereunder
interpreted on the basis of applicable law in effect at the time of execution of
this Agreement, at the time of the occurrence of the Indemnifiable Event giving
rise to a Claim or at the time indemnification is sought.

         10.      Liability Insurance.
                  -------------------

         (a)      To the extent the Company maintains at any time an insurance
                  policy or policies providing directors' and officers'
                  liability insurance, Indemnitee shall be covered by such
                  policy or policies, in accordance with its or their terms, to
                  the maximum extent of the coverage available for any other
                  Company director or officer under such insurance policy. The
                  purchase and maintenance of such insurance shall not in any
                  way limit or affect the rights and obligations of the parties
                  hereto, and the execution and delivery of this Agreement shall
                  not in any way be construed to limit or affect the rights and
                  obligations of the Company and/or of the other parties under
                  any such insurance policy.

         (b)      For seven years after the Indemnitee no longer serves as a
                  director or officer of the Company, the Company shall continue
                  to provide directors' and officers' liability coverage for
                  liabilities of the Indemnitee occurring during his service
                  with the Company on terms no less favorable in terms of
                  coverage and amount than such insurance maintained by the
                  Company at the date of the Indemnitee's separation from the
                  Company. In the event such coverage is not available, the
                  maximum available coverage shall be maintained pursuant to
                  this covenant.

         11.      Period of Limitations. No legal action shall be brought and no
                  ---------------------
cause of action shall be asserted by or on behalf of the Company or any
affiliate of the Company against Indemnitee, Indemnitee's spouse, heirs,
executors or personal or legal representatives after the expiration of two years
from the date of accrual of such cause of action, and any claim or cause of
action of the Company or its affiliate shall be extinguished and deemed released
unless asserted by the timely filing of a legal action

                                       5

<PAGE>

within such two-year period; provided, however, that if any shorter period of
                             --------  -------
limitations is otherwise applicable to any such cause of action such shorter
period shall govern.

         12. Amendments, Etc. No supplement, modification or amendment of this
             ----------------
Agreement shall be binding unless executed in writing by both of the parties
hereto. No waiver of any of the provisions of this Agreement shall be deemed or
shall constitute a waiver of any other provisions hereof (whether or not
similar) nor shall such waiver constitute a continuing waiver.

         13. Subrogation. In the event of payment under this Agreement, the
             -----------
Company shall be subrogated to the extent of such payment to all of the rights
of recovery with respect to such payment of Indemnitee, who shall execute all
papers required and shall do everything that may be necessary to secure such
rights, including the execution of such documents necessary to enable the
Company effectively to bring suit to enforce such rights.

         14. No Duplication of Payments. The Company shall not be liable under
             --------------------------
this Agreement to make any payment in connection with any Claim made against
Indemnitee to the extent Indemnitee has otherwise actually received payment
(under any insurance policy, By-law or otherwise) of the amounts otherwise
indemnifiable hereunder.

         15. Binding Effect, Etc. This Agreement shall be binding upon and inure
             --------------------
to the benefit of and be enforceable against and by the parties hereto and their
respective successors, assigns (including any direct or indirect successor by
purchase, merger, consolidation or otherwise to all or substantially all of the
business and/or assets of the Company), spouses, heirs and personal and legal
representatives. The Company shall require and cause any successor (whether
direct or indirect by purchase, merger, consolidation, or otherwise) to all,
substantially all, or a substantial part, of the business and/or assets of the
Company, by written agreement in form and substance satisfactory to Indemnitee,
expressly to assume and agree to perform this Agreement in the same manner and
to the same extent that the Company would be required to perform if no such
succession had taken place. This Agreement shall continue in effect regardless
of whether Indemnitee continues to serve as a director and/or officer of the
Company or of any other enterprise at the Company's request.

         16. Severability. The provisions of this Agreement shall be severable
             ------------
in the event that any of the provisions thereof (including any provision within
a single section, paragraph or sentence) are held by a court of competent
jurisdiction to be invalid, void or otherwise unenforceable, and the remaining
provisions shall remain enforceable to the fullest extent permitted by law.

         17. Notices. All notices, requests, demands and other communications
             -------
required or permitted hereunder shall be in writing and shall be deemed to have
been duly given when delivered by hand or when mailed by certified registered
mail, return receipt requested, with postage prepaid.

             A.   If to Indemnitee, to:   ___________________________
                                          3811 Turtle Creek Blvd., Suite 770
                                          Dallas, Texas  75219

or to such other person or address which Indemnitee shall furnish to the Company
in writing pursuant to the above.

             B.   If to the Company, to:  Citadel Security Software Inc.
                                          3811 Turtle Creek Boulevard, Suite 770
                                          Dallas, Texas  75219
                                          Attention:  Chief Executive Officer

                                       6


<PAGE>

or to such person or address as the Company shall furnish to Indemnitee in
writing pursuant to the above.

         18.  Governing Law. This Agreement shall be governed by and construed
              -------------
and enforced in accordance with the laws of the State of Delaware applicable to
contracts made and to be performed in such State without giving effect to the
principles of conflicts of laws.

         IN WITNESS WHEREOF, the parties hereto have duly executed and delivered
this Agreement as of the Effective Date.

CITADEL SECURITY SOFTWARE INC.


_________________________________________________
Steven B. Solomon, Chief Executive Officer



INDEMNITEE:


_________________________________________________

Name:  __________________________________________

                                       7