**UNITED
STATES SECURITIES AND EXCHANGE COMMISSION**


**WASHINGTON,
D.C. 20549**


**FORM
10-KSB**





x ANNUAL
REPORT PURSUANT TO SECTION 13 OR 15(D) OF THE SECURITIES EXCHANGE ACT OF 1934


FOR THE
FISCAL YEAR ENDED DECEMBER 31, 2004


o TRANSITION REPORT PURSUANT TO SECTION 13 OR 15(D) OF THE SECURITIES EXCHANGE ACT
OF 1934


COMMISSION
FILE NUMBER: 000-33491








**CITADEL
SECURITY SOFTWARE INC.**


(NAME OF
SMALL BUSINESS ISSUER IN ITS CHARTER)





DELAWARE
    
    75-2873882(STATE
      OR OTHER JURISDICTION OF
    
    (I.R.S.
      EMPLOYERINCORPORATION
      OR ORGANIZATION)
    
    IDENTIFICATION
      NO.)





TWO
LINCOLN CENTRE, SUITE 1600, 5420 LBJ FREEWAY, DALLAS, TEXAS 75240


(ADDRESS
OF PRINCIPAL EXECUTIVE OFFICES)


(214)
520-9292


(ISSUER’S
TELEPHONE NUMBER, INCLUDING AREA CODE)





SECURITIES
REGISTERED UNDER SECTION 12(B) OF THE EXCHANGE ACT: NONE


SECURITIES
REGISTERED UNDER SECTION 12(G) OF THE EXCHANGE ACT:


COMMON
STOCK, PAR VALUE $.01 PER SHARE


(TITLE OF
CLASS)





Check
whether the issuer (1) filed all reports required to be filed by Section 13 or
15(d) of the Securities Exchange Act of 1934 during the past 12 months (or for
such shorter period the Registrant was required to file such reports), and (2)
has been subject to such filing requirements for the past 90 days. Yes x No o





Check if
disclosure of delinquent filers in response to Item 405 of Regulation S-B is not
contained in this form, and no disclosure will be contained, to the best of
Registrant’s knowledge, in definitive proxy or information statements
incorporated by reference to such filing requirements incorporated by reference
in Part III of this Form 10-KSB or any amendment to this Form 10-KSB. x





State
issuer’s revenue for its most recent fiscal year $15,253,155





Indicate
by check mark whether the registrant is an accelerated filer (as defined in Rule
12b-2 of the Act). Yes o No x





As of
March 30, 2005, there were outstanding 29,845,730 shares of common stock, par
value $.01 per share.  The aggregate market value of common stock held by
non-affiliates of the issuer (25,512,372 shares) based on the closing price of
the issuer's common stock as reported on the Nasdaq SmallCap Market of
$1.10 per share, on March 30, 2005, was $28,063,609.  For purposes of this
computation, all executive officers, directors, and 10% beneficial owners of the
issuer are deemed to be affiliates.  Such determination should not be
deemed an admission that such officers, directors, or 10% beneficial owners are,
in fact, affiliates of the issuer.




DOCUMENTS
INCORPORATED BY REFERENCE
 
 The
information required by Part III of this Report, to the extent not set forth
herein, is incorporated by reference from the registrant’s definitive proxy
statement to be filed with the Commission within one hundred and twenty (120)
days following the registrant’s fiscal year end, or on or before April 30,
2005.


Transitional
Small Business Disclosure Format.  Yes o  No x





****





CITADEL SECURITY SOFTWARE INC.


FORM
10-KSB


ANNUAL
REPORT


FOR THE
FISCAL YEAR ENDED


DECEMBER
31, 2004





Table of
Contents


**PART
      I**
    PageItem 1.  Description of Business
    4Item 2.  Description of Property
    33Item 3.  Legal Proceedings
    33Item 4.  Submission of Matters to a Vote of Security
      Holders
    33**PART
      II**Item 5.  Market for Common Equity and Related
      Stockholder Matters
    34Item 6.  Management’s Discussion and
      Analysis
    36Item 7.  Financial Statements
    50Item 8.  Changes in and Disagreements with
      Accountants on Accounting and Financial Disclosure
    50Item 8A. Controls and Procedures
    50Item 8B.  Other Information
    50**PART
      III**Item 9.   Directors and Executive Officers of the
      Registrant
    51Item 10.  Executive Compensation
    51Item 11.  Security Ownership of Certain Beneficial
      Owners and Management and Related Stockholder Matters
    51Item 12.  Certain Relationships and Related
      Transactions
    51Item 13.  Exhibits
    51Item 14.  Principal Accountant Fees and
      Services
    51Signatures
    52




**2**
 Table of Contents





**PART
I**


CAUTIONARY
STATEMENT REGARDING FORWARD-LOOKING STATEMENTS





This
report on Form 10-KSB contains forward-looking statements within the meaning of
the Private Securities Litigation Reform Act of 1995. Citadel Security Software
Inc. (“Citadel” or the “Company”) bases these forward-looking statements on its
expectations and projections about future events, which Citadel has derived from
the information currently available to it. In addition, from time to time,
Citadel or its representatives may make forward-looking statements orally or in
writing. Furthermore, forward-looking statements may be included in Citadel’s
filings with the Securities and Exchange Commission or press releases or oral
statements made by or with the approval of one of Citadel's executive officers.
For each of these forward-looking statements, Citadel claims the protection of
the safe harbor for forward-looking statements contained in the Private
Securities Litigation Reform Act of 1995. These forward-looking statements
relate to future events or Citadel’s future performance, including but not
limited to:





·
    possible
      or assumed future results of operations;


·
    future
      revenue and earnings; and


·
    business
      and growth strategies





Forward-looking
statements are those that are not historical in nature, particularly those that
use terminology such as may, could, will, should, likely, expects, anticipates,
contemplates, estimates, believes, plans, projected, predicts, potential or
continue or the negative of these or similar terms. The statements contained in
this Report that are not purely historical are forward-looking statements within
the meaning of Section 27A of the Securities Act of 1933, as amended, and
Section 21E of the Securities Exchange Act of 1934, as amended, including
statements regarding the Company’s expectations, beliefs, intentions or
strategies regarding the future. Forward-looking statements are subject to
certain known and unknown risks and uncertainties that could cause actual
results to differ materially from those expressed in any forward-looking
statements. These risks and uncertainties include, but are not limited to, the
following important factors with respect to Citadel:





(1) the
uncertainty of general business and economic conditions, including the potential
for a slowdown in business and governmental expenditures on information
technology and software;





(2) the
impact of competition, both expected and unexpected;





(3)
adverse developments, outcomes and expenses in legal proceedings;





(4) the
risk that underlying assumptions or expectations related to the spin-off from
our former parent company prove to be inaccurate or unrealized;





(5) the
Company’s inability to realize the anticipated benefits of strategic and
operational initiatives related to increased productivity, new product
development, technological advances, and the achievement of sales growth across
the business segments; and





(6) those
described under Risk Factors.





Forward-looking
statements are only predictions as of the date they are made and are not
guarantees of performance. All forward-looking statements included in this
document are based on information available to Citadel on the date of this
Annual Report. Readers are cautioned not to place undue reliance on
forward-looking statements. The forward-looking events discussed in this report
on Form 10-KSB and other statements made from time to time by Citadel or its
representatives may not occur, and actual events and results may differ
materially and are subject to risks, uncertainties and assumptions about Citadel
including without limitation those discussed elsewhere in this Annual Report
under the heading Risk Factors as well as those discussed elsewhere in this
Annual Report, and the risks discussed in our Securities and Exchange Commission
filings. Except for their ongoing obligations to disclose material information
as required by the federal securities laws, Citadel is not obligated to publicly
update or revise any forward-looking statement, whether as a result of new
information, future events or otherwise. In light of these risks, uncertainties
and assumptions, the forward-looking events discussed in this Annual Report on
Form 10-KSB and in other statements made from time to time by Citadel or its
representatives might not occur.





**3**
 Table of Contents





“Citadel,”
the "Company," “we,” “us,” and “our” refer to Citadel Security Software
Inc. **** Hercules®,
AssetGuardTM, ConnectGuardTM, Secure PCTM and NetOFFTM are trademarks or registered
trademarks of Citadel Security Software Inc. Other trademarks that may be
mentioned in this Form 10-KSB are intellectual property of their respective
owners.





**ITEM 1.    DESCRIPTION OF
BUSINESS**





**OVERVIEW**





Citadel
provides enterprise vulnerability management and policy compliance and
enforcement solutions that enable organizations to reduce the risk associated
with vulnerabilities in computer and network systems. With our solutions, public
and private enterprises are able to realize cost and process efficiencies,
proactively manage the latest threats and vulnerabilities and demonstrate
compliance with corporate mandates or government legislation. Vulnerabilities
are one of the fastest growing threats to enterprise network security, and since
its inception in 1996, Citadel has been developing software products and
services to mitigate the risk of security vulnerabilities. Today, Citadel is a
leader in enterprise vulnerability management solutions, helping enterprises
effectively neutralize security vulnerabilities through automated vulnerability
remediation (AVR) technology.





Citadel
recognizes the importance of providing a platform built for the purpose of
enterprise vulnerability management. Our solutions provide capabilities to
secure the enterprise and focus on the needs of both security and information
technology (“IT”) operations professionals. Our team of security professionals
provides up-to-date vulnerability intelligence and has created the world’s
largest library of vulnerability remedies, exceeding 20,000 as of the filing
date of this Form 10-KSB. Citadel provides advanced software solutions that
address the growing security concerns of enterprises. Our products include
Hercules AVR, ConnectGuard, AssetGuard, SecurePC and NetOFF.





With
Citadel’s advanced AVR technology, enterprises now have a powerful, secure and
automated patch management and vulnerability remediation solution. Citadel’s
suite of vulnerability management solutions enables organizations to proactively
protect against vulnerabilities, saving valuable time and money, while
mitigating risk and complying with corporate and government mandates.





Our
vision is to change the future of securing computing devices in enterprise
environments. Our mission is to be a global leader in enterprise vulnerability
management software and to continually develop innovative solutions to secure IT
networks. It is our goal to ensure the continuity of business and the
availability of technology by eliminating the impact of security threats.





We are
driven to provide the highest level of customer satisfaction. By executing all
aspects of our business, including development, quality assurance, support,
marketing, professional services and sales with passion and dedication, we will
continue to earn the trust and confidence of our customers and the business and
government communities at large.





Citadel's
security software business was formed in 1996 as the result of the acquisition
of several technology businesses operated by a business incubator from 1996
through May 17, 2002 at which time Citadel was spun out from its former parent
as a stand alone company. Citadel is listed on the NASDAQ SmallCap Market and
trades under the symbol CDSS. Citadel is a Delaware corporation with its
headquarters in Dallas, Texas, a regional office in Washington, D.C. to support
public sector operations, and local sales offices in New Jersey, Illinois,
California and Michigan. Our website is located at www.citadel.com. We make
available, free of charge, our annual reports on Form 10-KSB, quarterly reports
on Form 10-QSB and current reports on Form 8-K, and any amendments to those
reports filed pursuant to Section 13(a) or 15(d) of the Securities Exchange Act
of 1934 through our Investor Relations website, as soon as reasonably
practicable after they are electronically filed with or furnished to the SEC.
The contents of our website are not incorporated into, or otherwise to be
regarded as a part of, this Annual Report on Form 10-KSB.





**SECURITY
SOFTWARE MARKET**





The
market for software and hardware security technology has many players and many
products that secure networks systems from attack, accident or failure from
outside and inside influences. We are actively engaged in the vulnerability
management market and more specifically, in the “policy administration,
compliance and enforcement” and “automated vulnerability remediation” segments.
Our NetOFF and Secure PC products participate in the policy administration
category. Hercules, ConnectGuard and AssetGuard are positioned in the heart of
the vulnerability management market, specifically automated vulnerability
remediation but also cross over into policy compliance and
enforcement.





**4**
 Table of Contents





We
believe that the market drivers that are beginning to develop are in part
derived from mandates, liability concerns and security breaches. Examples of
each are as follows:





·
    The
      audit community is addressing the implementation of the Sarbanes-Oxley Act
      and related regulations and the related liability issues. We believe that
      both the internal and external audit community will begin to take the
      position that a key part of certifying the integrity of financial
      statements is the examination of the IT infrastructure and accompanying
      security practices that are the basis of the protection of the data and
      systems that produce the financial
statements.





·
    The
      issue of liability attached to successful compromises that may produce an
      adverse impact on information or data, such as theft, corruption,
      manipulation, or similar actions, that could result in a financial loss to
      investors or shareholders. We believe that some insurance companies are
      beginning to examine vulnerability assessment and remediation practices of
      their insured base during the renewal application process for various
      forms of liability and Internet risk insurance.





·
    A
      renewed focus on privacy issues gaining higher public profile by the more
      frequent announcements of data loss or systems compromise to unauthorized
      access. California bill SB1386 requires that a person or business that
      conducts business in California, that owns or licenses computerized data
      that includes personal information to publicly disclose any breach of the
      security of the data to any resident of California whose unencrypted
      personal information was, or is reasonably believed to have been, acquired
      by an unauthorized person. Other states are proposing similar
      laws.





We see
the security market being driven by the following prime factors:





·
    Existing
      and potential legislation and mandates are requiring enhanced IT security
      in government and industry. These mandates are expected to drive
      organizations to look at the potential liability and potential loss
      created by insecure networks.





·
    Vulnerabilities
      are growing in number, scope and breadth of device coverage; exploits of
      vulnerabilities by worms, viruses, backdoors and other malware are
      becoming more malicious in nature resulting in potentially more severe and
      widespread damage; and the time between the identification of a
      vulnerability and its exploit is shrinking from months to weeks or
      days.





·
    Innovative
      automated solutions are necessary to replace manual processes and point
      solutions.





Our
strategy is to address these market drivers with the suite of Hercules products,
new product development and strategic marketing to the customers that have an
identified need for vulnerability remediation.





**LEGISLATION
AND MANDATES**





Government
mandates and new legislation are driving public and private sector enterprises
to improve the security of their networks. Mandates and laws affecting systems
security include:





·
    Clinger-Cohen
      Act of 1996 establishes responsibilities for information technology
      investment decision making and capital planning, and establishes the role
      of the federal Chief Information Officer. In 2004 as part of the National
      Intelligence Reform Act of 2004, Congress amended the Clinger-Cohen Act to
      set forth information security as a required element of federal
      information technology investment decision making and strategic
      planning.


·
    Health
      Insurance Portability And Accountability Act Of 1996 (“HIPAA”) - Certain
      provisions of HIPAA require organizations to protect the privacy of
      patient data.


·
    Presidential
      Directive 63 (PDD 63), May 1998 - This White Paper explains key elements
      of the Clinton Administration’s policy on critical infrastructure
      protection.





**5**
 Table of Contents





·
    Gramm
      Leach Bliley Act of 1999 (“GLB”) includes provisions to protect consumers’
      personal financial information held by financial
    institutions.


·
    Security
      of Federal Automated Information Systems, November 2000 - This OMB
      memorandum is issued as a reminder to federal agencies and departments of
      their responsibilities for the security of their respective automation
      resources.


·
    Executive
      Order 13231: Critical Infrastructure Protection in the Information Age,
      October 2001 - This order directs a senior executive branch board to work
      with state and local governments, industry and others to create and manage
      systems for cyber security threat warning and incident analysis.


·
    Title
      III of the 2002 E-Gov Act - The Federal Information Security Management
      Act (“FISMA”) mandates that each government agency perform a risk
      assessment of the security of their information systems and mitigate the
      risk of attack.


·
    Sarbanes-Oxley
      Act of 2002 - Section 404 of the act requires that auditors of public
      companies attest to management’s assessment of the effectiveness of
      internal controls including security controls against loss of data or
      unauthorized access to data.





Each of
these directives places an emphasis on securing systems, personal data and
financial information from intentional or unintentional unauthorized access.





**VULNERABILITIES**





A
vulnerability is any weakness in systems configuration, systems services or
software code that may be exploited thereby allowing the running of a malicious
code or the unauthorized access by an individual to obtain information or do
damage to an organization’s computing environment. We classify vulnerabilities
into five classes: unnecessary services, mis-configurations, backdoors, unsecure
accounts and software defects. Vulnerabilities are proliferating rapidly in
number, sophistication and scope of coverage. CERT/CC® at Carnegie Mellon
University’s Software Engineering Institute (http://www.cert.org) has
identified over 16,000 unique vulnerabilities since 1995 that negatively affect
computer systems. Vulnerabilities are the targets of such well publicized
malicious code as MyDoom, SQL Slammer, Blaster, Nimda, Code Red and Sasser.
These worms look for vulnerabilities to exploit in networked systems in order to
do damage.





In
addition, the scope or breadth of coverage of vulnerabilities is also growing as
the number of internet connected devices continues to rise. A January 2005
Internet Domain Survey published by the Internet Software Consortium
(http://www.isc.org) reports that the number of named internet protocol
(“IP”) addresses exceeds 317,000,000. This is up nearly 85 million IP addresses
from a year earlier survey, opening up more pathways to systems that have
unremediated vulnerabilities. Companies and government agencies are susceptible
to more avenues of attack by more sophisticated worms and viruses and in greater
numbers of attacks. According to a recent report on the CERT/CC® website, the
2004 E-Crime Watch survey conducted among security and law enforcement
executives by CSO magazine in cooperation with the United States Secret Service
and the Carnegie Mellon University Software Engineering Institute’s CERT®
Coordination Center, shows a significant number of organizations reporting an
increase in electronic crimes (e-crimes) and network, system or data intrusions.
More than 40% of respondents reported an increase in e-crimes and intrusions
compared to the previous year and approximately 70% reported at least one
e-crime or intrusion was committed against their organization. Respondents
indicated that e-crimes cost their organizations approximately $666 million in
2003. “Complete findings from the 2004 E-Crime Watch survey can be found at
http://www.csoonline.com/releases/052004129 
release.html.





Implement
Best Practices





We
believe that the risk of exploitation and the associated cost of a potential
attack, can be mitigated through the implementation of best practices including
proactive vulnerability management including hardening systems, implementation
of security policies, frequent assessment of the security posture, automated
remediation of identified vulnerabilities, and routine and frequent monitoring
of compliance with the organization's predefined security policies. The best
practice of proactive vulnerability management is the process of independent
assessment, compliance validation, reporting of non-compliance and then an
independent remediation of vulnerabilities found in computer systems and
networks. We believe that these steps are the cornerstone requirements of
vulnerability management capabilities. The strength of sound vulnerability
management best practices is the timely remediation of the vulnerabilities and
then the ongoing monitoring of compliance with established security policies.
Identifying, reporting and then managing vulnerabilities in any system without
proactive remediation and compliance monitoring processes leaves that system as
vulnerable to attack, accident or failure, just as if no risk assessment had
been performed. Also, independent assessment and independent remediation
functions provide information assurance due to the separation of the two
duties.





**6**
 Table of Contents





In order
to ensure the highest level of security (as it relates to vulnerability
remediation) with the least amount of interruption, we recommend adherence to
best practices policy outlined below:





1.
    Identify
      Devices - Administrators should use an assessment tool or network mapping
      software that can scan all networks (and sub-networks) to determine used
      TCP/IP addresses and the associated devices connected to them.
      Administrators should also determine which systems are most critical to
      prioritize and protect.


2.
    Assess
      Vulnerabilities - This is typically performed using an independent
      vulnerability assessment tool. Hercules is interoperable with one, or can
      aggregate output data from multiple independent scanners including:
      FoundStone® FoundScan EngineTM, Harris STAT® Scanner, ISS Internet
      Scanner®, ISS System Scanner®, ISS Site Protector, Microsoft® MBSA,
      nCircle IP360TM, Nessus Scanner, netVigilance SecureScout NX, Qualys
      QualysGuardTM Scanner, Retina® Digital Security Scanner, Saint Corp. SAINT®
      Scanning Engine and Tenable NeWT.


3.
    Review
      Vulnerabilities - Once the vulnerability assessment data has been imported
      into Hercules, the administrator should review the vulnerabilities and the
      remediation steps that Hercules will take to resolve the vulnerability
      prior to approving the remediation.


4.
    Remediate
      Vulnerabilities - Once the vulnerabilities have been reviewed, each
      device, or group of devices, can be selected and scheduled for
      remediation.


5.
    Proactively
      Manage New Vulnerabilities - Since new vulnerabilities are identified
      daily, and users can also re-introduce vulnerabilities into their
      environments, it is important to regularly assess and remediate network
      devices.





We
encourage our customers to adopt a proactive approach to vulnerability
management through the adoption of Citadel's best practices policy outlined
above.





**INNOVATIVE
SOLUTIONS REPLACE INEFFICIENT PROCESSES**





A recent
report, the 2004 E-Crime Watch survey also noted that the most common
technologies deployed to combat e-crimes are firewalls (used by 98% of
respondents), followed by physical security systems (94%) and manual patch
management (91%). Ranking the effectiveness of various technologies, firewalls
were considered most effective (71%), followed by encryption of critical data in
transit (63%) and encryption of critical data in storage (56%). Manual patch
management, the third most common technology in use, was rated as the single
least effective technology (23%). Among policies and procedures, conducting
regular security audits was listed as the most effective method (51%), and
recording or reviewing employee phone conversations is listed as one of the
least effective (26%).  Complete findings from the 2004 E-Crime Watch
survey can be found at http://www.csoonline.com/releases/052004129
release.html.





The
manual patch management process was reported by the survey respondents as “the
least effective technology.” Citadel’s solutions were designed and developed to
go far beyond the automation of the manual patch management process and in
addition to patching, address the remediation of vulnerabilities that are
directly related to an organization’s security policies, often associated with
the other four classes of vulnerabilities: unnecessary services,
mis-configurations, backdoors, unsecure accounts, as well as patch management.
Our solutions address the maintenance of an organization’s security
configuration posture to proactively protect its information technology
infrastructure through the implementation of best security practices.





**POLICY
ADMINISTRATION/COMPLIANCE**





The
policy administration and compliance market is a mature market with many
companies including Symantec, Microsoft, RSA and Computer Associates, to name a
few. This market has grown around the need for organizations to control access
to desktop and system settings, thereby reducing costs associated with downtime
and reconfiguration of systems, and the need to control unauthorized access,
whether internal or external to the company, of confidential information thereby
meeting organizational or mandated security and privacy requirements.
Healthcare, Financial Services, Education and eCommerce are just a few of the
industries that require tools to protect private information and to restrict
user access to system settings that can cause down time and require extensive
cost and time to repair.





**7**
 Table of Contents





Our
strategy is to position NetOFF and Secure PC as critical components to the
overall security and privacy posture of organizations in the Healthcare,
Financial, Educational, applicable corporate industries and government agencies.
We will continue to market and license these products into the industries in
which we have gained a foothold. We will furthermore seek to expand the new
customer relationships developed through sales of Hercules to include SecurePC
and NetOFF.





**OUR
PRODUCTS**





***Hercules***





Hercules
is an enterprise vulnerability management platform with integrated processes to
effectively neutralize security vulnerabilities. Our award-winning Hercules®
suite of solutions includes vulnerability remediation, AssetGuardTM for asset
discovery and inventory and ConnectGuardTM for endpoint security. Hercules
reduces vulnerability remediation time from months to minutes, using the world’s
largest library of over 20,000 proven remedies. Hercules supports remediation on
multiple operating systems, including Microsoft Windows, UNIX, Linux and Mac OS
X; is certified on Windows 2000 and 2003; and we believe that it is the only AVR
solution that has achieved Common Criteria Certification, Evaluation Assurance
Level 3("EAL 3"). In addition, Hercules is Open Vulnerability Assessment
Language **** (OVAL)
and Common Vulnerabilities and Exposures (CVE) compliant.





*Full
Control and Automated Flexibility*





Hercules
allows users full control over the remediation process, enabling efficient
aggregation, prioritization and resolution of vulnerabilities that are detected
by industry leading vulnerability assessment tools. Administrators maintain
complete control over scheduling remediation, selecting when and which
vulnerabilities to be resolved or if desired, remediate on demand. We believe
that the ever growing number of vulnerabilities, the increase in the
maliciousness of the attacking code and the potential liability from an attack,
now requires a twenty-four hour commitment to security management in order to
mitigate the risk of data and financial loss. Hercules replaces the time
consuming process of patch and security configuration often performed manually,
one device at a time. In some cases, customers have used point solutions for
patch management or software distribution tools to deploy scripts. However,
neither of these tools were designed to be a comprehensive vulnerability
management solution that address all five classes of vulnerabilities with access
to a library of more than 20,000 tested remedies.





*Interoperability*





Hercules
is interoperable with industry leading vulnerability assessment tools
(“Scanners”) including FoundStone® FoundScan EngineTM, Harris STAT® Scanner, ISS
Internet Scanner®, ISS System Scanner®, ISS SiteProtector®, Microsoft® MBSA,
Nessus Scanner, NextaniS SecureScout SPTM, Qualys QualysGuardTM Scanner, eEye
Retina® Digital Security Scanner, Saint Corp. SAINT® Scanning Engine, Tenable
NeWT and nCircle IP360TM. The independency of the Scanner and Hercules
remediation provides a level of information assurance that is typically attained
from a separation of duties. We believe that interoperability with multiple
Scanners gives Hercules distinct advantages over other solutions, including:





1.
    Hercules
      allows customers to leverage their existing investment in the
      vulnerability assessment tools already in
use.


2.
    Customers
      have the option to add Scanners for redundancy or to meet specific needs
      of internal controls and corporate or government
  mandates.


3.
    Interoperability
      with multiple Scanners provides for the separation of duties - independent
      assessment followed by independent
remediation.


4.
    Scan
      data from multiple Scanners can be aggregated and correlated to specific
      devices or groups of devices. Remediation can then be scheduled based on
      the customer’s priority.





Hercules
goes beyond rudimentary patch management utilities and systems configuration
management solutions. Patch management solutions generally address only software
defects. Some patch management solutions have a built-in Scanner that finds only
those vulnerabilities which the patch management solution can patch, thereby
covering only a small percentage of security breaches on the network and leaving
the system susceptible to other vulnerabilities and out of compliance with
mandates. Some solutions apply patches indiscriminately without regard to having
previously applied the patch. In addition, solutions with built-in Scanners do
not meet information assurance requirements for separation of duties,
independent assessment and remediation.





**8**
 Table of Contents





Systems
configuration management and software distribution solutions were not designed
as security solutions and therefore do not address vulnerabilities without a
programmer writing scripts for each remediation. This takes time and personnel
resources away from network operations. Alternatively, a customer using Hercules
does not need to write the remedies to remove a vulnerability. Hercules has a
repository of over 20,000 remediation actions that have been thoroughly tested
and are available to Hercules customers under the support services agreement.





In
addition to the tactical application of remediation actions, Hercules also
provides an intuitive framework for managing the remediation process by allowing
customers to prioritize and aggregate vulnerability information based upon
groups, devices or severity and provides centralized command and control of the
entire remediation effort. Hercules utilizes a server for the presentation of
the Hercules console and the residence of the remediation action database. The
Hercules console is the central point of control for the systems administrator
("SA") functionality.





*Three
approaches to Vulnerability Management with Hercules*





The first
step is for the assessment to take place. Hercules supports three approaches to
assessment; top-down (policy enforcement), targeted (action packs), and
bottom-up (import scan and remediate, the traditional approach).





Top-down
Vulnerability Management





This is a
more strategic form of risk reduction provided by the Hercules EVM suite
commonly referred to as Policy Management. This approach entails establishing
asset and security configuration baselines, then managing deviations from those
baselines where vulnerabilities may result. In this approach, vulnerabilities
are managed as exceptions from a policy-driven desired state. This requires the
Hercules AssetGuard component to capture and manage asset baseline information,
and to provide a workflow that spans across the information technology security
and operations teams, effectively linking and aligning enterprise security to
operational objectives. Further extending the top-down approach is the Hercules
ConnectGuard component which provides end point security allowing an
organization to control the processing of IT security policy when a device
connects to the corporate network.





Targeted
Vulnerability Management





This type
of risk reduction is new to the Hercules EVM suite with the release of Hercules
3.5. This approach enables IT Security to immediately identify and remediate
vulnerabilities on key assets. The Hercules EVM solution leverages detailed IT
asset information to rapidly pinpoint devices that are at risk and that require
vulnerability remediation or IT policy enforcement. This improves productivity
and links remediation to operational objectives by allowing organizations to
target only those devices that need remediation to meet their specific IT
security policies.





Bottom-up
Vulnerability Management





This is
essentially the traditional form of risk reduction provided by Hercules,
commonly referred to as Scan and Remediate. Using this approach IT Security
personnel scans the environment using Vulnerability Assessment tools (Scanners)
or services, then remediates the vulnerabilities reported. This approach is
driven by security policy requirements to manage the vulnerability state of the
environment as a whole, and each component host within that environment, by
discovery and remediation. The Hercules EVM solution extends this capability by
enabling this process to occur within one centralized solution. Vulnerabilities
and remedies are both managed across the IT Security and IT Operations
departments while maintaining appropriate separation of duties. By importing
vulnerability assessment data from industry-leading scanners, the Hercules EVM
solution enables IT Security to normalize, aggregate and prioritize
vulnerabilities across the enterprise. Once prioritized, they can be remediated
on demand or on a scheduled basis by IT Operations personnel. A
vulnerability-centric view pervades this process, removing disconnects among
departments regarding scheduling and prioritizing remediation, and providing
awareness of critical security problems.





**9**
 Table of Contents





*Architecture
and Ease of Use*





Hercules
utilizes a 3-tier architecture to manage and control the remediation process. To
illustrate we will use the traditional bottoms up approach discussed above. The
first step is for the assessment to take place utilizing any of the supported
scanners. Scan data from the vulnerability assessment tools is then imported
into the Hercules Server. Second, the systems administrator, or SA will execute
a V-Flash update to access, via the Internet, the latest remedies retained in
the secured V-Flash server that are continually updated by a team of Citadel
security engineers. The secured V-Flash server contains the remedies that are
then matched to the vulnerabilities identified by the scanners. During the
V-Flash update, the customer also downloads new vendor patches from the vendor
sites for storage on the customer’s server. Each patch is downloaded only once
and stored for remedial action on the Hercules server thereby reducing the time
for deploying a patch. Using the Hercules console, the SA will follow best
practices and select the vulnerabilities to be remediated. The SA may remediate
all or only selected vulnerabilities. Vulnerability management best practices
recommend that vulnerabilities be selected in groups and scheduled for
remediation. This best practice allows the SA to manage the process to suit time
requirements, system availability and to prioritize the remedy of the
vulnerabilities that are of high priority as may be determined by the SA.





Third,
once remediation actions have been applied and completed, the SA has the option
to run a differential scan to confirm the application of the remediation actions
and to set a baseline for the next assessment and remediation process. In
addition, detailed reports of the entire process can be run to highlight the
number and severity of remediation actions taken, the severity of the
vulnerabilities and the vulnerabilities that can only be remediated manually. An
example of a remediation action that must be performed manually is a
vulnerability that can only be remediated through the acquisition of another
license from the vendor or one that requires a user intervention.





Hercules
is an enterprise class product that under appropriate licensing may be deployed
with vulnerability assessment tools and Hercules consoles anywhere in a network,
including across geographies. Access to V-Flash updates is available over the
Internet or through offline updates for an additional fee. All communication
between the various Hercules endpoints is performed using the industry standard
Hypertext Transfer Protocol (“HTTP”) and Simple Object Access Protocol (“SOAP”)
protocols.





*Vulnerability
Intelligence Gathering and the Remedies*





A
vulnerability is any weakness in system configuration, systems services or
software code that may be exploited thereby allowing the running of a malicious
code or the unauthorized access by an individual to obtain information or do
damage to an organization’s computing environment. An exploit is an identified
action in the form of a worm, virus, malware or other software code that has
been written by a hacker to attack a specific vulnerability.





Our
Remediation Security Group monitors the sources of potential attack information
(such as Internet Relay Chat (“IRC”) channels and alerts from our scanning
partners) and collects and compiles vulnerability data, creates new remedies and
makes them available to our customer base on a routine basis during the term of
the customer support agreement. Less than 20 to 30% of vulnerabilities are
related to software defects which are repaired by installing a software patch.
The remaining 70 to 80% of vulnerabilities are related to unsecured accounts,
backdoors, unnecessary services and mis-configurations which collectively with
software defects define the five classes of vulnerabilities. These last four
classes of vulnerabilities require configuration changes and settings to be
revised.





When new
vulnerabilities are identified, our team of security engineers known as the
Remediation Security Group, researches the possible solutions and writes a
remedy for the identified vulnerability. The remedy is then tested before it is
made available to our customers. Using V-Flash, our automated delivery
mechanism, the customer can download the new remedies through the Hercules
server to provide their networks access to the latest source of remedies
available. In addition to delivering new remedies, our Remediation Security
Group also continually monitors and updates research information and URL links
for patches and related content to ensure that all links and research material
are timely and relevant.





In
addition to V-Flash delivered remedies, Hercules provides the functionality for
customers to write their own remedies or customize existing remedies using a
graphical interface. This interface provides all the power and flexibility in
writing remedies that is available to Citadel’s in-house security team. Using
this feature, our customers can develop and deliver remedies for custom
applications. Our Remediation Security Group has used this capability to create
baseline configurations such as the organization known as SANS (an acronym for
SysAdmin, Audit, Network, Security) and National Security Agency (“NSA”) Guides
or other configuration guideline standards. These configuration templates ship
with the Hercules product.





**10**
 Table of Contents





*Hercules
Certifications*





The
Common Criteria (“CC”) certification project was developed by the United States,
Canada and Europe to establish a set of international standards for information
security products that became ISO International Standard 15408 in 1999. The
United States is represented within the CC Project by the National Information
Assurance Partnership (“NIAP”), a joint National Institute of Standards and
Technology (“NIST”) and NSA project. The CC provides a comprehensive, rigorous
method for specifying security functionality and assurance requirements for IT
security products (or classes of products).





On
January 1, 2001, the federal government issued a policy stating that preference
was to be given to the acquisition of Commercial Off-The-Shelf (“COTS”)
Information Assurance (“IA”) IT products (to be used on systems entering,
processing, storing, displaying, or transmitting national security information)
which had been evaluated and validated, as appropriate, in accordance with:





·
    The
      International Common Criteria for Information Security Technology
      Evaluation Mutual Recognition Arrangement;


·
    The
      National Security Agency (NSA) /National Institute of Standards and
      Technology (NIST) National Information Assurance Partnership (NIAP)
      Evaluation and Validation Program; or


·
    The
      NIST Federal Information Processing Standard (FIPS) validation program.





Effective
July 1, 2002, the federal government issued a policy stating that the
acquisition of all COTS IA and IA-enabled IT products to be used on the systems
specified above would be limited only to those which have been evaluated and
validated in accordance with the criteria, schemes, or programs specified by CC,
NIAP or FIPS.




Recognizing
that CC certification was required for defense department agencies to purchase
IT security products, Hercules was registered for Common Criteria evaluation in
March 2003. Products undergoing Common Criteria testing are required to have an
independent lab certify the product. The testing is done according to strict
criteria and designated an evaluation assurance level (“EAL”). The Hercules
product achieved EAL 3 certification through Electronic Warfare Associates -
Canada, Ltd ("EWA") on March 1, 2004. Citadel has a continuous maintenance
program with EWA to ensure future updates and revisions are reviewed and
re-evaluated as needed. At December 31, 2004, we were not aware of any customer
or market requirements to achieve CC certifications above our present
certification of EAL 3, therefore we do not expect to seek a higher level of CC
compliance; however, as major versions of the product are planned in the future
we will consider the need to increase the level of compliance which is
appropriate to the then current installed customer base or a potential group of
new customers.





Hercules
has undergone testing at the US Army’s Information Systems Engineering Command,
Technology Integration Center (“TICLabs”) at Ft. Huachuca, Arizona. TICLabs
performs independent product evaluations and evaluated the functionality,
manageability and security of Hercules that would be applicable and valuable to
the Department of Defense. Hercules was put through a rigorous set of test
requirements, passing each of the requirements tested. TICLabs concluded that
Hercules performed as expected and automates the remediation process as
represented in the technical specifications.





Hercules
achieved certification for installation on Windows Server 2000 and 2003 Standard
Editions to support remediation of those environments. This certification
demonstrates to customers that Hercules provides the highest levels of
reliability running on Windows and automating the mitigation of vulnerabilities
identified on the Windows family of products. In addition, Citadel attained
Microsoft Gold Certification Partnership status demonstrating Citadel’s
competence on the latest Microsoft technologies and a commitment to delivering
high quality solutions for the Windows platform. The Microsoft Gold Certified
Partner Program was established to identify Microsoft Certified Partners who
have proven their commitment and expertise in building or delivering solutions
based on Microsoft technologies. By becoming a Gold Certified Partner, we have
once again demonstrated our expertise in the remediation of Windows platforms
and will now be able to leverage Microsoft’s referral program to customers
looking for a complete vulnerability remediation solution.





**11**
 Table of Contents





*Hercules
Reporting and Other Features*





As with
any security product, we believe that reporting and visibility of progress is a
key component. Hercules provides full reporting at various levels, including
management and technical reports, as well as compliance reports. Hercules
provides various trend analysis reports to provide a visual indicator of the
progress of remediation based upon pre- and post- remediation scan data. All
reports can be reviewed at strategic field levels or accessed via a master
console for full view and querying of remediation status and overall risk
exposure. Reports are generated through a reporting engine and pull information
directly from the Hercules Repository. With the appropriate training, users can
create and customize their own reports to fulfill mission critical requirements.
All reports can be exported to various formats including PDF, Word, Excel and
HTML. In addition to user customizable reports, Citadel offers a range of
customization services to provide report capabilities tailored to specific
customer requirements. Hierarchical rollup reporting is currently available to
customers with a pre-qualified MS SQL environment via a professional services
engagement. Hierarchical reporting is expected to be available as a separate
component of the Hercules 4.0 release anticipated in the second quarter of 2005.





Remediation
compliance is managed by the Hercules agent to prevent vulnerabilities from
being re-introduced into the network through common mistakes such as installing
software without eliminating its vulnerabilities or changing the configuration
of a device. Based upon user defined polling intervals, the Hercules client will
revalidate previously resolved vulnerabilities to enable proper compliance of
the device. This compliance function allows system administrators the ability to
create and maintain custom hardening guides based upon industry standards such
as SANS and NSA Guide for Securing Windows 2000, CIS Gold Standard and Microsoft
Hardening guides. These hardening templates can be customized to suit the
particular work task and security requirements of the device and will be
enforced based upon the rules and scheduling set by the administrator. Any
changes to the device configuration will be brought back into compliance and
have audit reporting associated to indicate what vulnerabilities re-occur over
time and on which devices.





Hercules
supports role based remediation and policies to selectively enforce which
administrators have the right to approve remediation, change or create new
remedies and templates and set the enforceability of specific vulnerabilities.
These policies leverage the significant security knowledge in a top down
management approach allowing policies to be created and maintained by the
subject matter experts and distributed and acted upon by the operations
personnel.





Hercules
is offered to our customers under a perpetual license or under a two year
subscription license. As part of the perpetual licensing process for Hercules,
we require our customers to enter into a customer support contract whereby the
customer receives vulnerability remediation updates through V-Flash. These
services are also included under the subscription based license model.





*Security-On-Demand
Appliance*





In
February 2005 we announced that a new appliance product, Security-On-Demand,
powered by Hercules is anticipated to be available in the second quarter of
2005. Security-On-Demand is expected to provide a complete vulnerability
management solution to the small and mid-sized businesses that have not been
addressed by our enterprise vulnerability management solution ("EVM"), Hercules.
The solution is in addition to our existing product offerings for enterprise
customers. We believe that the Security-On-Demand offering will change the way
smaller organizations acquire vulnerability management software thereby enabling
them to proactively protect their networks from cyber security threats and
vulnerabilities and helping them achieve compliance with internal security
policies and external mandates.





The
Security-On-Demand model, comprised of asset inventory, security risk analysis,
policy compliance, vulnerability remediation, endpoint security and end-to-end
reporting, leverages the power of software as a service, allowing customers to
implement the entire Hercules EVM solution on an appliance and pay for the use
of the product as they implement the remedies across their networks. This usage
based pricing model allows customers to have access to the V-Flash library of
over 20,000 vulnerability remedies and to pay for the remediation of their
networks as the remedies are applied. Security-On-Demand is expected to be a
plug-and-play appliance that meets the needs of the market by providing an
easy-to-deploy solution for rapid implementation across all sized networks from
small and medium businesses to large enterprises.





**12**
 Table of Contents





New
features expected to be released with the Hercules Security-On-Demand appliance
include:





-- Visual
Dashboard - A customizable view that allows users to determine the security
status of their environment relative to policy compliance, vulnerable state,
exposure to threats, and overall coverage.





--
Automated Risk Analysis - Device risk analysis that evaluates and ranks all
vulnerabilities for each device based on the factors of risk and business value
enabling users to prioritize vulnerability resolution.





-- Policy
Compliance - A new policy compliance capability allowing users to monitor and
report on policy compliance.





--
Security Intelligence Portal - Access to Citadel's expert security team and the
latest security intelligence through the portal enables IT managers to have the
most up-to-date information available and a resource to answer their
vulnerability management questions.





--
End-to-End Management Reporting - A complete analysis of security state from
critical inputs, including risk analysis, policy compliance and vulnerability
coverage.


Hercules
Security-On-Demand appliance customers are expected to benefit from Hercules'
endpoint security protection component, ConnectGuard, which stops all traffic
from remote and local machines reconnecting to the network, checks for security
policy compliance, and performs remediations on out-of-compliance machines
before they are allowed to connect to the network. Additionally, the Hercules
Security-On-Demand appliance is expected to include AssetGuard, our IT asset
inventory feature that allows administrators to rapidly target devices in need
of critical patches and configuration updates in light of the increasing number
of near-day exploits.


******


***ConnectGuard***





Laptops
and desktop machines that have become disconnected from the network represent a
security threat when they attempt to reconnect. ConnectGuard, a separate
component of Hercules, provides endpoint security by quarantining remote and
local machines before allowing them to reconnect to the network, checking for
security policy compliance, and applying remedies to out of compliance machines
before releasing the quarantine and allowing network access. By preventing
infected devices from gaining access to the network, ConnectGuard provides the
ability to defend against recurring cyber threats, and provide a more secure
environment as devices disconnect and reconnect to the network.





One of
the key benefits of ConnectGuard is its flexible administration and control
capabilities. ConnectGuard can be enabled for individual devices, groups of
devices, or servers. Administrators may set network access policy for any
protected device connecting either to the Hercules network or a foreign network.
Foreign networks are typically those accessed in hotels, airports, or Internet
cafes, through wireless networks or home via an Internet service provider.
Administrators may also allow users to override ConnectGuard, giving them the
option to connect to the corporate network or a foreign network without
quarantine or remediation .





***AssetGuard***





Networks
are comprised of various types of devices and knowing exactly what is installed
on these devices helps the security administrator to react quickly to the
emergence of new vulnerabilities. AssetGuard is a comprehensive, easy-to-use
solution to discover, inventory and protect the workstation and server devices
on a network.





A
component of Hercules, AssetGuard provides the ability to collect detailed
workstation and server device information and store that information in the
Hercules database repository. By providing complete inventory data on network
connected workstations and servers, AssetGuard enables the administrator to
perform detailed queries to rapidly identify devices that need vulnerability
remediation or configuration policy enforcement. The detailed data collected
allows the administrator to target devices for vulnerability remediation or
configuration policy enforcement based on specific attributes, such as a common
operating system, patch level or configuration.





By
comparing inventory data from a baseline to a current or historical snapshot,
AssetGuard enables security administrators to identify changes to hardware,
software or services running on network connected devices that might impact the
security of the network. AssetGuard leverages comprehensive device information
to provide a strategic advantage when responding to critical IT security
vulnerabilities. AssetGuard mitigates the immediate threat of a newly emerging
vulnerability by targeting only those devices that need remediation or security
configuration changes to meet security configuration policies.





**13**
 Table of Contents





***Secure
PC***





Secure PC
provides advanced features that allow security administrators to create, manage
and deploy security policies for Windows computing environments. Secure PC
establishes user and group profiles to enforce workstation and server security
policies from a single point of control. These security policies can be
configured to prevent changes to system settings and installation of
unauthorized software. Secure PC “hardens” system files as a first line of
defense against viruses, malicious code and unauthorized access or theft of
confidential information. Hardening of files is crucial to defending against
intentional and unintentional security breaches.





Secure PC
offers support for computers running Microsoft Windows versions 95, 98, ME, NT,
2000 and XP. Its advanced set of features allows administrators to apply
security policies to users or groups of users within an organization. We sell
this product in two configurations, Secure PC Workstation and Secure PC Network.
Secure PC Workstation is designed for home, educational or commercial
non-networked computers. Secure PC Network is designed for environments with
multiple computers connected to a Windows or Novell network. The network version
of Secure PC has been designed to scale dynamically within network environments
ranging from departmental local area networks (LANs) to global wide area network
(WAN) capacity and includes tools that provide remote installation and
configuration of the Secure PC client software. Additional benefits include File
and Folder Access Control, Prevent Un-Authorized Software Installation and
Application Control. Secure PC is offered to our customers under a perpetual
license.





***NetOFF***





NetOFF
allows administrators to secure unattended workstations from unauthorized
access. A PC that stays connected to a network while users attend meetings - or
leave the office for the night - is a wide-open door to the network. Customer
files, patient records, classified information and proprietary documents are
open to disclosure and theft through unattended PCs. With NetOFF, unattended PCs
are a reduced security risk.





NetOFF is
designed to protect a network by shutting down unattended client PCs
automatically after a specified period of inactivity. Through NetOFF,
administrators can define policies that trigger a graceful logoff of unattended
or inactive workstations. Through a graceful logoff, all user data is saved,
applications are closed and workstations are logged off the network. Network
administrators may also use NetOFF to shut down PCs to enhance backup operations
or assist with the distribution of new software and anti-viral updates. NetOFF
is available for Windows operating environments including Windows 2000, Windows
2003 and Windows XP desktop PCs. NetOFF is offered to our customers under a
perpetual license.








**PRODUCT
DEVELOPMENT**





In
developing new Citadel security products, we strive to meet the following
standards in product development:





·
    Standards
      Compliance and Network Compatibility. Our products comply with industry
      standards and are designed to be compatible with the leading operating
      systems, including Microsoft, Unix and Linux variants. To that end, our
      products are currently developed using standard tools such as XML, C++,
      C#, Microsoft.Net and various platform dependent
  toolkits.





·
    Ease
      of Use. Our products are designed to function without extensive and
      continual user involvement. The aim is to simplify, not complicate, the
      user’s work environment.





·
    Commitment
      to Quality Assurance including Common Criteria (“CC”). On March 1, 2004,
      Hercules was certified under Common Criteria Evaluation Assurance Level 3
      (“EAL 3”).





We plan
to capitalize on our existing security and network administration technology and
our expertise in research, development and marketing to expand our business into
products that address the growing market for security. Our internal development
work remains the key component of bringing new product lines to market. In
addition, we may pursue an alliance strategy to develop new products. Our
internal research and development staff is currently working on the development
of the next generation of Hercules with an expected release in the second
quarter of 2005. This planned release is expected to include new features and
functionality, greater ease of use, an improved graphical user interface, a
graphical dashboard and is also planned to be available on an appliance,
Hercules Security-On-Demand. Schedules for the development and release of high
technology products are inherently difficult to predict, therefore there can be
no assurance that we will achieve targeted customer shipment dates for any of
our products, or at all. In addition, we may pursue acquisitions of technologies
or products that complement our products and product strategy. Acquisitions of
technology are risky and we may not be successful in finding the right
technology products or, once acquired, integrating the new technology with
existing development projects.





**14**
 Table of Contents





We
capitalize software development costs at the time technological feasibility is
established, which generally occurs at the time the design and analysis plan is
completed and programming begins. The costs and expenses that qualify for
capitalization primarily consist of salaries, benefits and the direct and
indirect costs associated with the development staff or with the specific
development projects. Costs and expenses that do not qualify for capitalization
and all costs and expenses incurred prior to technological feasibility are
expensed and classified as product development expense. During the year ended
December 31, 2004, we incurred $1,995,612 of product development expense, which
is net of $3,261,210 of capitalized software development costs. During the year
ended December 31, 2003, we incurred product development expenses of $392,967,
net of $1,897,497 of capitalized software costs.





Capitalized
software development costs and product development expense are expected to
remain at the current levels of capitalization and expense during the year 2005.
However, changes in product plans, technologies or in development engineering
staffing levels can alter these expectations. Historical product development
expense and the capitalization rate have fluctuated from period to period, and
may continue to fluctuate from period to period in the future depending upon the
number and status of software development projects that are in process and the
related number of employees assigned to those projects. At December 31, 2004, we
employed 40 software product development and quality assurance engineers,
including our Executive Vice President Development and our Chief Technology
Officer.





Separate
from the product development team is the Remediation Security Group which is a
team of security engineers that support the Hercules solution by writing and
testing the content of the Hercules remedy database. This team monitors
intelligence sites on the Internet, converses with our scanning partners and
scans research from third party intelligence sources to identify new
vulnerabilities. When new vulnerabilities are identified and confirmed, the team
writes the remedies. Once written, the remedies are tested across all the
platforms supported by Hercules. The remedies are then released to the V-Flash
database for deployment to our installed customer base. This service is provided
to our customers under the terms of the customer support agreement that is sold
with the software license. As a result, the costs and expenses associated with
this service are not eligible for capitalization under the accounting rules for
capitalization of software development costs. At December 31, 2004 we employed
16 security engineers in the Remediation Security Group.





**SALES,
MARKETING AND BUSINESS DEVELOPMENT**





As is
common in the software industry, our customers are granted a license right to
use our technology, as opposed to owning our technology. We receive a license
fee in return for granting this right. Each server and desktop on which our
software is installed must be licensed for use of the software. Therefore, each
customer enters into a license agreement stating the terms under which our
software may be used. The license agreement is displayed on a screen during the
software installation process where the customer indicates acceptance to the
terms of the license. A paper copy of the license is included in the product
documentation shipped to the customer. In some cases, the customer will sign a
software license agreement or we will sign a master agreement with a customer
for an enterprise-wide software license. An enterprise license offers the
customer a set number of licenses that may be deployed across the customer's
entire enterprise. In some arrangements, the enterprise license allows the
customer an unlimited number of license copies. A customer may license our
products for perpetual use or for limited terms under a subscription. Generally,
license fees are computed based on the mix of servers and desktops that make up
the customer's network. Discounts are available for volume purchases.





In
addition to technology licenses, we offer one-year renewable customer support
agreements generally referred to as maintenance or post contract customer
support agreements. Customers have an option to subscribe to telephone support,
software updates and the Hercules V-Flash remedies separately or in combination.
Signing a customer support agreement for all three services is more cost
effective for the end user customer. Telephone support is staffed by security
engineers that are knowledgeable about the use of our products. Customers may
contract for standard support available during normal business hours or for a
premium payment, customers may sign up for 24 hour, 7 days a week ("24/7")
support availability. Support cases are opened for each telephone support call
and the cases are tracked through the customer support system until the solution
is determined and the case is closed. Software updates are made available to
customers on a "when and if available" basis (i.e. when needed as determined by
development management and not on a guaranteed time schedule). Software updates
include hotfixes, point releases and new version releases of our products.
Software updates do not include the V-Flash remedies which are available to our
Hercules customers. Our library of over 20,000 remedies is available to our
Hercules customers separately or in combination with the telephone support and
software updates.





**15**
 Table of Contents





Even
though our technology is licensed and not sold, we refer to a sales organization
and depend upon our sales representatives to license our products to end users
in return for a license fee. The sales organization consists of experienced
sales representatives who have been trained on the use of each of our products.
Our sales representatives are assigned sales quotas and territories by geography
or by industry. At December 31, 2004, we employed 25 quota sales representatives
in regions around the United States, including the regional vice presidents.
This compares to 10 quota sales representatives at December 31, 2003. The
regional sales representatives report to regional vice presidents covering the
east, west and central states as well as a sales unit that covers federal
government agencies and state and local governments. The sales representatives
are supported by a team of software pre-sales engineers. These pre-sales
engineers assist with the technical sales component of the sales process and are
responsible for conducting product demonstrations to prospective customers and
responding to the potential customer's technical questions raised about the
product's use within the customer's IT environment.





Marketing
efforts are targeted to provide qualified leads and leverage the opportunities
presented by our vulnerability assessment partners. Sales leads are generated
through various marketing activities including trade shows, conferences,
webinars, direct mail campaigns, partner relationships and other marketing
programs. The Citadel website is a marketing tool that contains the most up
to-date product and company information and can be found at www.citadel.com . From
time-to-time, we participate in partner events and regional seminars.





Sales
leads are qualified by inside sales representatives gathering such
characteristics from potential customers as size of the customer’s organization
and network infrastructure, geographic location and whether an attack or other
event had occurred on the customer’s systems. All sales leads are entered and
tracked utilizing a web based customer relationship management system. Once the
lead is qualified, the opportunity is assigned to a territory sales
representative who arranges for meetings with the customer, a product
demonstration and eventually moves the opportunity towards closure. In addition,
our executive management team is highly involved in the selling process.





Each
sales representative is assigned a sales quota and receives incentive
compensation based on achieving the assigned sales target, in addition to a base
salary and benefits package. Higher incentive compensation may be earned when a
sales representative exceeds the assigned sales quota. Special incentives may be
offered from time-to-time to encourage the sales team to achieve specific sales
goals.





Some
sales to agencies of the federal government are facilitated through prime
government contractors such as BAE Systems Information Technology, Northrop
Grumman Information Technology and Hewlett Packard, as well as approved
resellers to the federal government including Apptis, Inc. and Merlin Technical
Solutions. Government agencies may also purchase our products and services on
General Services Administration (“GSA”) contract schedule 70.  We are
authorized to sell under the Procurement of Computer Hardware and Software
(“PCHS”) contract for purchasing by the hospitals under the Department of
Veteran Affairs. In addition, we are a Catalog Information Systems Vendor for
Texas and are listed on the California Multiple Award Schedules (CMAS) for
sales to the state agencies in California. In January 2004, Hercules was added
as an approved product under the US Army’s Blanket Purchase Agreement under
CECOM Acquisition Center, Southwest Operation Office (CAC-S), Ft. Huachuca, AZ.





Our
business development personnel have been engaged in building strategic alliances
related to marketing and licensing our software products. With Hercules, we are
seeking to work with companies which have technologies for scanning for
vulnerabilities within a network structure. We have established relationships
with several scanning technology companies including FoundStone (now part of
McAfee), Harris Corporation, Internet Security Systems, nCircle, and Qualys,
Inc. By entering into strategic alliances with these companies, we seek to
leverage their existing installed customer base to sell Hercules and broaden
their opportunity to sell more scanners.





**16**
 Table of Contents





Through
alliances and marketing relationships, we believe that the number of leads that
can be cultivated by the Citadel sales team will increase. By working with the
sales teams of these third parties, we believe that we can increase the revenue
generated from Citadel products without adding significant cost, and provide
qualified customer leads for our inside sales staff. We believe that our direct
selling model, coupled with targeted marketing activities, focused alliance
efforts with vulnerability scanning providers and the federal government
contracting vehicles will enable Citadel to increase market penetration into
large corporate and government enterprises. The increased market penetration is
expected to increase awareness of our vulnerability management and policy
compliance solutions ultimately leading to increased revenue although no
assurances can be made that this objective will be achieved.





**CUSTOMER
SUPPORT**





We
believe that a broad range of services are essential for a successful continuing
relationship with our customers. Customer support services are provided under a
customer support services agreement under such policies as are in effect on the
date customer support services are ordered. There are three components to
customer support that may be contracted individually or in combination. These
components include telephone support, software updates and Hercules V-Flash
remedies.





Customer
telephone support services are renewable annually and may be purchased in two
tiers:





·
    Standard
      Customer Support Services provides the customer with a toll-free telephone
      number for problem reporting available 7 a.m. to 7 p.m. Central Time
      Monday through Friday excluding holidays.





·
    Premium
      Customer Support Services provides the customer 24 hours a day, 365 days a
      year access to support engineers with a toll-free telephone number for
      problem resolution.





Software
updates are made available to customers under contract support plans on a "when
and if available" basis (i.e. when needed as determined by development
management and not on a guaranteed time schedule). Software updates include
hotfixes, point releases and new version releases of our products. Software
updates do not include the V-Flash remedies which are available to our Hercules
customers. Our library of over 20,000 remedies is available to our Hercules
customers separately on a subscription basis or in combination with the
telephone support and software updates purchased under a customer support
services agreement.





All
Support Service Levels include levels of web and e-mail support. All customers
have access to our web site which includes a series of frequently asked
questions addressing the most commonly encountered issues and their resolutions.
All customers who have purchased a support plan have access to customer service
engineers through the Citadel Support Portal. The support portal allows the
customer to log a case and then track the progress of the case. They also have
access to all their open and closed case history in the portal. In addition,
they have access to all published solutions through the support portal.





The
Citadel Customer Support Center is staffed by highly qualified support
engineers. Our support engineers assist the customer in diagnosing and resolving
problems experienced with using our products. Those problems that cannot be
resolved by our support engineers are escalated to a team of level 2 customer
support engineers who have the ability to examine the source code, replicate the
customer’s environment and test the source code for confirmation of the
customer’s issue. Source code that needs to be modified is escalated to the
development team who then schedules and develops a software hotfix. Once tested,
the hotfix is made available to all customers who request the update from
customer support.





**TRAINING**





We offer
training courses for Hercules administrators. We recommend that all system
administrators go through a series of training courses we offer. During 2004 we
introduced Virtual-On-Demand training. This training is a web enabled training
program that allows our customers access to the product in an online training
environment. Training courses are available as instructor led, computer based,
or virtual on-demand classrooms, in which students are assigned a virtual
network for the purpose of training on the best practices and live use of the
Hercules product. The currently available product training classes are listed
below:





**17**
 Table of Contents





·
    Online
      Hercules Operator Training


This
course provides an understanding of the concepts and skills necessary to perform
the Hercules remediation process, following best practices procedures. The
students, through the use of interactive virtual machines (VMs), configure
Hercules to remediate a network based on imported scan data and network
topology.





·
    On
      Site- Hercules Operator Training


This
course provides an understanding of the concepts and skills necessary to perform
the Hercules remediation process, following best practices procedures. This
course is comprised of hands-on training with Hercules. The students will
configure Hercules to remediate a network based on imported scan data and
network topology.





·
    Hercules
      Advanced Training Course


This
course provides an understanding of the concepts and skills necessary to
architect, implement and customize your Hercules installation. This course
focuses on the following:


•
    Set-up
      of the enterprise architecture


•
    Understanding
      the internal Hercules architecture


•
    Building
      custom remedies and


•
    Troubleshooting.





**PROFESSIONAL
SERVICES**





During
2004 we launched our professional services organization and related offerings.
At the option of the customer, services provided include implementation services
and subject matter expertise around the use of Hercules. At December 31, 2004 we
had services engagements in process or scheduled at MCI Inc., the Department of
Veteran Affairs and the Department of Defense, among other customer engagements.
We
expect that revenue from professional services engagements will increase in 2005
over professional services revenue during 2004. At December 31, 2004 we had
approximately $480,000 of professional services revenue recorded as deferred
revenue and approximately $625,000 for professional services in unfilled order
backlog.

As we
formalize services programs and service offerings around Hercules, we expect
that professional services revenue will increase in 2005 over the services
revenue recognized in 2004; however there can be no assurances that this growth
will occur. In addition, professional services revenue is expected to have lower
gross margins than the gross margins generated from licensing of our software
products plus revenue from customer support agreements. Therefore, a change in
the revenue mix to a larger proportion of professional services revenue than
revenue from software licenses and customer support contracts could lower total
gross margins.





**COMPETITION**


We
believe that Hercules is the only automated vulnerability remediation solution
today that addresses all five classes of vulnerabilities. Companies that create
patch management utilities sometimes compete with Hercules at the low end of the
security software market where customers may be looking for a point solution and
quick fix to patch their networks. However, patching of software defects
remediates only one of the five classes of vulnerabilities that affect the
enterprise. Patch management utilities are generally not scalable to a large
enterprise network where Hercules is a more appropriate security solution.
Companies that have products that compete at the low end price points of the
market include BigFix, Inc., PatchLink Corporation, Shavlik Technologies and
Secure Elements, among others.





We have
also seen customers use configuration management or software distribution
applications as security management tools. Customers must write the scripts to
manage their vulnerabilities which prove costly in terms of development time and
lost productivity. While it is possible to use these solutions to manage
vulnerabilities, we believe that our library of over 20,000 remedies provides
Hercules an important competitive advantage over these solutions. Companies that
we see at this end of the market include Altiris, Inc., Computer Associates, IBM
Tivoli and Microsoft, among others. The security software industry is intensely
competitive and rapidly changing and we expect that in the future other
companies may develop vulnerability management enterprise solutions that will
compete directly with Hercules.





In
desktop policy administration, we compete against large companies (such as
Microsoft, Novell, Cisco, Computer Associates, Internet Security Systems,
Network Associates, Symantec and others) that offer network and desktop PC
security and administration software as a segment of their businesses. We also
compete with a large number of small companies that offer security and
administration software for networks and desktop PCs. Some of these competitors
offer products that address multiple aspects of network and desktop security and
administration and management, while other competitors market products that
provide narrow solutions.





**18**
 Table of Contents





Many of
our competitors have longer operating histories and significantly greater
financial, technical, sales, marketing and other resources, as well as greater
name recognition and a larger installed customer base, than we do. Further, many
competitors have established relationships with our customers and end users of
our products. Our competitors could, in the future, introduce products with more
features and lower prices than our product offerings. These companies could also
bundle existing or new products with other, more established products in order
to compete with us.





**CUSTOMERS
AND PRODUCT LICENSING**





We
license our software products to corporations, government organizations and
entities that need to reduce computing vulnerabilities and manage security and
privacy policies within their computing environments. Our products are licensed
for perpetual use on standalone computers, within a single network, or within a
network of computers across single or multiple customer sites. Our license
agreement restricts the use of the software to a single computer or designated
network or site(s) and generally prohibits the reproduction, transfer, reverse
engineering and disclosure of the program code. A form of perpetual license that
we offer is an enterprise-wide license. This form of license allows the customer
to deploy a contractually set number of licenses anywhere in their enterprise.
In some very large customers accounts, we may allow the customer unlimited
licenses to deploy across their networks. The terms and conditions of use of the
enterprise-wide license are generally set forth in a written enterprise license
agreement.




In
addition to perpetual licenses, we offer our customers a subscription to use our
products over a contractual period of time, generally from one to five years. At
any time during the subscription period, the customer may opt to pay an
additional fee to convert the subscription to a perpetual license. We have
announced that with the expected release of Hercules 4.0 in the second quarter
of 2005 that we will offer customers the use of our product on a hardware
appliance and under a usage based pricing model. Similar to the subscription,
the customer will be allowed to use our Hercules product for a contractual
period of time and pay for its usage based on the number of remedies deployed
each month.
 
 During
the year ended December 31, 2004, revenue from the Defense Information Systems
Agency accounted for approximately 39% of total revenue and revenue from
hospitals under the Department of Veterans Affairs accounted for approximately
41% of total revenue. During the year ended December 31, 2003, revenue from
hospitals under the Department of Veterans Affairs accounted for approximately
67% of total revenue. No other customers individually accounted for more than
10% of total revenue for 2004 or 2003. Although these existing customers
represent a large portion of our total revenue, we do not expect to rely on any
one customer, group of customers or industry segment for a significant and
recurring source of revenue from the existing installed customer base. However,
we foresee that revenue from the licensing of Hercules (other than as part of
our usage based pricing model) will be derived from large enterprises consisting
of Fortune 2000 companies and large government agencies. Therefore, in the
future, any one customer or groups of customers in the same industry segment
could be a significant component of revenue in any future quarter or year. We
also expect that in the future our customers will enter into annual renewal
contracts for post sale customer support services. However no assurance is
provided that these expectations will be met.
 
 Customers
that individually placed orders for products, customer support services and
other services during 2004 in excess of $50,000 include:
 
 92ndAir Refueling Wing
    Department
      of Veterans Affairs
    Raytheon
      CompanyAir
      Force Material Command
    DISA
      - Defense Information Systems Agency
    TechTeam
      GlobalBanknorth
      Group, Inc.
    MCI,
      Inc.
    University
      of IL Medical CenterCitizens
      Business Bank
    National
      Science Foundation
    Washington
      MutualCushman
      and Wakefield
    Providence
      Health Care Systems


**19**
 Table of Contents





**INTELLECTUAL
PROPERTY RIGHTS**





We regard
some features of our software and documentation to be proprietary intellectual
property. We have been and will be dependent in part on our ability to protect
our proprietary technology under copyrights, trademarks and patents. We will
seek to use patents, copyright, trademarks, trade secret laws, confidentiality
and assignment of invention agreements and other measures if necessary to
establish and protect our rights in our proprietary technology. We have filed
five United States patent applications and one related Patent Cooperation Treaty
patent application which has been the basis for eleven pending foreign patent
applications with respect to some of our business applications and intellectual
property rights related to our Hercules software, and specifically the Patent
Cooperation Treaty patent application has gotten a favorable report on
preliminary examination. We have one registered copyright on the code for the
Hercules software. We also have one trademark registered with the United States
Trademark Office as well as seven pending trademark applications.
 
 Despite
our patent applications, copyright and trademark rights, we do not have any
issued patents or other registered copyrights or trademarks on any of our
proprietary technology which we believe to be material to our future success,
and we cannot be certain that others will not develop substantially equivalent
or superseding proprietary technology. Furthermore, there can be no assurance
that any confidentiality and assignment of invention agreements between our
employees or third parties and us will provide meaningful protection of our
proprietary information in the event of any unauthorized use or disclosure of
such proprietary information.


There can
be no assurance that we will not become the subject of claims of infringement
with respect to intellectual property rights associated with our products. In
addition, we may initiate claims or litigation against third parties for
infringement of our proprietary rights or to establish the validity of our
proprietary rights. Any such claims could be time consuming and could result in
costly litigation or lead us to enter into royalty or licensing agreements
rather than disputing the merits of such claims.





**EMPLOYEES**





As of
December 31, 2004, we employed 138 professionals. We employed 61 professionals
in sales activities including field sales, telesales, professional services,
training, business development, pre-sales engineering, lead generation and
marketing. Included in the 61 were 25 quota carrying sales representatives
focused on the commercial and government markets, including 4 regional or
industry segment sales managers, 13 sales engineers that provide pre-sales
support the commercial and government sales organizations, 4 sales management
personnel, 10 professionals focused on marketing and lead generation, 4
employees managed the commercial and government business development activities
and 5 employees were in professional services and training activities. Product
development and quality assurance had 40 professionals, customer support
employed 7 engineers and the remediation security group employed 16
professionals. We also employed 14 people employed in the functional areas of
information technology, finance, administration and general management including
our CEO and CFO. At December 31, 2003 we employed 74 professionals,
including 28 professionals in sales, sales engineering, customer support and
marketing, 37 in product development, and 9 people in information technology,
finance, and administration.





Competition
for employees in the software industry and specifically the security software
market is highly competitive. We offer competitive compensation packages and
benefits but companies with greater resources than ours may have a competitive
hiring advantage. The employees are not organized under a union and we believe
that the relationship with our employees as a group is good. Our 2005 operating
plan calls for our hiring to level off at between 140 and 150 personnel. We
believe that this level of employee resources is sufficient to achieve our
operating plan during 2005 but there can be no assurances that changes in
competitive forces, technologies or other business requirements may alter the
number of employee resources required.





**GOVERNMENT
REGULATION**





Except
for the costs associated with the implementation of the Sarbanes-Oxley Act of
2002 ("SOX") described below, government regulation has not had a material
effect on the conduct of our business to date. Except for the requirement of
compliance with United States export controls relating to the export of high
technology products, we are not subject to government approval procedures or
other regulations for the licensing of our products. The nature of our business
does not subject us to environmental laws in any material manner. As the United
States and other governments address via legislation the growing requirements
for increased security and privacy of data, particularly health, financial and
personal information, new opportunities to license our existing and future
products may arise.





**20**
 Table of Contents





The
implementation of the requirements of SOX has placed a burden in cost and
resources on the company during 2004. During 2004 we incurred approximately
$130,000 for the services of outside consultants and the implementation of
software associated with the SOX requirements. We have not made an estimate of
the costs associated with internal employees who are implementing the SOX
requirements. The costs associated with compliance with SOX requirements are
expected to continue to be incurred but cannot be estimated at the current time.
In addition, we expect that we will need to hire additional personnel, engage
outside consultants and acquire additional software and hardware to maintain SOX
compliance on an ongoing basis but cannot currently estimate these
costs.





**RISK
FACTORS**





You
should carefully consider each of the following risk factors and all of the
other information in this Annual Report. The risks and uncertainties described
below are not the only ones Citadel will face. Additional risks and
uncertainties not presently known to Citadel or that it currently believes to be
immaterial may also adversely affect Citadel’s business.





If any of
the following risks and uncertainties develops into actual events, the business,
financial condition or results of operations of Citadel could be materially
adversely affected. If that happens, the trading prices of our shares of common
stock could decline significantly.





The risk
factors below contain forward-looking statements. Actual results could differ
materially from those set forth in the forward-looking statements. See
Cautionary Statement Regarding Forward-Looking Statements above.





**WE
HAVE A HISTORY OF NET LOSSES AND MAY NEED OR DECIDE TO SEEK ADDITIONAL FINANCING
TO FUND OPERATIONS.**





At
December 31, 2004 we had cash and cash equivalents of approximately $9.8
million, a net working capital position of approximately $3.5 million and
stockholders’ equity of approximately $10.8 million. On February 10, 2004, in
return for gross proceeds of $15,000,000, we issued 15,000 shares of our Series
A Convertible Preferred Stock (convertible into 3,000,000 shares of common stock
at the initial conversion price of $5.00 per share) and warrants to purchase
1,200,000 shares of common stock. The net proceeds from the preferred stock
financing, were approximately $13,800,000, after placement agent fees, as well
as accounting and legal fees and were used to fund the expansion of our sales
and marketing team to execute our business plans, and to increase our
engineering team to implement our product development initiatives, grow market
share through product innovation and establish Citadel as a provider of quality
products in the life cycle vulnerability management market. In April 2004, we
secured a revolving credit line from Comerica Bank of $750,000 for
operations and term loan credit facilities totaling $2,750,000 for use to
acquire the capital equipment necessary to support our business plan. The
proceeds from the credit facilities have been used to fund the growth in
technology infrastructure to support the expansion of our sales, marketing and
engineering resources.





We
believe that cash generated from the preferred stock financing, credit
facilities provided by the bank, our existing cash balances and cash equivalents
along with the cash balances expected to be generated from the execution of our
2005 operating plan will be sufficient to meet our cash requirements for the
next twelve months. We have had a history of annual operating losses and have
reported a net loss to common shareholders in the twelve months ended December
31, 2004 of approximately $8.7 million. If the operating losses continue, we may
be required, or could elect, to seek additional funding prior to that time. Our
future capital requirements will depend on many factors, including our rate of
revenue growth, the timing and extent of spending to support product development
initiatives and expansion of sales and marketing, the timing of introductions of
new products, enhancements to existing products, and the general market
acceptance of our products. We cannot assure you that additional equity or debt
financing will be available to us at the time we require the financing or
available on acceptable terms. The terms of our preferred stock and bank loans
may also make it more difficult for us to raise additional funds if needed. In
the event we are required to seek additional capital, our shareholders may be
diluted and any additional financing may have a material adverse effect on our
results of operations and share price. Our sources of liquidity beyond twelve
months, in our opinion, will be our then current cash balances, funds from
operations, debt or equity financings and any credit facilities we may
arrange.





**21**
 Table of Contents





**OUR
OPERATING RESULTS MAY BE ADVERSELY AFFECTED BY THE UNCERTAIN GEOPOLITICAL
ENVIRONMENT AND UNFAVORABLE ECONOMIC AND MARKET CONDITIONS.**





Adverse
economic conditions worldwide have contributed to a material slowdown in the
software business and may continue to adversely impact our business, resulting
in:





·
    Reduced
      demand for our products as a result of a decrease in technology spending
      by our customers and potential customers;


·
    Increased
      price competition for our products; and


·
    Higher
      overhead costs as a percentage of revenues.





Terrorist
and military actions may continue to put pressure on economic conditions. If the
economic and market conditions in the United States do not improve, or
deteriorate further, we may continue to experience material adverse impacts on
our business, operating results, and financial condition as a consequence of the
above factors or otherwise.





**ECONOMIC
CONDITIONS, AND CONDITIONS AFFECTING THE NETWORK SECURITY MARKET IN PARTICULAR,
MAY HAVE A NEGATIVE IMPACT ON OUR REVENUES AND MARGINS.**





The
market for our products depends on various economic conditions including those
affecting the network security, Internet infrastructure and other related
markets. Any slowdown in corporate earnings or tightening of corporate or
governement budgets may cause potential customers to delay or cancel security
projects, reduce their overall or security-specific information technology
budgets, or reduce or cancel orders for our products. Further, if economic
conditions deteriorate, customers may experience financial difficulty, cease
operations or fail to budget for the purchase of our products. This, in turn,
may lead to longer sales cycles, price pressures and collection issues, causing
us to realize lower revenues and margins. In addition, many parts of the world
are experiencing economic instability, and we cannot predict how these
conditions may affect our customers or business.





**CITADEL
STOCKHOLDERS MAY EXPERIENCE SIGNIFICANT DILUTION IF FUTURE EQUITY OFFERINGS ARE
USED TO FUND OPERATIONS OR ACQUIRE COMPLEMENTARY BUSINESSES OR RESULT FROM
OPTION EXERCISES.**





If future
operations or acquisitions are financed through the issuance of equity
securities, Citadel stockholders could experience significant dilution. In
addition, securities issued in connection with future financing activities or
potential acquisitions may have rights and preferences senior to the rights and
preferences of our common stock.





We have
granted options to purchase shares of our common stock to our directors,
employees and consultants and we will grant additional options in the future.
Options to purchase 7,993,000 shares of common stock and warrants to issue
1,434,881 shares of common stock were outstanding as of December 31, 2004. The
issuance of shares of our common stock upon the exercise of these options may
result in dilution to our stockholders.





**OUR
SERIES A CONVERTIBLE PREFERRED STOCK AND BANK DEBT MAY ADVERSELY IMPACT CITADEL
AND OUR COMMON STOCKHOLDERS OR HAVE A MATERIAL ADVERSE EFFECT ON
CITADEL.**


We have
issued shares of Series A Convertible Preferred Stock (the “Series A
Preferred”), the terms of which may have a material adverse effect on Citadel
and its financial condition and results of operations. The Series A Preferred
has a liquidation preference in the amount of $15 million plus accrued and
unpaid dividends, which must be paid before common stockholders would receive
funds in the event of a liquidation of Citadel, including some changes of
control. In addition, Citadel is required to redeem the shares of Series A
Preferred in certain circumstances, including Citadel’s failure to deliver
shares of common stock to the holder of the Series A Preferred in connection
with the conversion of the shares of Series A Preferred or a change in control
of Citadel. Citadel has also agreed not to issue securities senior to or on a
par with the Series A Preferred (other than the Comerica Bank credit facilities)
while the Series A Preferred is outstanding, which could materially and
adversely affect the ability of Citadel to raise funds necessary to continue its
business.


**22**
 Table of Contents





The loans
from Comerica Bank required us to grant a security interest in all of our
assets, including intellectual property, to Comerica Bank, and in the event of a
default by Citadel under the Comerica loan documents, Comerica could foreclose
on the loans and acquire all of our assets. The loan also provides that the
indebtedness has priority on any liquidation over the shares of our common
stock, and limits our ability to pay dividends on our common stock. These terms
and conditions could have a material adverse effect on Citadel and its financial
condition and results of operations.





**CITADEL
HAS A LIMITED OPERATING HISTORY AS AN INDEPENDENT PUBLIC COMPANY AND HAS BEEN
AND MAY CONTINUE TO BE UNABLE TO OPERATE PROFITABLY AS A STANDALONE
COMPANY** .





Citadel
has a limited operating history as an independent public company since May 2002.
Prior to May 2002, since the businesses that comprise each of Citadel and its
former parent company were combined under one holding company, they were able to
rely, to some degree, on the earnings, assets, and cash flow of each other for
capital requirements. Following May 2002, Citadel has relied solely on its
security software business for such requirements. The security software business
has operated at a loss in the past for Citadel's former parent company and for
Citadel following May 2002, and there can be no assurance that such losses will
not continue or increase.





**OUR
EARNINGS AND STOCK PRICE ARE SUBJECT TO SIGNIFICANT FLUCTUATIONS.**





Due to
the factors noted in this Form 10-KSB, our earnings and stock price have been
and may continue to be subject to significant volatility, particularly on a
quarterly basis. We have stated previously and continue to state that quarterly
revenue is difficult to forecast. We have previously experienced shortfalls in
revenue and earnings from levels expected by investors and analysts, which have
had an immediate and significant adverse effect on the trading price of our
common stock and has resulted in shareholder litigation. This may occur again in
the future.








**IF
WE LOSE THE SERVICES OF ANY OF OUR KEY PERSONNEL, INCLUDING OUR CHIEF EXECUTIVE
OFFICER OR OUR DIRECTORS, OUR BUSINESS MAY SUFFER** .





We are
dependent on our key officers, including Steven B. Solomon, our Chairman and
Chief Executive Officer, our directors, and our key employees in our finance,
technology, sales and marketing operations. Our business could be negatively
impacted if we were to lose the services of one or more of these persons.





**MEMBERS
OF CITADEL'S BOARD OF DIRECTORS AND MANAGEMENT MAY HAVE INTERCOMPANY CONFLICTS
OF INTEREST AFTER OUR SPIN-OFF.**





Members
of the board of directors and management of Citadel own shares of both Citadel
and CT Holdings common stock after our spin-off from our former parent company
because of their prior relationship and, in some cases, continuing relationships
as directors or executive officers with CT Holdings. In addition, following the
spin-off, two of the four directors of Citadel are also directors of CT
Holdings, and the Chief Executive Officer and Chief Financial Officer of Citadel
also continue to serve as Chief Executive Officer and Chief Financial Officer of
CT Holdings. These relationships could create, or appear to create, potential
conflicts of interest when Citadel's directors and management are faced with
decisions that could have different implications for Citadel and CT Holdings.
Examples of these types of decisions might include the resolution of disputes
arising out of the agreements governing the relationship between CT Holdings and
Citadel following the spin-off. Also, the appearance of conflicts, even if such
conflicts do not materialize, might adversely affect the public's perception of
Citadel following the spin-off.





**OUR
INDUSTRY IS CHARACTERIZED BY RAPID TECHNOLOGICAL CHANGE AND WE WILL NEED TO
ADAPT OUR DEVELOPMENT TO THESE CHANGES** .





We
participate in a highly dynamic industry characterized by rapid change and
uncertainty relating to new and emerging technologies and markets. Future
technology or market changes may cause some of our products to become obsolete
more quickly than expected.





**23**
 Table of Contents





**INTRODUCTION
OF NEW OPERATING SYSTEMS MAY CAUSE SIGNIFICANT FLUCTUATIONS IN OUR FINANCIAL
RESULTS AND STOCK PRICE** .





If we are
unable to successfully and timely develop products that operate under existing
or new operating systems, or if pending or actual releases of the new operating
systems delay the purchase of our products, our future net revenues and
operating results could be materially adversely affected. Additionally, as
hardware vendors incorporate additional server-based network management and
security tools into network operating systems, the demand may decrease for some
of our products, including those currently under development.





**THE
TREND TOWARD CONSOLIDATION IN OUR INDUSTRY MAY IMPEDE OUR ABILITY TO COMPETE
EFFECTIVELY** .





As
consolidation in the software industry continues, fewer companies dominate
particular markets, changing the nature of the market and potentially providing
consumers with fewer choices. Also, many of these companies offer a broader
range of products than us, ranging from desktop to enterprise solutions. We may
not be able to compete effectively against these competitors. Furthermore, we
may use strategic acquisitions, as necessary, to acquire technology, people and
products for our overall product strategy. The trend toward consolidation in our
industry may result in increased competition in acquiring these technologies,
people or products, resulting in increased acquisition costs or the inability to
acquire the desired technologies, people or products. Any of these changes may
have a significant adverse effect on our future revenues and operating results.





**WE
FACE INTENSE PRICE-BASED COMPETITION FOR LICENSING OF OUR
PRODUCTS** .





Price
competition is often intense in the software market, especially for security
software products. Many of our competitors have significantly reduced the price
of their products. Price competition may continue to increase and become even
more significant in the future, resulting in reduced revenue and/or profit
margins.





**WE
MUST EFFECTIVELY ADAPT TO CHANGES IN THE DYNAMIC TECHNOLOGICAL ENVIRONMENT OF
THE INTERNET IN A TIMELY MANNER.**





Critical
issues concerning the commercial use of the Internet, including security,
reliability, cost, ease of use, accessibility, quality of service or potential
tax or other government regulation, remain unresolved and may affect the use of
the Internet as a medium to distribute or support our software products and the
functionality of some of our products. If we are unsuccessful in timely
assimilating changes in the Internet environment into our business operations
and product development efforts, our future net revenues and operating results
could be adversely affected.





**PRODUCT
RETURNS MAY AFFECT OUR NET REVENUES.**





A
customer may return a product under very limited circumstances during the first
thirty days from shipment for a replacement if the media is damaged or for a
full refund if the software does not perform in accordance with written
specifications. Accordingly, the Company records a provision for returns against
license revenue in the same period the revenue is recognized. The provision is
estimated based on historical product returns and other known data as well as
market and economic conditions. An allowance for returns and bad debts of
$209,000 has been recorded at December 31, 2004. In the future, this estimate
may fluctuate from period to period due to factors including but not limited to
the value of actual returns, the average dollar value of licenses granted in the
period and the relative product revenue volume for the period. In addition,
future returns could exceed the reserves we have established, which could have a
material adverse effect on our operating results.





Current
reseller agreements generally do not provide for a contractual right of return,
future price concessions, or minimum purchase commitments. Payment is not
contingent upon the reseller’s future licensing of products. Revenue generated
from products licensed through various marketing channels where the right of
return might expressly or implicitly exist is reduced by reserves for estimated
product returns. Such reserves are estimates developed by management based on
returns history and current economic and market trends. Management determined
that no reserve for returns from resellers was required at December 31, 2004 or
2003. However, future returns could exceed the reserves we have established,
which could have a material adverse effect on our operating results.





**24**
 Table of Contents





**OUR
INCREASED USE OF SITE LICENSES MAY INCREASE FLUCTUATIONS IN OUR FINANCIAL
RESULTS AND COULD AFFECT OUR BUSINESS.**





We are
increasingly emphasizing licenses to corporations and small businesses through
volume licensing agreements. These licensing arrangements tend to involve a
longer sales cycle than other distribution channels, require greater investment
of resources in establishing the enterprise relationship and can sometimes
result in lower operating margins. The timing of the execution of volume
licenses, or their non-renewal or renegotiation by large customers, could cause
our results of operations to vary significantly from quarter to quarter and
could have a material adverse impact on our results of operations. In addition,
if the corporate marketplace grows and becomes a larger component of the overall
marketplace, we may not be successful in expanding our corporate segment to take
advantage of this growth.





**CHANGES
MADE TO OUR SALES ORGANIZATION AND SALES STRATEGY COULD ADVERSELY AFFECT OUR
FUTURE REVENUES.**





Prior to
January 2004 our sales organization was centrally managed from our Dallas
headquarters. Since January 2004, we have created three geographic sales regions
focused on the commercial market and a public sector sales organization focused
on the government agencies. We have employed experienced and enterprise skilled
sales managers to manage these sales regions and public sector sales
organization. Each of these managers has employed experienced sales account
executives and assigned sales territories, responsibilities and quotas to these
sales account executives. We expect that these sales account executives will
seek sales opportunities in large enterprises consisting of Fortune 2000
companies and large government agencies with large geographically disbursed
networks.





This
sales organization and strategy has not been executed previously by us. Sales
cycles are expected to be longer than previously experienced, less predictable
and we may not be successful in closing sales quickly or in a regular or
consistent manner from quarter to quarter or year to year. Our dependence upon
large enterprise sales may cause fluctuations in revenue from quarter to quarter
or year to year.





In
addition, our revenue since the fourth quarter of 2003 has been highly dependent
upon revenue derived from the federal government and more specifically the
Department of Veteran Affairs and the Department of Defense. We expect that our
revenue mix for the foreseeable future to be weighted toward the federal
government customers where we have been engaged in the sales cycle for many
months. We anticipate that the percentage of our revenue derived from commercial
enterprises will increase gradually in future quarters as our commercial sales
executives begin to reach the end of the long sales cycles in accounts in the
commercial sector. However there can be no assurance that our sales executives
will be successful in the near term or in the quarters or years in which we
expect to realize the sales.


Therefore
any one customer, or groups of customers, in the same industry segment could
become a material component of revenue in any future quarter or year. There can
be no assurance that the historical distribution of revenue by industry segment
or customer is representative of future revenue projections and we expect that
our revenue by industry segment and customer will vary dynamically from period
to period. In addition, the concentration of revenue in one industry or customer
is largely dependent upon factors outside of our control including, but not
limited to, the customer's information technology budgets and spending
availability, the general economic and political environment, or the complexity
of the customer's purchasing process, such as in the federal government. Due to
the concentration of our sales, delays in licensing of our products by one or
more large customers or potential customers would have a material adverse effect
on our results of operations and financial condition.


**OUR
FINANCIAL FORECASTS MAY NOT BE ACHIEVED, INCLUDING DUE TO THE UNPREDICTABILITY
OF END-OF-PERIOD BUYING PATTERNS, WHICH COULD MAKE OUR STOCK PRICE MORE
VOLATILE.**





We do not
maintain significant levels of backlog. License fee revenue in any quarter is
dependent, in significant part, on contracts entered into or orders booked and
shipped in that quarter. The risk of quarterly fluctuations is increased by the
fact that a significant portion of our quarterly net revenue has historically
been generated during the last month of each fiscal quarter. Many enterprise
customers negotiate site licenses near the end of each quarter. Due to these
end-of-period buying patterns, forecasts may not be achieved, either because
expected sales do not occur or because they occur at lower prices or on terms
that are less favorable to us.





**25**
 Table of Contents





In
addition, fluctuations may be caused by a number of other factors, including:





·
    the
      timing and volume of customer orders and customer cancellations;
 ·
    a
      change in our revenue mix of products and services and a resulting change
      in the gross margins;


·
    the
      timing and amount of our expenses;


·
    the
      introduction of competitive products by existing or new competitors;


·
    reduced
      demand for any given product;


·
    quarterly
      seasonality of customer buying patterns due to holidays and vacation
      patterns; and


·
    the
      market’s transition between operating systems.





Due to
these factors, forecasts may not be achieved, either because expected revenues
do not occur or because they occur at lower prices, at later times, or on terms
that are less favorable to us. In addition, these factors increase the chances
that our results could diverge from the expectations of investors and analysts.
If so, the market price of our stock would likely decrease and may result in
shareholder lawsuits.





**WE
FACE RISKS ASSOCIATED WITH GOVERNMENTAL CONTRACTING.**





Our
customers include agencies of the U.S. government and in the future may include
other U.S., state and local governments or agencies. Government agencies present
us with processes that are unique to these organizations including procurement,
budgetary constraints and cycles, contract modifications and cancellations,
government audits and security clearances.





Contracting
with public sector customers is highly competitive and can be expensive and
time-consuming, often requiring that we incur significant upfront time and
expense without any assurance that we will win a contract. Public sector
customers may also change the way they procure new contracts and may adopt new
rules or regulations governing contract procurement, including required
competitive bidding or use of “open source” products, where available. Demand
and payment for our products and services are impacted by public sector
budgetary cycles and funding availability, with funding reductions or delays
adversely impacting public sector demand for our products and services.





Public
sector customers often have contractual or other legal rights to terminate
current contracts for convenience or due to a default. If a contract is
cancelled for convenience, which can occur if the customer’s product needs
change, we may only be able to collect for products and services delivered prior
to termination. If a contract is cancelled because of default, we may only be
able to collect for products and services delivered, and we may be forced to pay
any costs incurred by the customer for procuring alternative products and
services. The U.S. government may also terminate contracts with us if we come
under foreign government control or influence, require that we disclose our
pricing data during the course of negotiations, ban us from doing business with
any government entity and require us to prevent access to classified data.





U.S.
government and other state and local agencies routinely investigate and audit
government contractors’ administrative processes. They may audit our performance
and pricing and review our compliance with applicable rules and regulations. If
they find that we have improperly allocated costs, they may require us to refund
those costs or may refuse to pay us for outstanding balances related to the
improper allocation. An unfavorable audit could result in a reduction of
revenue, and may result in civil or criminal liability if the audit uncovers
improper or illegal activities.





Some
agencies within the U.S. government require some or all of our personnel to
obtain proper security clearance. If our key personnel are unable to obtain or
retain this clearance, we may be unable to bid for or retain some government
contracts.





**WE
ARE HIGHLY DEPENDENT ON REVENUE FROM OUR FLAGSHIP PRODUCT HERCULES.**





We have
historically derived the majority of our revenue from our flagship product
Hercules. This product is expected to continue to account for a significant
portion of our total revenue. Because of this revenue concentration, our
business could be harmed by a decline in demand for, or in the price of, this
product as a result of, among other factors, any change in our pricing model, a
maturation in the markets for this product or other risks described in this
document.





**26**
 Table of Contents





**THE
RESULTS OF OUR RESEARCH AND DEVELOPMENT EFFORTS ARE UNCERTAIN.**





We
believe that we will need to make significant research and development
expenditures to remain competitive. While we perform extensive usability and
beta testing of new products, the products we are currently developing or may
develop in the future may not be technologically successful. If they are not
technologically successful, our resulting products may not achieve market
acceptance and our products may not compete effectively with products of our
competitors currently in the market or introduced in the future.





**THE
LENGTH OF THE PRODUCT DEVELOPMENT AND SALES CYCLES ARE DIFFICULT TO PREDICT,
WHICH MAKES IT DIFFICULT TO PREDICT FUTURE REVENUES AND WHICH MAY CAUSE US TO
MISS ANALYSTS’ ESTIMATES AND RESULT IN OUR STOCK PRICE DECLINING.**





The
length of our product development and sales cycles may be greater than
originally expected. We may experience delays in future product development or
sales. These delays could have a material adverse effect on the amount and
timing of future revenues. Because our licensing cycle is a lengthy process, the
accurate prediction of future revenues from new licenses is difficult. In
addition, engineering services are dependent upon the varying level of
assistance desired by licensees and, therefore, revenue from these services is
also difficult to predict. We employ two methods of contract revenue accounting
based upon the state of the technology licensed, the dollar magnitude of the
program, and the ability to estimate work required over the contract period. We
use ratable revenue recognition for mature technologies that require support
after delivery of the technology. This method results in expenses associated
with a particular contract to be recognized as incurred over the contract
period, whereas contract fees associated with the contract are recognized
ratably over the period during which the post-contract customer support is
expected to be provided. We also use percentage-of-completion accounting for
contracts that may require significant development and support over the contract
term. There can be no assurance that we can accurately estimate the amount of
resources required to complete projects, or that we will have, or be able to
expend, sufficient resources required to complete a project. Furthermore, there
can be no assurance that the product development schedule for these projects
will not be changed or delayed. All of these factors make it difficult to
predict future licensing revenue that may result in us missing analysts’
estimates and causing our stock price to decline.





**OUR
EFFORTS TO DEVELOP AND INTRODUCE HERCULES AS PART OF AN APPLIANCE TO THE MARKET
IS UNPROVEN AND MAY NOT BE SUCCESSFUL AND OUR FUTURE REVENUE AND OPERATING
RESULTS COULD BE ADVERSELY AFFECTED.**


We have
announced the introduction of the Hercules Security-On-Demand appliance which is
expected to be released for general availability in the second quarter of 2005.
Because of our limited experience with the manufacturing of appliances, our
efforts to develop and sell appliances may not be as successful as we
anticipate. In addition, we expect that the gross margins generated from the
revenue from our appliance will be lower than the gross margins generated from
our software products. Our appliance solution may not achieve market acceptance
and may not be able to compete with solutions either currently in the market or
introduced in the future. In addition, we will sell the appliance under a new
usage based pricing model which is largely untested in the software industry and
may not be accepted by customers. We may also sell the appliance solution
through channels in which we have only limited experience. If we are unable to
achieve market acceptance of the appliance and new pricing and sales models or
compete effectively with solutions of our competitors, our future net revenues
and operating results could be adversely affected.
 
 We will
rely on a third party to manufacture our appliance hardware product. Reliance on
third-party manufacturers, involves a number of risks, including the lack of
control over the manufacturing process and the potential absence or
unavailability of adequate capacity. If our third party manufacturer cannot or
will not manufacture our appliance in required volumes on a cost-effective
basis, in a timely manner, or at all, we will have to secure additional
manufacturing capacity. Even if this additional capacity is available at
commercially acceptable terms, the qualification process could be lengthy and
could cause interruptions in appliance shipments. The unexpected loss of this
third party manufacturer would be disruptive to our
business.





**27**
 Table of Contents





**IF
THE CARRYING VALUE OF OUR LONG-LIVED ASSETS IS NOT RECOVERABLE, AN IMPAIRMENT
LOSS MUST BE RECOGNIZED WHICH WOULD ADVERSELY AFFECT OUR FINANCIAL RESULTS.**





We
evaluate our long-lived assets, including property and equipment and capitalized
software development costs whenever events or circumstances occur which indicate
that these assets might be impaired. Capitalized software development costs are
evaluated annually for impairment in the fourth quarter of each fiscal year,
regardless of events and circumstances. We will continue to evaluate the
recoverability of the carrying amount of our long-lived assets, and we may incur
substantial impairment charges, which could adversely affect our financial
results.





**WE
MUST MANAGE AND RESTRUCTURE OUR OPERATIONS EFFECTIVELY.**





We
continually evaluate our product and corporate strategy. We have in the past
undertaken and will in the future undertake organizational changes and/or
product and marketing strategy modifications. These organizational changes
increase the risk that objectives will not be met due to the allocation of
valuable limited resources to implement changes. Further, due to the uncertain
nature of any of these undertakings, these efforts may not be successful and we
may not realize any benefit from these efforts.





**WE
MUST ATTRACT AND RETAIN PERSONNEL WHILE COMPETITION FOR PERSONNEL IN OUR
INDUSTRY IS INTENSE.**





We
believe that our future success will depend in part on our ability to recruit
and retain highly skilled management, sales and marketing and technical
personnel. Competition in recruiting personnel in the software industry is
intense. To accomplish our objectives, we believe that we must provide personnel
with a competitive compensation package, including stock options which may
require ongoing stockholder approval.





**OUR
SOFTWARE MAY BE SUBJECT TO DEFECTS AND PRODUCT LIABILITY.**





Software
products frequently contain errors or defects, especially when first introduced
or when new versions or enhancements are released. We have not experienced any
material adverse effects resulting from any of these defects or errors to date
and we test our products prior to release. Nonetheless, defects and errors could
be found in current versions of our products, future upgrades to current
products or newly developed and released products. Software defects could result
in delays in market acceptance or unexpected reprogramming costs, which could
materially adversely affect our operating results. Most of our license
agreements with customers contain provisions designed to limit our exposure to
potential product liability claims. It is possible, however, that these
provisions limiting our liability may not be valid as a result of federal,
state, local or foreign laws or ordinances or unfavorable judicial decisions. A
successful product liability claim could have a material adverse effect on our
business, operating results and financial condition.





**OUR
SOFTWARE PRODUCTS AND WEB SITE MAY BE SUBJECT TO INTENTIONAL DISRUPTION.**





While we
have not been the target of software viruses or other attacks specifically
designed to impede the performance of our products or disrupt our website, such
viruses or other attacks could be created and deployed against our products or
website in the future. Similarly, experienced computer programmers, or hackers,
may attempt to penetrate our network security or the security of our website
from time to time. A hacker who penetrates our network or website could
misappropriate proprietary information or cause interruptions of our services.
We might be required to expend significant capital and resources to protect
against, or to alleviate, problems caused by virus creators and hackers.





**INCREASED
CUSTOMER DEMANDS ON OUR TECHNICAL SUPPORT SERVICES MAY ADVERSELY AFFECT OUR
FINANCIAL RESULTS.**





We may be
unable to respond quickly enough to short-term increases in customer demand for
support services. We also may be unable to modify the format of our support
services to compete with changes in support services provided by competitors.
Further customer demand for these services, without corresponding revenue could
increase costs and adversely affect our operating results.





**28**
 Table of Contents





**WE
RELY ON THIRD PARTY TECHNOLOGIES** .





Our
software products are designed to run on multiple operating systems and
integrate with security products from other vendors. Although we believe that
the target operating systems and products are and will be widely utilized by
businesses in the corporate market, no assurances can be given that these
businesses will actually adopt such technologies as anticipated or will not in
the future migrate to other computing technologies that we do not support.
Moreover, if our products and technology are not compatible with new
developments from these companies, as to which there can be no assurances, our
business, results of operations and financial condition could be materially and
adversely affected. Further, the determination by any of the companies which
offer scanners not to permit us to support their scanners, could have a material
adverse effect on our financial condition or results of operations.





In
addition, some of our products incorporate licensed software. We must be able to
obtain reasonably priced licenses and successfully integrate this software with
our technologies. In addition, some of our products may include “open source”
software. Our ability to commercialize products or technologies incorporating
open source software may be restricted because, among other reasons, open source
license terms may be ambiguous and may result in unanticipated obligations
regarding our products.





**WE
RELY ON OUTSIDE RESEARCH ORGANIZATIONS AND SCANNING VENDORS** .





With
respect to security vulnerability research, we monitor various security
intelligence websites, Internet Relay Chat, or IRC channels and alerts from our
scanning partners for the identification of new vulnerabilities and exploits and
we have contracted with iDefense to provide updated vulnerability research data
in addition to our own research efforts. Our own research team uses publicly
available research to find information on vulnerabilities and their attributes.
There can be no assurance that iDefense or the publicly available sites will
continue to operate as a going concern and that the data they provide will be
delivered without interruption. We have established business relationships with
scanning vendors. Hercules is interoperable with their scanning tools and
although not required for Hercules to remediate vulnerabilities, Hercules
imports the scan data results from those scanning tools to perform remediation.
The termination of one or more of the scanning vendor relationships with us
could have a material adverse effect on our results of operations.





**WE
FACE AGGRESSIVE COMPETITION IN MANY AREAS OF OUR BUSINESS, AND OUR BUSINESS WILL
BE HARMED IF WE FAIL TO COMPETE EFFECTIVELY.**





We
encounter aggressive competition from numerous competitors in many areas of our
business. Many of our current and potential competitors have longer operating
histories, greater name recognition and substantially greater financial,
technical and marketing resources than we have. We may not be able to compete
effectively with these competitors. To remain competitive, we must develop new
products and periodically enhance our existing products in a timely manner. We
anticipate that we may have to adjust the prices of many of our products to stay
competitive. In addition, new competitors may emerge, and entire product lines
may be threatened by new technologies or market trends that reduce the value of
these product lines. The market in which we compete is influenced by the
strategic direction of major computer hardware manufacturers and operating
system software providers. Our competitiveness depends on our ability to enhance
existing products and to offer successful new products on a timely basis. We
have limited resources and must restrict product development efforts to a
relatively small number of projects.





**OUR
MANAGEMENT TEAM IS NEW AND ITS WORKING RELATIONSHIPS ARE
UNTESTED** .





We have
only recently assembled our management team. Some members of our management team
have worked with each other in the past, although we cannot assess at this time
the effectiveness of their working relationships and may be required to make
changes in the management team to achieve our objectives.





**WE
RELY ON INTELLECTUAL PROPERTY AND PROPRIETARY RIGHTS.**





We regard
our software as proprietary and underlying technology as proprietary. We seek to
protect our proprietary rights through a combination of confidentiality
agreements and copyright, patent, trademark and trade secret laws. However, we
do not employ technology to prevent copying of our products. Third parties may
copy aspects of our products or otherwise obtain and use our proprietary
information without authorization or develop similar technology independently.





**29**
 Table of Contents





We do not
have any patents or currently registered copyrights on any of our proprietary
technology that we believe to be material to our future success. Although we
have filed five currently pending utility patent application in the United
States and one related currently pending Patent Cooperation Treaty patent
application which has been the basis for eleven currently pending foreign
applications with respect to some of our business applications and intellectual
property rights related to our Hercules software, we have been issued no patents
and we cannot assure you that any will be issued. Our future patents, if any,
may be successfully challenged and may not provide us with any competitive
advantages. We may not develop proprietary products or technologies that are
patentable and other parties may have prior claims.





In
selling our products, we have in the past relied primarily on shrink wrap
licenses that are not signed by licensees, and, therefore, such licenses may be
unenforceable under the laws of some jurisdictions. In addition, existing
copyright laws afford limited practical protection. Furthermore, the laws of
some foreign countries do not offer the same level of protection of our
proprietary rights as the laws of the United States.





Patent,
trademark and trade secret protection is important to us because developing and
marketing new technologies and products is time-consuming and expensive. We do
not own any U.S. or foreign patents or registered intellectual property except
our registered copyright in the code for our Hercules Software and our United
States registered trademark for the mark Hercules in Class 9. We may not obtain
issued patents or other protection from any future patent applications owned by
or licensed to us.





Our
competitive position is also dependent upon unpatented trade secrets. Trade
secrets are difficult to protect. Our competitors may independently develop
proprietary information and techniques that are substantially equivalent to ours
or otherwise gain access to our trade secrets, such as through unauthorized or
inadvertent disclosure of our trade secrets.





There can
be no assurance that our means of protecting our proprietary rights will be
adequate or that our competitors will not independently develop similar
technology substantially equivalent or superseding proprietary technology.
Furthermore, there can be no assurance that any confidentiality agreements
between us and our employees will provide meaningful protection of our
proprietary information, in the event of any unauthorized use or disclosure
thereof. Any legal action that we may bring to protect proprietary information
could be expensive and may distract management from day-to-day operations.





**WE
ARE INVOLVED IN LITIGATION, AND MAY BECOME INVOLVED IN FUTURE LITIGATION, WHICH
MAY RESULT IN SUBSTANTIAL EXPENSE AND MAY DIVERT OUR ATTENTION FROM THE
IMPLEMENTATION OF OUR BUSINESS STRATEGY.**





We
believe that the success of our business depends, in part, on obtaining
intellectual property protection for our products, defending our intellectual
property once obtained and preserving our trade secrets. Litigation may be
necessary to enforce our intellectual property rights, to protect our trade
secrets and to determine the validity and scope of our proprietary rights. Any
litigation could result in substantial expense and diversion of our attention
from our business, and may not adequately protect our intellectual property
rights.





In
addition, we may be sued by third parties which claim that our products infringe
the intellectual property rights of others. This risk is exacerbated by the fact
that the validity and breadth of claims covered in technology patents involve
complex legal and factual questions for which important legal principles are
unresolved. While we are not aware of any basis for such claims and are not
currently party to any material lawsuits, any litigation or claims against us,
whether or not valid, could result in substantial costs, place a significant
strain on our financial resources, divert management resources and harm our
reputation. Such claims could result in awards of substantial damages, which
could have a significant adverse impact on our results of operations. In
addition, intellectual property litigation or claims could force us to:




-
    cease
      licensing, incorporating or using any of our products that incorporate the
      challenged intellectual property, which would adversely affect our
      revenue;
 -
    obtain
      a license from the holder of the infringed intellectual property right,
      which license may not be available on reasonable terms, if at all; and
 -
    redesign
      our products, which would be costly and time-consuming.


**30**
 Table of Contents





In
January, February and March 2005, seven virtually identical lawsuits were filed
against Citadel, Steven B. Solomon, our Chief Executive Officer and a Director,
and Richard Connelly, our Chief Financial Officer. These suits have been
consolidated in one action styled Ruth R. Lentz v. Citadel Security Software,
Inc., et al., Civil Action No. 3:05-CV-0100-D, in the United States District
Court for the Northern District of Texas. Each case was filed on behalf of a
putative class of persons and/or entities who purchased our securities between
February 12, 2004 and December 16, 2004, inclusive. The suits seek recovery of
unspecified damages under Sections 10(b) and 20(a) of the Securities Exchange
Act of 1934, as amended, and Rule 10b-5 promulgated thereunder. The suits were
filed after our announcement on December 17, 2004 that our projection of revenue
and earnings for the full year 2004 would be less than previously projected. On
March 15, 2005, motions for appointment as lead plaintiff and for approval of
selection of lead counsel were filed and are pending before the Court for
determination. We believe these suits are without merit and intend to vigorously
defend them. Discovery has not yet commenced, and no trial date has been set.
These lawsuits could be time-consuming and costly and could divert the attention
of our management personnel.





From time
to time, we may be subject to additional legal claims incidental to our
business. We may suffer an unfavorable outcome as a result of one or more
claims. We do not expect the final resolution of these claims to have a material
adverse effect on our financial position, individually or in the aggregate.
However, depending on the amount and timing of unfavorable resolutions of claims
against us, or the costs of settlement or litigation, our future results of
operations or cash flows could be materially adversely affected.


Our
former parent company, CT Holdings, is a party to some legal proceedings, to
which Citadel is not a party. If a court in a lawsuit by an unpaid creditor or
representative of creditors, such as a trustee in bankruptcy, were to find that
at the time CT Holdings effected the spin-off of Citadel, CT Holdings or Citadel
(1) was insolvent; (2) was rendered insolvent by reason of the spin-off
distribution; (3) was engaged in a business or transaction for which their
respective remaining assets constituted unreasonably small capital; or (4)
intended to incur, or believed it would incur, debts beyond its ability to pay
as such debts matured, such court may be asked to void the spin-off distribution
(in whole or in part) as a fraudulent conveyance and require that the
stockholders return the Citadel Shares (in whole or in part) to CT Holdings or
require Citadel to fund certain liabilities for the benefit of creditors.
Citadel believes that at the time of the spin-off distribution, the spin-off
would not have given rise to any such claims.


**SOME
PROVISIONS OF OUR CERTIFICATE OF INCORPORATION AND BYLAWS MAY DISCOURAGE
TAKEOVERS.**





Our
certificate of incorporation and bylaws contain some anti-takeover provisions
that may make more difficult or expensive or that may discourage a tender offer,
change in control or takeover attempt that is opposed by our board of directors.
In particular, our certificate of incorporation and bylaws:





·
    classify
      Citadel’s board of directors into three groups, so that stockholders elect
      only one-third of the board each year;


·
    permit
      stockholders to remove directors only for cause and only by the
      affirmative vote of at least 80% of Citadel’s voting shares;


·
    permit
      a special stockholders’ meeting to be called only by a majority of the
      board of directors;


·
    do
      not permit stockholders to take action except at an annual or special
      meeting of stockholders;


·
    require
      stockholders to give Citadel advance notice to nominate candidates for
      election to Citadel’s board of directors or to make stockholder proposals
      at a stockholders’ meeting;


·
    permit
      Citadel’s board of directors to issue, without stockholder approval,
      preferred stock with such terms as the board may determine;


·
    require
      the vote of the holders of at least 80% of Citadel’s voting shares for
      stockholder amendments to Citadel’s bylaws; and


·
    require,
      for the approval of a business combination with stockholders owning 5% or
      more of Citadel’s voting shares, the vote of at least 50% of Citadel’s
      voting shares not owned by such stockholder, unless certain fair price
      requirements are met or the business combination is approved by the
      continuing directors of Citadel.







**31**
 Table of Contents




These
provisions of our certificate of incorporation and bylaws, Delaware law and
other measures we may adopt could discourage potential acquisition proposals and
could delay or prevent a change in control of Citadel, even though a majority of
Citadel’s stockholders may consider such proposals, if effected, desirable.
These provisions could also make it more difficult for third parties to remove
and replace the members of Citadel’s board of directors. Moreover, these
provisions could diminish the opportunities for stockholders to participate in
some tender offers, including tender offers at prices above the then-current
market value of the our shares of common stock, and may also inhibit increases
in the trading price of the our shares that could result from takeover attempts
or speculation.


In
connection with the spin-off distribution, Citadel agreed to indemnify CT
Holdings for all taxes and liabilities incurred as a result of Citadel’s or an
affiliate’s post-distribution action or omission contributing to an Internal
Revenue Service determination that the spin-off distribution was not tax-free.
Unless CT Holdings effectively rebuts the presumption that a change in control
transaction involving Citadel or disposition of Citadel occurring within the
four-year period beginning two years prior to the distribution date is pursuant
to the same plan or series of related transactions as the distribution, the
Internal Revenue Service might determine that the distribution was not tax-free,
giving rise to Citadel’s indemnification obligation. These provisions of the tax
disaffiliation agreement may have the effect of discouraging or preventing an
acquisition of Citadel or a disposition of Citadel’s businesses, which may in
turn depress the market price for our shares.





**FAILURE
TO QUALIFY AS A TAX-FREE TRANSACTION COULD RESULT IN SUBSTANTIAL LIABILITY.**





In May
2002 Citadel was spun out of CT Holdings in a pro rata tax free distribution to
shareholders. CT Holdings and Citadel intend for the distribution to be tax-free
for U.S. federal income tax purposes. Neither CT Holdings nor Citadel requested
an advance ruling from the Internal Revenue Service, or any opinion of their tax
advisors, as to the tax consequences of the distribution. No assurance can be
given that the Internal Revenue Service or the courts will agree that the
distribution was tax-free.





If the
distribution does not qualify for tax-free treatment, a substantial corporate
tax would be payable by the consolidated group of which CT Holdings is the
common parent measured by the difference between (1) the aggregate fair market
value of the Citadel shares distributed on the distribution date and (2) CT
Holdings' adjusted tax basis in the distributed Citadel shares on the
distribution date. The corporate level tax would be payable by CT Holdings.
However, Citadel has agreed under certain circumstances to indemnify CT Holdings
for all or a portion of this tax liability. This indemnification obligation, if
triggered, could have a material adverse effect on the results of operations and
financial position of Citadel. In addition, under the applicable treasury
regulations, each member of CT Holdings' consolidated group (including Citadel)
is severally liable for such tax liability. Furthermore, if the distribution
does not qualify as tax-free, each CT Holdings stockholder who received Citadel
shares in the distribution would be taxed as if he had received a cash dividend
equal to the fair market value of his Citadel shares on the distribution
date.





**32**
 Table of Contents





**ITEM 2.   DESCRIPTION OF PROPERTY**


In May
2004 we signed an 8 year lease for approximately 33,500 square feet of office
space in Dallas, Texas. The average monthly rent over the term of the new lease
is approximately $52,200 per month beginning on November 1, 2004. The new office
space was renovated and we moved into the new office space during the fourth
quarter of 2004. During
the year ending December 31, 2004, we completed the renovations to our Dallas
office. Approximately $836,000 of the renovations were lease incentives paid by
the landlord. Approximately $53,000 of renovation expenditures were paid by us
during the year ended December 31, 2004 and approximately $211,000 was paid
during the first quarter of 2005. In addition, we expect that a final payment of
approximately $186,000 will be made in the second quarter of 2005. All of the
expenditures for the renovations to the Dallas office were or will be paid from
general working capital.
 
 Also in
May 2004 we entered into a 3 year lease for approximately 6,300 square feet of
office space located in Reston, Virginia with a monthly base rent of
approximately $12,000 per month. We believe that the leases have commercially
reasonable terms. We maintain fire and casualty insurance that we believe
adequately covers our leased properties against loss. We believe that our
existing facilities are adequate for current needs and that the productive
capacity in such facilities is substantially being utilized. There are no
immediate plans to open offices outside the United States.


**ITEM3.   LEGAL PROCEEDINGS**





In
January, February and March 2005, seven virtually identical lawsuits were filed
against Citadel, Steven B. Solomon, the Chief Executive Officer and a Director
of the Company, and Richard Connelly, the Company’s Chief Financial Officer.
These suits have been consolidated in one action styled Ruth R. Lentz v. Citadel
Security Software, Inc., et al., Civil Action No. 3:05-CV-0100-D, in the United
States District Court for the Northern District of Texas. Each case was filed on
behalf of a putative class of persons and/or entities who purchased the
Company’s securities between February 12, 2004 and December 16, 2004, inclusive.
The suits seek recovery of unspecified damages under Sections 10(b) and 20(a) of
the Securities Exchange Act of 1934, as amended, and Rule 10b-5 promulgated
thereunder. The suits were filed after the Company’s announcement on December
17, 2004 that its projection of revenue and earnings for the full year 2004
would be less than previously projected. On March 15, 2005, motions for
appointment as lead plaintiff and for approval of selection of lead counsel were
filed and are pending before the Court for determination. The Company believes
these suits are without merit and intends to vigorously defend
them.





Various
legal claims are pending or may be instituted against our former parent company,
CT Holdings, Inc. Because Citadel is a separate corporation which did not engage
in the activities giving rise to these legal claims, Citadel’s management
believes the risk that Citadel’s assets could be subject to these claims and
liabilities (except for those claims and liabilities expressly assumed in the
distribution agreement) is remote, although there can be no assurance that
Citadel will not become subject to these claims and liabilities.





We may
become involved from time to time in litigation on various matters which are
routine to the conduct of our business. We believe that none of these actions,
individually or in the aggregate, will have a material adverse effect on our
financial position or results of operations, though any adverse decision in
these cases or the costs of defending or settling such claims could have a
material adverse effect on our business.





**ITEM 4.   SUBMISSION OF MATTERS TO A VOTE OF SECURITY
HOLDERS**





No
matters were submitted to a vote of our security holders during the fourth
quarter of 2004.





**33**
 Table of Contents





**PART
II**





**ITEM 5.   MARKET FOR COMMON EQUITY AND RELATED
STOCKHOLDER MATTERS**





**MARKET
INFORMATION**





On May
20, 2002 the Company’s stock began trading on the Over-The-Counter Bulletin
Board under the symbol CDSS. In April 2004 the Company's stock began trading on
the NASDAQ SmallCap Market under the symbol CDSS. As of March 30, 2005,
the last sales price per share of the Company’s common stock, as reported by The
NASDAQ SmallCap Market, was $1.10 . The
following table presents the quarterly range of high and low closing prices for
our common stock from January 1, 2003 through December 31, 2004, as reported by
The NASDAQ SmallCap Market and the Over-The-Counter Bulletin Board prior to
April 2004 (high and low quotations from the Over-The-Counter Bulletin Board
reflect inter-dealer prices, without retail markup, markdown or commission, and
may not necessarily represent actual transactions).





**HIGH**
    
    **LOW****YEAR
      ENDED DECEMBER 31, 2004****1****st****Quarter**
    
    $
    **6.36**
    
    **$******
    ******3.50****2****nd****Quarter**
    
    
    **5.40**
    
    
    **2.78****3****rd****Quarter**
    
    
    **3.18**
    
    
    **1.73****4****th****Quarter**
    
    
    **5.00**
    
    
    **2.28********YEAR
      ENDED DECEMBER 31, 2003****1****st****Quarter**
    
    $
    **1.60**
    
    **$******
    ******0.96****2****nd****Quarter**
    
    
    **2.03**
    
    
    **1.02****3****rd****Quarter**
    
    
    **1.80**
    
    
    **1.06****4****th****Quarter**
    
    
    **4.50**
    
    
    **1.25**





At
December 31, 2004 there were approximately 829 holders of record of the
Company’s outstanding common stock. Holders of common stock are entitled to
dividends when and if declared by the Board of Directors out of legally
available funds, subject to the limitations imposed by our shares of Series A
Convertible Preferred Stock and our credit facilities. The Company has never
paid cash dividends on its Common Stock, and management intends, for the
immediate future, to retain any earnings for the operation and expansion of the
Company’s business. Any future determination regarding the payment of dividends
will depend upon results of operations, capital requirements, the financial
condition of the Company, the limitations imposed by our preferred stock and
credit facilities, and such other factors that the Board of Directors of the
Company may consider. At December 31, 2004, the Company has 1,000,000 shares of
preferred stock authorized, of which 15,000 shares have been issued as Series A
Convertible Preferred Stock, which entitle the holders thereof to preferences as
to payment of dividends and liquidation proceeds. ****





**SALES
OF UNREGISTERED SECURITIES - USE OF PROCEEDS**





On
February 10, 2004, Citadel closed a private placement for gross proceeds of $15
million consisting of 15,000 shares of Series A Convertible Preferred Stock (the
“Series A Shares”) convertible at the option of the holder without additional
cost into 3 million shares of common stock, and five year warrants to purchase
1.2 million shares of common stock of Citadel, in a private placement to an
accredited investor under Rule 506 under Regulation D of the Securities Act of
1933, as amended. The placement agents, Merriman Curhan Ford & Co. and Brean
Murray & Co., received a fee of approximately $1,125,000 plus warrants to
purchase 225,000 shares of common stock at an exercise price of $5.15 per share
with substantially the same rights as the warrants the holders of Series A
Shares received. We granted registration rights to the holders of these
securities and registered the shares of our common stock underlying the
preferred stock and warrants in May 2004. The net proceeds from the preferred
stock financing after private placement fees and legal and accounting fees were
used to fund the expansion of our sales, marketing and engineering initiatives
and for working capital purposes .







**34**
 Table of Contents




**EQUITY
COMPENSATION PLANS**
 
 The 2002
Stock Incentive Plan (the "Plan") was adopted by the board of directors and
approved by the shareholder of Citadel prior to a spin out transaction of
Citadel in May 2002. The plan authorizes the Board or a committee, which
administers the plan, to grant stock options, stock appreciation rights,
restricted stock and deferred stock awards to eligible officers, directors,
employees and consultants. A total of 1,500,000 shares of common stock were
originally reserved for issuance under the terms of the Plan. In 2004 our Board
and our stockholders approved amendments to the Plan, including an increase in
the shares of common stock reserved for issuance thereunder by 1,500,000 shares
of common stock to an aggregate of 3,000,000 shares. In the event of any sale of
assets, merger, reorganization, consolidation, recapitalization, stock dividend
or other change in corporate structure affecting the stock, the Board or
committee may make an equitable substitution or adjustment in the aggregate
number of shares reserved for issuance under the Plan. Since the inception of
the Plan we have granted 2,402,000 awards under the Plan through December 31,
2004. Options cancelled since the inception of the Plan due to employee
terminations amounted to 746,776 and were added back to the options available
for future grants under the Plan. Option holders under the Plan have exercised
337,224 options since the inception of the Plan through December 31, 2004 and
hold 325,154 options which were exercisable at December 31, 2004. The options
granted have a term of 10 years and generally vest over periods of up to three
years. The underlying shares of common stock in the Plan were registered on Form
S-8 in July 2003.
 
 The board
of directors has also granted options outside of the Plan. These options are not
covered under a plan approved by the stockholders. Options have been granted to
officers, directors, employees, stockholders and consultants to the Company. The
options granted have a term of 10 years or less. There were 6,675,000 options
outstanding at December 31, 2004 of which 5,302,485, are exercisable. The
remaining options vest over periods of up to three years.


**Equity
      Compensation Plan Information****Plan
      category**
    
    **Number
      of securities to be issued upon exercise of outstanding options, warrants
      and rights**
    
    **Weighted-average
      exercise price of outstanding options, warrants and
      rights**
    
    **Number
      of securities remaining available for future issuance under equity
      compensation plans (excluding securities reflected in column
      (a))******
    
    **(a)**
    
    **(b)**
    
    **(c)****Equity
      compensation plans**
    
    
    ****
    
    
    ****
    
    
    ******approved
      by security holders**
    
    
    **1,318,000**
    
    **$**
    **2.73**
    
    
    **1,344,776******
    
    
    ****
    
    
    ****
    
    
    ******Equity
      compensation plans not**
    
    
    ****
    
    
    ****
    
    
    ******approved
      by security holders**
    
    
    **6,675,000**
    
    **$**
    **1.17**
    
    
    **-**




**REPURCHASES
OF SECURITIES**





The
Company made no repurchases of shares during the fourth quarter of
2004.





**35**
 Table of Contents





**ITEM 6.   MANAGEMENT’S DISCUSSION AND ANALYSIS**





You
should read the following discussion in conjunction with our audited financial
statements and related notes included elsewhere in this Form 10-KSB. Our year
ends on December 31, and each of our quarters end on the final day of a calendar
quarter (each March 31, June 30 and September 30). The following discussion
contains forward-looking statements. Please see "Risk Factors" and "Cautionary
Statement Regarding Forward-Looking Statements" for a discussion of
uncertainties, risks and assumptions associated with these statements.





**OUR
BUSINESS**





The
security software business of Citadel was formed in 1996 as the result of the
acquisition of several technology businesses operated by a technology business
incubator. Citadel was spun off as a standalone company in May 2002. We develop
and market full life cycle vulnerability management software for enterprise
level network security. Our computer software products include security
management solutions for networks and personal workstations which are designed
to manage security on servers and personal computers ("PC") attached to local
area networks ("LAN"). Our products enable organizations to remediate their
computer network's security vulnerabilities that occur in software applications,
unauthorized or weak access rights and misconfigurations of systems. In some
cases, security vulnerabilities are the result of leaving unnecessary services
turned on in a PC or LAN, or the occurrence of a system backdoor that remains
closed until exploited and opened by a hacker. Our software products can also be
used to maintain compliance with security policies of the managed devices
connected to the network.





With our
products, organizations are able to more efficiently manage their computing
environments and enforce security policies from a single point of control across
Windows, Linux, Unix and Mac platforms. Our products and services allow
enterprises to secure confidential information, applications, and systems from
unauthorized access, worms, and other security vulnerabilities. Our solutions
are designed to reduce customer costs, maintain integrity and availability of
customer information, maintain the secure operation of workstations and servers,
secure systems from unauthorized access or use, and generally enable IT
professionals to devote more time to improving service rather than focusing on
security policy details. Our products also allow customers to comply with
internal and external security policies that are being driven by government or
industry mandates.





**CRITICAL
ACCOUNTING POLICIES**





The
discussion and analysis of our financial condition and results of operations are
based on our financial statements, which have been prepared in accordance with
accounting principles generally accepted in the United States of America (GAAP).
The preparation of these financial statements requires us to make estimates and
judgments that affect the reported amounts of assets, liabilities, revenues and
expenses, and related disclosure of contingent assets and liabilities. On an
on-going basis, we evaluate these estimates, including those related to bad
debts, returns and allowances, software capitalization and technological
obsolescence, and litigation. We base our estimates on historical experience and
on various other assumptions that are believed to be reasonable under the
circumstances, the results of which form the basis for making judgments about
the carrying values of assets and liabilities. Actual results may differ from
these estimates under different assumptions or conditions.





We have
identified below our accounting policies for revenue recognition and software
development costs, which we believe are most critical to our business operations
and are discussed throughout Management’s Discussion and Analysis, where such
policies affect our reported and expected financial results.





**REVENUE
RECOGNITION**





Our
customers consist of large and small corporations, healthcare organizations,
financial institutions and government and educational agencies. Our revenue
recognition policies have been designed to follow the guidance provided by
Statement of Position (SOP) 97-2, "Software Revenue Recognition," as amended by
SOP 98-9 and Staff Accounting Bulletin (SAB) 104, "Revenue Recognition." Revenue
from license fees is generally recognized when a fixed fee order has been
received, delivery has occurred to the customer through electronic download or
if software media and documentation is shipped, when shipped if delivery terms
are FOB "Origin" or when delivered if delivery terms are FOB "Destination". In
addition, revenue is recognized only when the collectibility of the invoiced
amounts is probable and acceptance criteria, if any, have been met. Customer
support contracts provide the customer the right to telephone support, software
updates, point releases of new features and functionality, and vulnerability
remediation updates on a when and if available basis. Customer support contracts
are sold separately from the license and the related revenue is recognized
ratably over the term of the support contract. In arrangements that include
multiple elements, including perpetual software licenses and maintenance and/or
services, revenue is allocated to the undelivered components based on vendor
specific objective evidence (“VSOE”) and recognized based on management's
estimate of the fair value of each undelivered component as described in SOP
97-2, SOP 98-9 and SAB 104.





**36**
 Table of Contents





Customers
may obtain a license from our direct sales organization, or license products
through promotions or agreements with independent third party resellers and
strategic partners. Our products are not licensed through retail distribution
channels. Once properly licensed for an evaluation or permanent installation,
the customer has a choice to download our products from our secure website or to
have the media and documentation shipped directly to them. A customer may return
a product only under very limited circumstances during the first thirty days
from shipment for a replacement if the media is damaged or for a full refund if
the software does not perform in accordance with written specifications.
Accordingly, we record a provision for returns against license revenue in the
same period the revenue is recorded. The provision is subject to estimation by
management and has been based on historical product returns, the average invoice
size, revenue volume and other known data as well as market and economic
conditions. An allowance for returns, allowances and bad debts of $209,000 has
been estimated and recorded at December 31, 2004. The estimate of the allowance
for returns, allowances and bad debts may fluctuate from period to period due to
factors including but not limited to the value of actual returns, the average
dollar value of licenses granted during the period, the relative license revenue
volume for the period and changes in financial condition of individual
customers.





Current
reseller agreements generally do not provide for a contractual right of return,
future price concessions, or minimum purchase commitments. Payment is not
contingent upon the reseller's future licensing of products. Revenue generated
from products licensed through various marketing channels where the right of
return might expressly or implicitly exist is reduced by reserves for estimated
product returns. Such reserves are estimates developed by management based on
returns history and current economic and market trends. Management determined
that no reserve for returns from resellers was required at December 31, 2004.





As a
convenience to government customers, our products may be licensed through
government contractors, including system integrators. These government
contractors and systems integrators hold the preferred purchasing and
contracting vehicles for use by the various government agencies to purchase
information technology products and services including our products and
services. Our contracts with these government contractors do not contain an
express right of return, however, these government contractors may order
products in advance of receiving the order from the government agency. When
aware of these circumstances, we defer revenue recognition until the government
contractor has received the authorization to deliver the products to the end
user government agency and any contingencies have lapsed. In certain
circumstances where the federal agency ordering the product does not take
delivery of our product, we may agree to accept the return of the product from
the government systems integrator.





We also
offer our products to customers under subscription licenses with one year to
five year terms. The customer may renew the subscription at the end of the
subscription term or may convert the subscription into a perpetual use license
at any time for an additional fee. Under a subscription license the customer
receives the right to use the product, to post sale customer support and if the
product is Hercules, to the vulnerability remedy database for the term of the
subscription and for as long as the customer meets its payment obligation. The
subscription fee payment is generally due in equal payments at the beginning of
the subscription term and then on each anniversary date thereafter. Revenue from
subscriptions is recognized ratably over the term of the subscription. If a
customer fails to adhere to the payment terms of the subscription, the revenue
recognized is limited to the ratable recognition of the amount of payments
actually received.








**SOFTWARE
DEVELOPMENT COSTS**





We follow
the guidance provided in Statement of Financial Accounting Standards No. 86
“Accounting for the Costs of Computer Software to Be Sold, Leased, or Otherwise
Marketed” (“SFAS No. 86”) regarding the accounting for the costs of developing
our products. Purchased software (i.e., software acquired from a third party) is
recorded at the lower of acquisition cost or net realizable value. We develop
software for licensing to our customers and capitalize software development
costs when technological feasibility has been established. Technological
feasibility generally occurs at the time a detailed design and analysis plan is
completed and programming of the software code begins. Software development
costs that qualify for capitalization include the salaries and benefits of the
software engineers assigned to the projects, internal and external quality
assurance testing costs, overhead allocations primarily associated with
facilities costs and the costs of outsourced development activities and
independent product testing and certification labs. Software development costs
not qualifying for capitalization are expensed and classified as product
development expense in the statements of operations. Product development expense
and the capitalization rate will fluctuate from period to period depending upon
the number and status of software development projects that are in process and
the related number of people assigned to those projects.





**37**
 Table of Contents





Purchased
software and capitalized software development costs are amortized using the
greater of the revenue method or the straight-line method with useful lives
ranging from one to five years. Amortization expense is classified in costs of
revenue on the statements of operations. Our products operate on or with other
third party operating systems and software. When determining the useful life of
a product, we consider factors such as the current state of the technology,
operating systems on which our products run, competitive products and the
potential use of our products by the end user. Technological advances in
software operating systems and other software technologies on which our products
rely may shorten the expected life cycle of some versions of our products. We
make an assessment of the useful lives of our products at each balance sheet
date. If that assessment determines that a shortened product life has occurred,
we amortize the remaining unamortized balances over the new estimated useful
life of the product and provide disclosure regarding a change in estimate in the
notes to the financial statements pursuant to Accounting Principles Board
Opinion No. 20 “Accounting Changes.”





Our
product development strategy has been architected for the current and future
releases of Microsoft Windows, UNIX, Linux, Mac and other well established
operating systems. These operating systems are well established and we believe
that this cross platform strategy reduces the potential exposure to product
obsolescence due to rapid changes in customer preferences or technological
obsolescence due to the introduction of new operating systems or computing
products. However, it is possible that these factors may change in the future as
the Company's business model is adapted to changes in technology, changes in
customer buying patterns and changes in the software industry's revenue
licensing models.





We
evaluate the estimated net realizable value of each software product annually at
year end. Our estimate is based on historical and forecasted net revenue for
each product. Net revenue is the product revenue reduced by the estimated costs
of revenue and, if in development, the estimated cost to complete the
development of the product. When the net book value exceeds the estimate of net
realizable value, we record a write-down to net realizable value on each product
affected. Management’s ability to achieve its revenue forecast is subject to
judgment, competitive pressures, market and economic conditions and management’s
ability to successfully license its products to its customers. A change in one
or more of these factors may influence management’s estimates. Accordingly,
currently estimated net realizable values are subject to reductions resulting in
corresponding charges for impairment in the future.





**38**
 Table of Contents





**RESULTS
OF OPERATIONS FOR YEAR ENDED DECEMBER 31, 2004 AS COMPARED WITH THE YEAR ENDED
DECEMBER 31, 2003**





**OPERATIONAL
HIGHLIGHTS FOR 2004**





Key
operational highlights for the year ended December 31, 2004 include:





·
    We
      received a record $19.4 million in gross orders for products, maintenance
      and professional services during 2004. Of that amount, $3.4 million
      represented orders from commercial enterprises and $16.0 million
      represented orders from government organizations. The new orders booked
      translated into recognized revenue of $15.3 million for the year that was
      more than two and one-half times the 2003 full year
      revenue of $5.9 million.





·
    We
      completed a private placement of preferred stock in February 2004
      generating gross proceeds of $15 million. In addition, we entered into a
      bank line of credit of $3.5 million that partially funded capital
      expenditures in 2004. Cash at December 31, 2004 was $9.8 million. Working
      capital was $3.5 million and stockholders equity was $10.8 million at
      December 31, 2004.





·
    The
      momentum that began in the public sector in 2003 and continued into 2004
      was highlighted by the selection of Hercules as part of a $10.3 million
      task order award for automated vulnerability management covering the
      worldwide systems of the Department of Defense. In addition, 2004 saw
      repeat orders from the Department of Veteran Affairs for worldwide
      licensing of Hercules as well as software maintenance and training
      services.





·
    The
      largest commercial contract in our history to date was a $1.7 million
      enterprise-wide contract, which included professional services and the
      licensing of Hercules to MCI, Inc., a global communications and services
      provider.





·
    We
      opened an office in the Washington D.C. area to provide full-service
      sales, marketing, contract management and pre-sales engineering support to
      the federal government. In late 2004, we expanded the focus of this office
      to cover state and local governments in all 50 states. Our headquarters
      also moved to new high-tech facilities in Dallas to showcase our security
      solutions. Finally, field sales personnel were hired in strategic
      geographic territories throughout the United States to address the
      commercial market.





·
    Our
      common stock was approved for listing on the NASDAQ SmallCap Market and
      began trading in April 2004 under the company's ticker symbol
      "CDSS".





·
    During
      2004 our product development team completed and released three new
      versions and updates to Hercules including the new functionality of
      ConnectGuard and AssetGuard. Also during 2004, Hercules attained Common
      Criteria EAL 3 certification, Microsoft Windows Server 2003 certification,
      OVAL certification and full compatibility with CVE compliance. OVAL is an
      industry consortium developing a common language for security experts to
      discuss and agree upon technical details about how to check for the
      presence of vulnerabilities on computer systems, and CVE is an
      international, community-based effort among industry, government and
      academic participants to provide a common definitional framework for
      vulnerabilities.





**39**
 Table of Contents





**REVENUE**





The
components of revenue for the years ended December 31, 2004 and 2003 are as
follows.





Year
      Ended December 31,
    
    Increase
      (Decrease)2004
    
    2003
    
    Amount
    
    PercentRevenue
      from:-License
      feesHercules
    
    $
    9,491,667
    
    $
    4,686,801
    
    $
    4,804,866
    
    
    103
    %SecurePC
    
    
    432,208
    
    
    439,468
    
    
    (7,260
    )
    
    (2
    )%NetOFF
    
    
    2,506,264
    
    
    112,666
    
    
    2,393,598
    
    
    2125
    %Provision
      for returns and allowances
    
    
    (68,554
    )
    
    (40,925
    )
    
    (27,629
    )
    
    67
    %12,361,585
    
    
    5,198,010
    
    
    7,163,575
    
    
    138
    %-Customer
      support services
    
    
    2,786,916
    
    
    617,651
    
    
    2,169,265
    
    
    351
    %-Other
      services
    
    
    104,654
    
    
    40,635
    
    
    64,019
    
    
    158
    %Total
      revenue
    
    $
    15,253,155
    
    $
    5,856,296
    
    $
    9,396,859
    
    
    160
    %





During
the year ended December 31, 2004 we received gross orders for approximately
$19.4 million of product and services. After applying revenue recognition
criteria, total revenue, net of a provision for product returns, for the year
ended December 31, 2004 was $15,253,155 versus $5,856,296 for the year ended
December 31, 2003, an increase of $9,396,859 or 160%. The increase in revenue
was primarily the result of the increase in orders for Hercules and NetOFF.





The
increase in orders resulted in an increase in revenue from license fees, net of
a provision for returns and allowances, of $7,163,575 or 138%. Revenue from
Hercules license fees grew $4,804,866 or 103% to $9,491,667 for the year ended
December 31, 2004 versus $4,686,801 for the year ended December 31, 2003.
License fee revenue for NetOFF was up $2,393,598 primarily due to a $2.3 million
order from the Department of Veteran affairs. SecurePC license fee revenue was
flat in 2004 as compared to the year 2003.


Typically
we have little or no backlog of unfilled orders at the end of a reporting
period. However, at December 31, 2004 we had received an order for $2.2 million
dollars for renewal maintenance and professional services from one customer. The
renewal period for the maintenance began on January 1, 2005 and the services
were scheduled to be performed beginning in the first quarter of 2005. At
December 31, 2004 we had not been paid in advance for these services therefore,
no amounts were reflected in the financial statements for accounts receivable
and deferred revenue at December 31, 2004. We expect that the revenue from this
order for customer support will be recognized ratably and professional services
will be earned and recognized as performed during 2005.


License
fee revenue in the foreseeable future is expected to come primarily from our
automated vulnerability remediation product, Hercules, and its component
products, ConnectGuard and AssetGuard, licensed to Fortune 2000 companies and
large government agencies, with large and geographically diverse computer
networks. We expect to engage these customers in the sales process beginning at
the business unit or department level and ultimately leading to sales coverage
across the entire enterprise. However, due to the enterprise nature of the
Hercules product the sales cycle to these large enterprise customers is expected
to be longer for Hercules than for shrink wrap commodity software products. As a
result, quarterly revenue is anticipated to be less predictable due to the size
and timing of receipt of the orders from these large organizations. Compared to
other companies in our industry of larger size, the fluctuations in our revenue
and resulting net income or loss may be more volatile from quarter to quarter
than in more established companies.





**40**
 Table of Contents





We
require all customers to enter into a separate contract for customer support
services when licensing our products. In addition to support services, Hercules
customers receive access to the Hercules remedies available via the Hercules
update service known as V-Flash. Our Remediation Security Group researches new
vulnerabilities, writes the remedies for the new vulnerabilities and tests the
remedies to assure that the remedies function as expected. The remedies are then
made available to our customers via the V-Flash database. Customers are
encouraged to update their remediation database frequently by performing the
update actions within Hercules which accesses the V-Flash database via the
Internet. Accessing the database frequently is recommended if a customer wishes
to remain secure from newly identified vulnerabilities. Revenue recognized from
customer support services contracts recognized ratably over the term of the
contract, which is generally one year, amounted to $2,786,916 and $617,651 for
the years ended December 31, 2004 and 2003, respectively. The increase of
$2,169,265 or 351% is primarily due to the increase in the delivery of customer
support services related to Hercules.


During
2004 we began offering optional services to our customers including Hercules
training, implementation services and security system architecture expertise.
Other services revenue for the year ended December 31, 2004 included training
and implementation services revenue of $104,654 . Other services revenue for the
year ended December 31, 2003 includes training revenue of approximately $32,000
and approximately $8,000 of custom development services. As we formalize
services programs and service offerings around Hercules, we expect that
professional services revenue will increase in 2005 over the services revenue
recognized in 2004 however there can be no assurances that this growth will
occur. In addition, professional services revenue is expected to have lower
gross margins than the gross margins generated from licensing of our software
products plus revenue from customer support agreements. Therefore a change in
the revenue mix to a larger proportion of professional services revenue than
revenue from software licenses and customer support contracts could lower total
gross margins. We do not anticipate that custom development services will become
a primary offering or if offered, a material portion of services revenue in the
foreseeable future.




The
provision for product returns and allowances for the years ended December 31,
2004 was $68,554 versus $40,925 for the year ended December 31, 2003. The
provision for returns and allowances is an estimate based upon historical trends
and the increase in the average invoice size in 2004. We do not expect product
returns, if any, related to 2004 revenue to exceed the estimated allowance of
$209,000 at December 31, 2004 due to the nature of our licensing terms and
product quality however, there can be no assurance that returns will not exceed
the allowance.





During
2004 we continued to focus our licensing efforts on market segments including
government, healthcare, financial institutions and corporations in all other
market segments. This is due in part to the mandates of the Health Insurance
Portability and Accountability Act (“HIPAA”) for healthcare, Gramm-Leach-Bliley
Act for financial services (“GLB”), Federal Information Security Management Act
(“FISMA”), the Sarbanes Oxley Act of 2002 ("SOX") for publicly traded companies,
and Presidential Decision Directive 63 (“PDD-63”) for government, each of which
require certain industries to meet minimum security requirements for the
protection of personal, financial and government data. The revenue distribution
by industry segments for the years ended December 31, 2004 and 2003 was as
follows:





**Years
      Ended December 31,**Industry
      Segment
    
    **2004**
    
    **2003**Corporate
    
    
    12
    %
    
    3
    %Education
    
    
    1
    %
    
    2
    %Financial
      institutions
    
    
    4
    %
    
    8
    %Government
    
    
    82
    %
    
    80
    %All
      other, primarily health
    
    
    1
    %
    
    7
    %





Revenue
from customers representing 10% or more of total revenue during the years ended
December 31, 2004 and 2003, respectively, was as follows:





**Years
      Ended December 31,**End
      User Customer
    
    **2004**
    
    **2003**Department
      of Veteran Affairs
    
    
    41
    %
    
    67
    %Defense
      Information Systems Agency (“DISA”)
    
    
    39
    %
    
    0
    %




**41**
 Table of Contents





Although
the existing customers listed above represent 80% of the 2004 revenue we do not
expect to rely on any one existing customer, group of existing customers or
industry segment for a significant source of recurring revenue. However, revenue
from government agencies is anticipated to continue to be the larger portion of
the future revenue composition by industry segment. As mentioned above, we
expect that future revenue from the licensing of Hercules will be derived
primarily from large enterprises consisting of Fortune 2000 companies and large
government agencies. Therefore any one customer or groups of customers in the
same industry segment could become a material component of revenue in any future
quarter or year. However, there is no assurance that the distribution of revenue
by industry segment or customer is representative of future revenue projections
and we expect that our revenue by industry segment and customer will vary
markedly from period to period.


**COSTS
OF REVENUE**





The
components of costs of revenue for the years ended December 31, 2004 and 2003
are as follows:


Year
      Ended December 31,
    
    Increase
      (Decrease)2004
    
    2003
    
    Amount
    
    PercentCosts
      of revenueSoftware
      amortization
    
    $
    1,287,927
    
    $
    473,881
    
    $
    814,046
    
    
    172
    %Customer
      support and services costs
    
    
    1,507,661
    
    
    288,323
    
    
    1,219,338
    
    
    423
    %Shipping
      and other costs
    
    
    36,496
    
    
    56,544
    
    
    (20,048
    )
    
    (35
    )%Total
      costs of revenue
    
    $
    2,832,084
    
    $
    818,748
    
    $
    2,013,336
    
    
    246
    %





*Software
Amortization*





Software
amortization begins at the time a new product or new version of a product is
released from development and is made generally available to potential customers
for licensing. Software amortization expense increased $814,046, or 172%, in the
year ended December 31, 2004 versus the year ended December 31, 2003 due to
higher average balances of amortizable capitalized software development costs
related to new releases of Hercules versions in 2004 versus 2003. We expect that
software amortization will increase in the quarters of 2005 due to the
amortization of the capitalized software development costs associated with
planned new releases of Hercules and other new product releases. In addition,
quarterly software amortization is expected to vary in amount (from
approximately $500,000 per quarter to $575,000 per quarter) from quarter to
quarter due to the release of Hercules 3.5.1 during the first quarter of 2005
and Hercules 4.0 version expected to be available in late second quarter of
2005.





The
comparison of unamortized capitalized software development costs to the net
realizable value of the capitalized software at December 31, 2004 of $4,048,452
and December 31, 2003 of $2,075,169 indicated that the unamortized capitalized
software balances at December 31, 2004 and December 31, 2003 did not exceed net
realizable value. Accordingly, no write-down was required during the year ended
December 31, 2004 or the year ended December 31, 2003. The net realizable value
analysis involves assumptions as to future product revenue and as a result,
there can be no assurance that we will successfully achieve those future revenue
forecasts or that an unexpected technological change in operating systems or
other technologies will not impair the recorded values or require us to change
our estimated useful lives in the future.





*Customer
Support And Services Costs*





Under our
post sale customer support services agreements, a customer receives the right to
telephone support and the right to receive software point releases and software
updates on a when and if available basis. In addition to these services,
Hercules customers receive updates to the vulnerability remedies via Internet
access to our V-Flash remediation content database.





The
customer support and other services costs for the years ended December 31, 2004
and 2003 of $1,507,661 and $288,323, respectively, include the salaries,
benefits and other direct expenses of the personnel assigned to the post sale
customer support function plus similar expenses associated with the remediation
security engineers that write the vulnerability remedies and manage the V-Flash
remedy database. Other services costs include the direct costs of the personnel
assigned to training and implementation services. The increase in the customer
support and other services costs of $1,219,338 or 423% over the year ended
December 31, 2003 is directly attributable to the increase in personnel
performing these functions and an increase in the volume services engagements in
2004 over 2003.





**42**
 Table of Contents





At
December 31, 2004, we had 7 full time personnel assigned to the support
organization versus 3 full time employees assigned to customer support at
December 31, 2003. Included in customer support and other services costs are the
costs and expenses associated with our V-Flash remediation security engineering.
At December 31, 2004, we employed 16 security engineers versus 11 security
engineers at December 31, 2003. The security engineers monitor various security
intelligence sites, IRC channels and our associated scanning partners for new
vulnerabilities and exploits. As vulnerabilities and their exploits are
discovered, the remediation security engineers quickly respond by writing a
remedy to counteract the discovered vulnerability and prevent its exploit. The
remedy is tested against the known affected platforms and delivered to the
customer site electronically through the V-Flash mechanism. In addition to
delivering new remedies, the security engineers continually monitor and update
research information and URL links for vulnerabilities and related content to
ensure that all links and research material are timely and relevant. The costs
associated with the customer support and security remediation group are largely
dependent upon the number of people assigned to these functions. We believe that
these functions are adequately staffed and therefore we do not expect to incur
significant increases in the quarter-to-quarter costs for these functions during
2005, however there can be no assurance that costs will remain constant at these
expected staffing levels.





Included
in the customer support and other services costs is approximately $29,000 for
the costs associated with the delivery of services, including training and
implementation activities. The costs of services are expected to increase in the
foreseeable future as we formalize programs and service offerings around
Hercules and the best security practices for full life cycle vulnerability
management. At December 31, 2004 there was approximately $899,000 of services
revenue in deferred revenue and unfilled order backlog. These services are
expected to be delivered in 2005 and accordingly, the costs of the personnel and
other direct costs related to the delivery of these services are expected to be
reported as services costs, a component of costs of revenue.





*Shipping
And Other Costs*





Shipping
and other costs include freight costs, preparation of media and documentation,
costs of third party products shipped with Hercules and third party royalties
for technology embedded in Hercules. Shipping and other costs for the years
ended December 31, 2004 and 2003 were $36,496 and $56,544, respectively. Of
these costs, third party royalties were approximately $14,000 for the year ended
December 31, 2004, compared to approximately $13,000 of third party royalties
for the year ended December 31, 2003. The costs of shipping and media
preparation were immaterial in the years ended December 31, 2004 and 2003. We
expect that shipping and other costs will vary with revenue levels but will not
become a significant component of costs of revenue.





**SELLING,
GENERAL AND ADMINISTRATIVE EXPENSES**





We
incurred selling, general and administrative expenses ("SG&A") of
$17,550,485 and $6,388,396 for the years ended December 31, 2004 and 2003,
respectively, representing an increase of $11,162,089, or 175%. The increase in
SG&A as more fully described below, is primarily due to the increase in the
number of employees performing SG&A functions resulting in higher
compensation expense, increased infrastructure support costs and increased
professional fees incurred for the execution of the marketing and public
relations efforts surrounding the marketing and licensing of our vulnerability
management product, Hercules.





At
December 31, 2004, we employed 61 sales and marketing professionals, including
pre-sales security engineers and professional services consultants, and we
employed 14 people in finance, internal information technology, administration
and general management including our CEO and CFO. At December 31, 2003, we
employed 24 people as sales and marketing professionals, including pre-sales
security engineers, and 9 people in finance, administration and general
management including our CEO and CFO. This is an increase of 42 personnel in
SG&A functions since December 31, 2003 creating corresponding increases in
the expense categories described further in the table below.





**43**
 Table of Contents





As noted
above the increases in SG&A expense during the year ended December 31, 2004
over the year ended December 31, 2003 were approximately $11,162,000. The
significant categories of expense increases are shown in the following
table.





**Categories
      of selling, general and administrative expense
      increases**
    
    **Increase**
      **Year
      Ended December 31,**
      **2004
      Over****2003**Salaries
      and benefits associated with the increase in employees
    
    $
    4,530,000Incentive
      compensation associated with higher revenue
    
    
    3,140,000Travel
      and entertainment associated with increases in employees and customer
      sales activities
    
    
    724,000Direct
      marketing expense associated with trade shows, advertising and other
      marketing expenses
    
    
    913,000Professional
      fees including accounting, legal, investor relations, public relations and
      recruiting fees
    
    
    928,000Rents
      and telecommunications expenses
    
    
    423,000Expenses
      related to insurance, maintenance fees, supplies, business taxes and other
      office support expenses
    
    
    504,000Total
      increase in SG&A
    
    $
    11,162,000





Compensation
expense included in SG&A for 2004 included non-cash stock compensation
expense for estimated fair value of approximately $130,000 related to the
extension of the time to exercise a stock option grant by a former employee.
This is considered a modification of the terms of the option agreement and
accordingly the fair value of the option was estimated and expensed. In 2003,
compensation expense included in SG&A for 2003 included non-cash stock
compensation expense for the estimated fair value of $82,500 for shares of
common stock issued to an officer upon his employment with the Company.





**PRODUCT
DEVELOPMENT EXPENSE**





We
capitalize software development costs at the time technological feasibility is
established, which generally occurs at the time the design and analysis plan is
completed and software code programming begins. The costs and expenses that
qualify for capitalization primarily consist of salaries, benefits and the
direct and indirect costs associated with the development staff or with the
specific development projects. Costs and expenses that do not qualify for
capitalization and all costs and expenses incurred prior to technological
feasibility are expensed and classified as product development expense in the
statement of operations. A summary of gross product development expense, product
development expense net of capitalized development costs and the capitalization
rate for the years ended December 31, 2004 and 2003 are presented in the table
below.





**2004**
    
    **2003**Product
      development expense, net of capitalized software development
      costs
    
    $
    1,995,612
    
    $
    392,967Software
      development costs capitalized
    
    
    3,261,210
    
    
    1,897,497Gross
      product development expense
    
    
    5,256,822
    
    
    2,290,464Capitalized
      costs as a percentage of gross product development expense
    
    
    62
    %
    
    83
    %








**44**
 Table of Contents





The
increase in development expense is primarily due to the increase in pay and
benefits expenses associated with the increase in the number software
development engineers and quality assurance engineers employed during the
respective periods presented as well as the costs of third party development
projects and the Common Criteria certification testing. At December 31, 2004, we
employed 40 software development and quality assurance engineers versus 27
software development and quality assurance engineers at December 31, 2003.





The
capitalization rate is the percentage of capitalized costs to total gross
product development costs for the period. The capitalization rate was 62% for
the year 2004 versus 83% for the year 2003. The decrease in the capitalization
rate is primarily due to the expensing of higher levels of non-capitalizable
costs and expenses including development projects that had not reached
technological feasibility, software hotfixes and product maintenance releases
during the years presented.





Factors
that affect the amount of software development costs capitalized or expensed
include the stage of development of the project, the number of employees
assigned to capitalizable projects, and the existence of significant third party
costs, such as common criteria or other certification costs. Following a product
release there is a period of time when maintenance work is performed and new
product planning and analysis is done. Neither of the activities are allowed
costs for capitalization and as a result, the capitalization rate is expected to
decline following a product release. The capitalization rate may increase once
the new product planning and analysis phases are completed and the product has
been determined to have reached technological feasibility. Therefore, product
development expense and the capitalization rate historically have fluctuated
from period to period, and may continue to fluctuate from period to period in
the future. The capitalization rate is highly dependent upon the number and
stage of software development projects that are in process and the related
number of employees assigned to those projects. In addition, third party testing
and certification costs may be significant from time-to-time and are dependent
upon the cost requirements of the testing or certification laboratory. We expect
that the capitalization rate will range between 60% and 70% of gross product
development expense in any quarter of the year 2005 but due to the factors
discussed above, there can be no assurance that the capitalization rate will
remain within this range. Gross product development expense is expected to
remain constant at the current staffing and spending levels from quarter to
quarter during 2005. In the first quarter of 2005 we released Hercules 3.5.1. We
plan to release new products and new versions of our products during 2005
including the Hercules Security-On-Demand appliance and Hercules 4.0, both
scheduled for release in late second quarter 2005.





**DEPRECIATION
EXPENSE**





Depreciation
expense for the year ended December 31, 2004 was $670,782, compared to $207,924
for the year ended December 31, 2003, representing an increase of $462,858 or
223%. We attribute this increase to higher average depreciable balances of
property, equipment and leasehold improvements. During the year ended December
31, 2004, we purchased $5,038,193 of capital expenditures for the expansion of
office facilities and the build out of our technology infrastructure supporting
the growth in employees, new products, quality assurance test labs and our
remediation signature and software development initiatives.





**Year
      Ended**
      **December
      31,****2004**
    
    **2003**Capital
      expenditures for depreciable property and equipment
    
    $
    5,038,193
    
    $
    411,211Net
      property and equipment balances
    
    
    6,356,362
    
    
    635,748





Capital
expenditures in 2005 are expected to approximate $1.5 million to replace or
refresh older technology assets and to support the equipment requirements for
new product development. The estimated useful lives of the property and
equipment range from 1 to 8 years. Quarterly depreciation expense is expected to
range between $300,000 and $400,000 per quarter as the completed technology
infrastructure assets that come on line begin to depreciate.





**INTEREST
EXPENSE**





Interest
expense for the years ended December 31, 2004 and 2003 was $82,612 and
$3,036,342, respectively, reflecting a decrease in interest expense of
$2,953,730. During 2003 we completed a number of equity and debt financings that
due to the type and estimated fair value of the securities and debt instruments
issued, approximately $2.8 million of non-recurring, non-cash charges were
recorded as interest expense. The non-cash interest charges are listed in the
table below. During 2004 interest expense primarily related to the interest on
the bank debt and the amortization of the deferred debt issuance costs related
to the estimated fair value of warrants issued to the bank in conjunction with
obtaining the lines of credit. Interest expense paid during 2004 was
approximately $55,000 versus approximately $38,000 paid during 2003. The
components of interest expense for the years ended December 31, 2004 and 2003
are summarized as follows:





**45**
 Table of Contents




**Years
      Ended****December
      31,****2004**
    
    **2003**Non-cash
      interest charges:Fair
      value of common stock issued in conjunction with convertible
      debt
    
    $
    ---
    
    $
    1,067,928Fair
      value of beneficial conversion feature of convertible debt
    
    
    ---
    
    
    1,543,310Fair
      value of warrants issued to placement agent
    
    
    ---
    
    
    121,725Interest
      payable converted to common stock
    
    
    ---
    
    
    68,131Amortization
      of fair value of warrants as debt issuance costs
    
    
    16,052
    
    
    ---Total
      non-cash interest expense
    
    
    16,052
    
    
    2,801,094Cash
      interest charges:Amortization
      of debt issue costs
    
    
    ---
    
    
    212,000Interest
      on notes payable
    
    
    ---
    
    
    23,248Interest
      on bank lines of credit
    
    
    60,908
    
    
    ---Other
      interest bearing obligations
    
    
    5,652
    
    
    ---Total
      interest expense
    
    $
    82,612
    
    $
    3,036,342





**WRITE-OFF
OF PROPERTY AND EQUIPMENT**





In May
2004, we signed an 8 year lease for approximately 33,500 square feet of office
space in Dallas, Texas. We moved into the new office space on November 18, 2004
and at that time wrote off the remaining net book value of $77,786 of leasehold
improvements and equipment that we would no longer use in our operations.





**WRITE-OFF
OF NOTE RECEIVABLE FROM RELATED PARTY**





In April
2003, a CT Holdings legal claim associated with a lawsuit was settled for
$225,000 in cash. Citadel advanced $225,000 to CT Holdings in return for a
demand note payable bearing interest at 12% per year and a release for any
potential claims pertaining to the CT Holdings litigation. Because CT Holdings
has a significant cash deficiency and stockholder's deficit this demand note
receivable was fully reserved in the second quarter of 2003 as there can be no
assurance that this note will be collected.





**PREFERRED
DIVIDENDS AND ACCRETION OF BENEFICIAL CONVERSION FEATURE OF PREFERRED
STOCK**





The
statement of operations presents preferred dividends and the accretion of the
beneficial conversion feature of the Series A Convertible Preferred Stock (the
"Preferred Stock") as an increase to the net loss so as to arrive at net loss to
common shareholders. The Preferred Stock accrues dividends at a rate of 5% if
paid in cash, or 6% if paid in shares of our common stock. The dividends are
payable on April 1, July 1, October 1 and January 1 of each year. During the
year ended December 31, 2004 we had accrued $187,500 and paid $477,439 of
preferred stock dividends in cash.





The
Preferred Stock was issued along with warrants for 1.2 million shares of common
stock. The relative fair values of the Preferred Stock and the warrants were
estimated and as a result, it was determined that the non-cash relative fair
value of the beneficial conversion feature of the Preferred Stock was
approximately $985,000 which is being accreted to additional paid in capital
over the four year term of the preferred stock. Of this amount, $215,397 was
accreted in the year ended December 31, 2004.





**NET
LOSS AND INCOME TAX VALUATION ALLOWANCE**




For
the year ended December 31, 2004 we reported a net loss to common shareholders
of $8,719,362 versus a net loss to common shareholders of $5,248,581 for the
year ended December 31, 2003. Due to the uncertainty of realization, we recorded
a valuation allowance equal to the net deferred tax asset associated with income
tax benefit ascribed to the loss before income taxes for the years ended
December 31, 2004 and 2003. At December 31, 2004 we have a net operating loss
carryforward of approximately $13,500,000 which due to the uncertainty of
realization has been fully reserved. The net operating loss carryforward is
subject to annual limitations as prescribed in the Internal Revenue Code and is
available to offset future taxable income and begins to expire in 2023.


**46**
 Table of Contents


****


**LIQUIDITY
AND CAPITAL RESOURCES**


At
December 31, 2004 we had cash and cash equivalents of approximately $9.8
million, a net working capital position of approximately $3.5 million and
stockholders’ equity of approximately $10.8 million. On February 10, 2004, in
return for gross proceeds of $15,000,000, we issued 15,000 shares of the
Preferred Stock (convertible into 3,000,000 shares of common stock at the
initial conversion price of $5.00 per share) and warrants to purchase 1,200,000
shares of common stock. The net proceeds from the preferred stock financing,
were approximately $13,800,000, after placement agent fees, as well as
accounting and legal fees and were used to fund the expansion of our sales and
marketing team to support the Company's business plan, and to increase our
engineering team to implement our product development initiatives, grow market
share through product innovation and establish Citadel as a provider of quality
products in the life cycle vulnerability management market. In April 2004, we
secured a revolving credit line from a bank of $750,000 for operations and term
loan credit facilities totaling $2,750,000 for use to acquire the capital
equipment necessary to support our business plan. The $750,000 revolving line of
credit was later converted by the bank as a term loan line of credit for the
acquisition of equipment. The total $3,500,000 in proceeds from the credit
facilities has been used to partially fund approximately $5,000,000 of capital
expenditures during 2004. In March 2005, we entered into an amendment to these
credit facilities to revise the financial covenants to bring them more in line
with our operations, including the liquidity ratio test, EBITDA requirement and
minimum cash balance. The other material terms of the credit facilities,
including interest rate, security, and final maturity, remain the
same.


We
believe that cash generated from the preferred stock financing, the credit
facilities provided by the bank, our existing cash balances and cash equivalents
along with the cash balances expected to be generated from the execution of our
2005 operating plans will be sufficient to meet our cash requirements for the
next twelve months. However we may be required, or could elect, to seek
additional funding prior to that time. Our future capital requirements will
depend on many factors, including our receipt of cash from licenses of our
products, our rate of revenue growth, the timing and extent of spending to
support product development initiatives and expansion of sales and marketing,
the timing of introductions of new products, enhancements to existing products,
and the general market acceptance of our products. We cannot assure you that we
will achieve our operating plans, or that additional equity or debt financing
will be available on acceptable terms or at all. Our sources of liquidity beyond
twelve months, in our opinion, will be our then current cash balances, funds
from operations and whatever credit facilities or debt or equity financings we
may arrange.





***Cash
Used in Operating Activities***





The net
cash used in operating activities was $4,100,422 during the year ended December
31, 2004. Our net loss of $7,839,025 was adjusted for non-cash charges of
$2,313,042 and a net increase in cash from changes in operating assets and
liabilities of $1,425,561. Non-cash charges include depreciation and
amortization of $1,958,709, provision for returns, allowances and bad debts of
$130,500, stock compensation expense of $129,995, a $77,786 write-off of fixed
assets and the amortization of debt issuance costs of $16,052. Cash decreased
due to a change in operating assets of $256,103 during the year ended December
31, 2004 primarily due to the increase in prepaid commissions on higher levels
of deferred revenue offset by the collection of accounts receivable during the
year ended December 31, 2004. Operating liabilities except for deferred revenue,
increased $1,543,836 primarily due to higher activity levels from a higher
number of employees during 2004 than in 2003. Deferred revenue increased
$137,828 resulting from a net increase in deferred maintenance and services
revenue of $1,847,828 related to a higher level of post sale customer support
and services contracts in force at December 31, 2004 than at December 31, 2003
and offset by the reversal of $1,710,000 million related to the deferred revenue
associated with a December 2003 product shipment to a systems integrator.





Total
deferred revenue at December 31, 2004 and 2003 was $2,943,023 and $2,805,195,
respectively, and represents revenue to be earned from customer support
contracts in force at December 31, 2004 and professional services contracts for
which the services had not been performed at December 31, 2004. Of the total
deferred revenue, $480,172 is for prepaid services expected to be performed more
than twelve months from the balance sheet date and accordingly has been
classified as long-term deferred revenue. The increase in deferred revenue of
$137,828 is the result of higher levels of orders during 2004 than in 2003 for
customer support services and professional services net of a $1.7 million
cancellation of an order from a government systems integrator discussed
below.




**47**
 Table of Contents





Deferred
revenue at December 31, 2003 was $2,805,195, of which approximately $1,400,000
relates to deferred license fees and approximately $1,400,000 relates to
customer support services deferred revenue. At December 31, 2003 deferred
revenue included the invoiced value of a December 2003 product shipment for an
order received from a government systems integrator of approximately $1.7
million and consisting of approximately $1.4 million in license fees and $0.3
million for post sale customer support services. Although the order was
fixed-fee order and shipment had occurred in December 2003 and the Company
determined that the collection of the revenue was probable, the Company deferred
revenue recognition because the government systems integrator had not concluded
negotiations with the end user government agency and had not delivered the
software licenses to the government agency. During the quarter ended June 30,
2004, the systems integrator cancelled the order to the Company because,
according to the cancellation notice, the systems integrator and the government
agency had not concluded contract negotiations and the eventual terms of the
systems integrator’s order from the government agency would most likely be
different than the terms originally proposed in December 2003. Accordingly, the
Company reduced deferred revenue and accounts receivable by approximately $1.7
million in June 2004.





The net
cash used in operating activities was $272,093 for the year ended December 31,
2003. The net loss of $5,248,581 was adjusted for non-cash charges of $4,257,979
and changes in operating assets and liabilities of $718,509. Non-cash charges
include depreciation and amortization of $681,806, provision for returns,
allowances and bad debts of $58,500, non-cash interest charges of $2,944,963
related to the convertible notes issued during the year, stock compensation
expense of $82,500, the estimated fair value of $265,210 for common stock, stock
options and warrants issued to consultants in lieu of cash payments for
services, and the $225,000 write-off of the note receivable from CT Holdings.
Operating assets increased $1,749,447 during the year ended December 31, 2003
primarily due to the increase in licensing fees and support services related to
the increased orders for Hercules. Operating liabilities except for deferred
revenue decreased $187,046 due to the payment of the payroll tax liability,
which is no longer in arrears and the payment of accounts payable due to the
availability of cash to meet our current obligations.





***Cash
Used in Investing Activities***





Cash
flows used in investing activities during the year ended December 31, 2004 were
$8,299,403. Of that amount $5,038,193 was expended for purchases of computer
equipment for newly hired employees, improvements to our information technology
infrastructure and the leasehold improvements to new office space. Similar
expenditures during the year 2003 were $411,211. Expenditures for computer
equipment and our information technology infrastructure in 2005 are expected to
be approximately $1.5 million representing the expenditures for the completion
of our technology infrastructure project begun in 2004, expenditures for the
refresh and replacement of older equipment technologies and expenditures for new
equipment technologies to support our planned development projects.





We also
had expenditures during 2004 of $3,261,210 for additions to capitalized software
development costs related to the Hercules product development costs. This
compares to $1,897,497 for similar expenditures during 2003. Our development
plans include new product releases, new features and functionality additions to
existing products. Gross expenditures for product development are largely
dependent upon the number of software engineers employed and assigned to the
software development projects. We believe that at December 31, 2004 we were
fully staffed in product development therefore, gross expenditures are expected
to remain stable from quarter to quarter during 2005. However, the
capitalization rate may fluctuate from quarter to quarter in the future,
depending upon the number and stage of software development projects that are in
process and the related number of employees assigned to those projects.





Cash
flows from investing activities during the year ended December 31, 2003 in
addition to capital expenditures and capitalized software development costs,
included the issuance of a $225,000 note receivable to CT Holdings.





***Cash
Provided by Financing Activities***





Cash
flows provided by financing activities for the year ended December 31, 2004 were
$17,145,818 and were primarily due to the proceeds received from a preferred
stock transaction in February 2004 and borrowings of $3,500,000 on our bank
lines of credit to partially fund approximately $5,000,000 of capital
expenditures during 2004. On February 10, 2004, in return for net proceeds of
$13,797,283 (net of placement fees of $1,125,000 plus legal, accounting and
registration fees of $77,717), we completed the issuance of 15,000 shares of
Series A Convertible Preferred Stock (convertible into 3,000,000 shares of
common stock at the initial conversion price of $5.00 per share) with warrants
to purchase 1,200,000 shares of common stock. Preferred dividends of $477,439
were paid during the year ended December 31, 2004. At December 31, 2004, we had
accrued preferred dividends of $187,500 which were subsequently paid in January
2005. During 2004 we borrowed $3,500,000 against our bank lines of credit to
partially fund capital expenditures related to the technology infrastructure
project and the build out of new office space. Payments against the borrowings
began in November 2004 and through December 31, 2004 we had made payments of
$183,334 against the borrowings. We also received proceeds of $336,057 from the
exercise of employee stock options, $216,550 from the exercise of warrants and
we repaid $16,903 of advances made to us by our CEO.





**48**
 Table of Contents





Cash
flows provided by financing activities for the year ended December 31, 2003 were
$7,885,133. During January 2003, we received net proceeds of approximately
$2,397,467 from the issuance of 3,275,000 shares of common stock plus warrants
to purchase 1,637,500 shares of common stock. In May 2003 we received net
proceeds of $1,122,814 from the exercise of warrants for 1,560,559 shares of
common stock. During the fourth quarter of 2003 warrants for 1,974,336 shares of
common stock were exercised providing net proceeds of $2,506,430. Proceeds of
$199,060 were received during 2003 from the exercise of stock options for
393,660 shares of common stock. In September 2003, we closed a bridge loan
financing transaction, receiving gross proceeds of approximately $2,570,000 and
issued convertible notes payable to a limited number of accredited investors.
The principal amount of the bridge loans plus accrued interest together
aggregating $2,810,881 were converted into 2,348,079 shares of common stock
during the fourth quarter of 2003. The placement agent for this transaction
converted their fee of $212,000 and $50,000 of our payables to them into a note
payable with the same terms and conversion features as the Notes. This note was
repaid in cash in December 2003.





In
addition, we received advances and proceeds from notes payable from related
parties of $888,522 and made payments to related parties of $1,463,160 to pay
down the advances and notes payable from related parties. During the year ended
December 31, 2003, a former director exercised stock options for 862,500 shares
of the Company’s common stock using a $250,000 note payable to the former
director plus accrued interest of $26,000 through the date of exercise as
payment of the aggregate exercise price of $276,000. Notes payable to
stockholders at December 31, 2002 plus new notes issued to stock holders during
the year 2003, aggregating $537,000, were repaid during the year ended December
31, 2003. At December 31, 2003, as a result of the culmination of all the
financing activities, we had no amounts owed under notes payable.








**CONTRACTUAL
OBLIGATIONS**





At
December 31, 2004 the contractual obligations are as follows:





Less
      than
    
    1 -
      3
    
    3 -
      5
    
    More
      thanContractual
      obligations
    
    Total
    
    1
      year
    
    years
    
    years
    
    5
      yearsLong-Term
      Debt Obligations
    
    $
    3,316,666
    
    $
    1,327,273
    
    $
    1,989,393
    
    $
    -
    
    $
    -Capital
      Lease Obligation
    
    
    -
    
    
    -
    
    
    -
    
    
    -
    
    
    -Operating
      Lease Obligations
    
    
    5,111,002
    
    
    751,620
    
    
    1,409,096
    
    
    1,220,808
    
    
    1,729,478Purchase
      Obligations
    
    
    600,619
    
    
    600,619
    
    
    -
    
    
    -
    
    
    -Preferred
      Stock Dividends
    
    
    2,335,061
    
    
    750,000
    
    
    1,585,061
    
    
    -
    
    
    -Other
      Contractual ObligationsReflected
      on the Registrant’sBalance
      Sheet under GAAP
    
    
    -
    
    
    -
    
    
    -
    
    
    -
    
    
    -Total
    
    $
    11,363,348
    
    $
    3,429,512
    
    $
    4,983,550
    
    $
    1,220,808
    
    $
    1,729,478








**OFF-BALANCE
SHEET ARRANGEMENTS**





The
Company has no off-balance sheet arrangements that have had, or are reasonably
likely to have, a current or future effect on the Company’s financial condition,
changes in financial condition, revenues or expenses, results of operations,
liquidity, capital expenditures or capital resources that are material to
investors.





**49**
 Table of Contents





**ITEM 7.     FINANCIAL
STATEMENTS**





The
Financial Statements for the years ended December 31, 2004 and 2003 are found
following the signature page of this report.





**ITEM 8.     CHANGES IN AND DISAGREEMENTS
WITH ACCOUNTANTS ON ACCOUNTING AND FINANCIAL DISCLOSURE**





None.





**ITEM 8A.  CONTROL AND PROCEDURES**





The
Company’s management, including the Company’s principal executive officer and
principal financial officer, has evaluated the effectiveness of the Company’s
disclosure controls and procedures (as defined in Rules 13a-15(e) and 15d-15(e)
under the Securities Exchange Act of 1934) as of the year ended December 31,
2004, the period covered by the Annual Report on Form 10-KSB. Based upon that
evaluation, the Company’s principal executive officer and principal financial
officer have concluded that the disclosure controls and procedures were
effective as of December 31, 2004 to provide reasonable assurance that material
information relating to the Company is made known to management including the
CEO and CFO.





There
were no changes in the Company’s internal control over financial reporting that
occurred during the Company’s last fiscal quarter that have materially affected,
or are reasonably likely to materially affect, the Company’s internal control
over financial reporting. ****








**ITEM 8B.  OTHER INFORMATION**





None





**50**
 Table of Contents





**PART
III**





**ITEM 9.   DIRECTORS AND EXECUTIVE OFFICERS OF THE
REGISTRANT**


Information
with respect to this Item may be found in the section captioned “Directors and
Executive Officers,” and “Section 16(a) Beneficial Ownership Reporting
Compliance” appearing in the definitive Proxy Statement that we will deliver to
stockholders in connection with our Annual Meeting of Stockholders for 2005.
Such information is incorporated herein by reference.
 
 Our Board
of Directors adopted a Code of Business Conduct for all of our directors,
officers and employees and a Code of Ethics for our CEO and Senior Financial
Executives in March 2004. Stockholders may view our Code of Business Conduct and
Code of Ethics on our website at www.citadel.com or request a free copy:
 
 Citadel
Security Software Inc.
 Attention:
Investor Relations
 Two
Lincoln Centre, Suite 1600
 5420 LBJ
Freeway
 Dallas,
Texas 75240
 (214)520-9292
 
 To date,
there have been no waivers under our Code of Business Conduct and Ethics. We
will post any waivers, if and when granted, of our Code of Business Conduct and
Ethics on our website at www.citadel.com.
 
 **ITEM
10. EXECUTIVE COMPENSATION**
 
 Information
with respect to this Item may be found in the section captioned “Executive
Compensation” appearing in the definitive Proxy Statement that we will deliver
to stockholders in connection with our Annual Meeting of Stockholders for 2005.
Such information is incorporated herein by reference.
 
 **ITEM
11. SECURITY OWNERSHIP OF CERTAIN BENEFICIAL OWNERS AND
MANAGEMENT**  **AND
RELATED STOCKHOLDER MATTERS**
 
 Information
with respect to this Item may be found in the section captioned “Directors and
Management - Security Ownership of Certain Beneficial Owners and Management” and
“Equity Compensation Plan Information” appearing in the definitive Proxy
Statement that we will deliver to stockholders in connection with our Annual
Meeting of Stockholders for 2005. Such information is incorporated herein by
reference.
 
 **ITEM
12. CERTAIN RELATIONSHIPS AND RELATED TRANSACTIONS**
 
 Information
with respect to this Item may be found in the section captioned “Related Party
Transactions” appearing in the definitive Proxy Statement that we will deliver
to stockholders in connection with our Annual Meeting of Stockholders for 2005.
Such information is incorporated herein by reference.
  **ITEM
13. EXHIBITS**
  The
exhibits listed in the accompanying index to exhibits are filed or incorporated
by reference as part of this Annual Report.
 
 **ITEM
14. PRINCIPAL ACCOUNTANT FEES AND SERVICES**
 
 Information
with respect to this Item may be found in the section captioned “Principal
Accountant Fees and Services” appearing in the definitive Proxy Statement that
we will deliver to stockholders in connection with our Annual Meeting of
Stockholders for 2005. Such information is incorporated herein by
reference.


**51**
 Table of Contents





**SIGNATURES**





Pursuant
to the requirements of Section 13 or 15(d) of the Securities Exchange Act of
1934, as amended, the Registrant has duly caused this Annual Report on Form
10-KSB to be signed on its behalf by the undersigned, thereunto duly authorized.





Date:
      March 31, 2005
    CITADEL SECURITY
      SOFTWARE INC.By:
    /s/  STEVEN B. SOLOMONSteven B. Solomon, President
      And  Chief
      Executive Officer





POWER OF
ATTORNEY





KNOW ALL
PERSONS BY THESE PRESENTS, that each person whose signature appears below
constitutes and appoints Steven B. Solomon his true and lawful attorney-in-fact
and agent, with full power of substitution and resubstitution, to sign any and
all amendments to this Annual Report on Form 10-KSB and to file the same, with
all exhibits thereto and other documents in connection therewith, with the
Securities and Exchange Commission, granting **** unto said
attorney-in-fact and agent full power and authority to do and perform each and
every act and thing requisite and necessary to be done in connection therewith,
as fully to all intents and purposes as he might or could do in person, hereby
ratifying and confirming all that said attorney-in-fact and agent, or his
substitute or substitutes, or any of them, shall do or cause to be done by
virtue hereof.





Pursuant
to the requirements of the Securities Exchange Act of 1934, as amended, this
report has been signed below by the following persons on behalf of the
Registrant and in the capacities and on the dates indicated:





SIGNATURE
    
    TITLE
    
    DATE/s/
      STEVEN B. SOLOMON
    
    President,
      Chief Executive OfficerSteven B.
    Solomon
    
    and
      Director
    
    March
      31, 2005(Principal
      Executive Officer)/s/
      RICHARD CONNELLY
    
    Chief
      Financial Officer
    
    March
      31, 2005Richard
      Connelly
    
    (Principal
      Accounting Officer)/s/
      JOHN LEIDE
    
    Director
    
    March
      31, 2005Major
      General (Ret) John Leide/s/
      CHRIS A. ECONOMOU
    
    Director
    
    March
      31, 2005Chris
      A. Economou/s/
      JOE M. ALLBAUGH
    
    Director
    
    March
      31, 2005Joe
      M. Allbaugh


**52**
 Table of Contents





INDEX TO
EXHIBITS




EXHIBITNUMBER
    
    DESCRIPTION3.1
    
    Amended
      and Restated Certificate of Incorporation of the Registrant (filed as
      Exhibit 3.1 to the Registrant’s Registration Statement on Form 10-SB,
      Registration No. 000-33491, filed with the Commission on January 11, 2002
      (the “Form 10-SB”) and incorporated by reference herein)3.2
    
    Amended
      and Restated By-laws of the Registrant (filed as Exhibit 3.2 to the Form
      10-SB and incorporated by reference herein)3.3
    
    Certificate
      of Designation, Rights and Preferences of Series A Convertible Preferred
      Stock (filed as Exhibit 3.1 to the Form 8-K filed by the Company on
      February 10, 2004 and incorporated by reference herein)4.1
    
    Form
      of Certificate of Common Stock of the Registrant (filed as Exhibit 4.1 to
      the Form 10-SB and incorporated by reference herein)4.2
    
    Form
      of Warrant to Purchase Common Stock (filed as Exhibit 4.1 to the Form 8-K
      filed by the Company on February 10, 2004 and incorporated by reference
      herein)4.3
    
    Registration
      Rights Agreement, dated as of February 10, 2004 by and among Citadel and
      the entities whose names appear on the signature pages thereof (filed as
      Exhibit 4.2 to the Form 8-K filed by the Company on February 10, 2004 and
      incorporated by reference herein)4.4
    
    Form
      of Senior Promissory Note (filed as exhibit 4.1 to the Form 8-K filed by
      the Company on September 8, 2004 and incorporated by reference herein)4.5
    
    Loan
      and Security Agreement between Citadel and Comerica Bank (filed as Exhibit
      10.1 to the Form 10-QSB filed by the Company on May 13, 2004 and
      incorporated by reference herein)4.6
    
    Intellectual
      Property Security Agreement between Citadel and Comerica Bank (filed as
      Exhibit 10.2 to the Form 10-QSB filed by the Company on May 13, 2004 and
      incorporated by reference herein)4.7
    
    Form
      of Warrant to Purchase Stock (filed as Exhibit 10.3 to the Form 10-QSB
      filed by the Company on May 13, 2004 and incorporated by reference herein)4.8
    
    First
      Amendment to Loan and Security Agreement between Citadel and Comerica Bank
      dated as of December 30, 2004 (filed as Exhibit 99.1 to the Form 8-K filed
      by the Company on December 30, 2004 and incorporated by reference herein)4.9
    
    Second
      Amendment to Loan and Security Agreement between Citadel and Comerica Bank
      dated as of March 30, 2005 (filed herewith)10.1
    
    Form
      of Plan and Agreement of Distribution between CT Holdings and Registrant
      (filed as Exhibit 10.1 to the Form 10-SB and incorporated by reference
      herein)10.2
    
    Form
      of Tax Disaffiliation Agreement between CT Holdings and the Registrant
      (filed as Exhibit 10.2 to the Form 10-SB and incorporated by reference
      herein)10.3
    
    Form
      of Transition Services Agreement between CT Holdings and Registrant
      (amended to extend the term until May 2005 and reduced the monthly fee to
      $7,500) (filed as Exhibit 10.3 to the Form 10-SB and incorporated by
      reference herein)10.4
    
    Form
      of Indemnification Agreement between Registrant and its directors and
      officers (filed as Exhibit 10.4 to the Form 10-SB and incorporated by
      reference herein)10.5
    
    Employment
      Agreement dated as of January 1, 2002 by and between Registrant and Steven
      B. Solomon (filed as Exhibit 10.5 to the Form 10-SB and incorporated by
      reference herein)
  **53**
 Table of Contents
  10.6
    
    2002
      Stock Incentive Plan of the Registrant, as amended (filed as Attachment B
      to the Company's Proxy Statement filed with the Commission on August 10,
      2004 and incorporated herein by reference)10.7
    
    Master
      Services Agreement, dated as of December 19, 2001, between CT Holdings and
      SBC Services (filed as Exhibit 10.7 to Amendment No. 1 to the Form 10-SB
      filed with the Commission on March 6, 2002 and incorporated by reference
      herein)


10.8
    
    Office
      Lease Agreement between Citadel and Metropolitan Life Insurance Company
      (filed as Exhibit 10.1 to the Form 10-QSB filed with the Commission on
      August 16, 2004 and incorporated by reference herein)10.9
    
    Form
      of Subscription Agreement between the Registrant and certain accredited
      investors (filed as Exhibit 99.2 to the Registrant’s Current Report on
      Form 8-K filed with the Commission February 13, 2003 and incorporated by
      reference herein)10.10
    
    Form
      of Warrant issued by the Registrant to certain accredited investors (filed
      as Exhibit 99.3 to the Registrant’s Current Report on Form 8-K filed with
      the Commission February 13, 2003 and incorporated by reference herein)10.11
    
    Form
      of Amendment No. 1 to Stock Purchase Warrant issued by the Registrant to
      certain accredited investors (filed as Exhibit 99.1 to the Registrant’s
      Current Report on Form 8-K filed with the Commission April 21, 2003 and
      incorporated by reference herein)10.12
    
    Form
      of Stock Purchase Warrant issued by the Registrant to certain accredited
      investors (filed as Exhibit 99.2 to the Registrant’s Current Report on
      Form 8-K filed with the Commission April 21, 2003 and incorporated by
      reference herein)10.13
    
    Engagement
      letter, dated December 10, 2002, between DHR International Inc. and the
      Registrant. (filed as Exhibit 10.13 to the Company’s Registration
      Statement on Form SB-2 (registration number 333- 104777) filed with the
      Commission on June 30, 2003 and incorporated by reference herein)10.14
    
    Advisory
      Agreement, dated November 11, 2002, between Merriman Curhan Ford & Co.
      (formerly known as RTX Securities Corporation) and the Registrant. (filed
      as Exhibit 10.14 to the Company’s Registration Statement on Form SB-2
      (registration number 333- 104777) filed with the Commission on June 30,
      2003 and incorporated by reference herein)10.15
    
    Engagement
      letter related to private placement dated December 9, 2002 between
      Merriman Curhan Ford & Co. (formerly known as RTX Securities
      Corporation) and the Registrant. (filed as Exhibit 10.15 to the Company’s
      Registration Statement on Form SB-2 (registration number 333- 104777)
      filed with the Commission on June 30, 2003 and incorporated by reference
      herein)10.16
    
    Warrant
      Agreement between the Registrant and Merriman Curhan Ford & Co. dated
      January 29,2003. (filed as Exhibit 10.16 to the Company’s Registration
      Statement on Form SB-2 (registration number 333- 104777) filed with the
      Commission on June 30, 2003 and incorporated by reference herein)10.17
    
    Promissory
      Note, dated September 11, 2002, payable by the Registrant to the order of
      Eagle Equity I, L.P. (filed as Exhibit 10.17 to the Company’s Registration
      Statement on Form SB-2 (registration number 333- 104777) filed with the
      Commission on June 30, 2003 and incorporated by reference herein)10.18
    
    Stock
      Purchase Agreement, dated September 11, 2002, among the Registrant,
      Lawrence E. Steinberg, Michael A. Hershman, and Ari Reubin. (filed as
      Exhibit 10.18 to the Company’s Registration Statement on Form SB-2
      (registration number 333- 104777) filed with the Commission on June 30,
      2003 and incorporated by reference herein)10.19
    
    Promissory
      Note, dated December 9, 2002, payable by the Registrant to the order of
      Ken Schnitzer, including Guaranty by Steven B. Solomon, Chief Executive
      Officer of the Registrant in favor of Ken Schnitzer. (filed as Exhibit
      10.19 to the Company’s Registration Statement on Form SB-2 (registration
      number 333- 104777) filed with the Commission on June 30, 2003 and
      incorporated by reference herein)


**54**
 Table of Contents


10.20
    
    Notice
      of Conversion, dated April 23, 2003, by Kenneth Schnitzer. (filed as
      Exhibit 10.20 to the Company’s Registration Statement on Form SB-2
      (registration number 333- 104777) filed with the Commission on June 30,
      2003 and incorporated by reference herein)10.21
    
    Option
      agreement dated November 4, 2002 between the registrant and Marc Still.
      (filed as Exhibit 10.21 to the Company’s Registration Statement on Form
      SB-2 (registration number 333- 104777) filed with the Commission on June
      30, 2003 and incorporated by reference herein)10.22
    
    Promissory
      Note dated June 5, 2002 payable by the Registrant to Aspen Advisors, LP.
      (filed as Exhibit 10.22 to the Company’s Registration Statement on Form
      SB-2 (registration number 333- 104777) filed with the Commission on June
      30, 2003 and incorporated by reference herein)10.23
    
    Consultant
      Agreement dated April 24, 2003 between the Registrant and CEOcast, Inc.
      (filed as Exhibit 10.23 to the Company’s Registration Statement on Form
      SB-2 (registration number 333- 104777) filed with the Commission on June
      30, 2003 and incorporated by reference herein)10.24
    
    Warrant
      Agreement between the Registrant and Merriman Curhan Ford & Co. dated
      April 21, 2003. (filed as Exhibit 10.24 to the Company’s Registration
      Statement on Form SB-2 (registration number 333- 104777) filed with the
      Commission on June 30, 2003 and incorporated by reference
      herein)10.25
    
    Securities
      Purchase Agreement, dated as of February 9, 2004 by and among Citadel and
      the entities whose names appear on the signature pages thereof (filed as
      Exhibit 10.1 to the Form 8-K filed by the Company on February 10, 2004 and
      incorporated by reference herein)10.26
    
    Employment
      Agreement dated as of November 17, 2003 between Registrant and Ed Krupa(filed
      as Exhibit 10.26 to the Form 10-KSB filed with the Commission on March 15,
      2004 and incorporated herein by reference)10.27
    
    Employment
      Agreement dated as of April 1, 2003 between Registrant and Richard
      Connelly (filed as Exhibit 10.27 to the Form 10-KSB filed with the
      Commission on March 15, 2004 and incorporated herein by reference)10.28
    
    Amendment
      No. 1 to Employment Agreement dated as of October 1, 2003 between
      Registrant and Steven B. Solomon (filed as Exhibit 10.28 to the Form
      10-KSB filed with the Commission on March 15, 2004 and incorporated herein
      by reference)10.29
    
    Amendment
      No. 1 to Employment Agreement dated as of October 1, 2003 between
      Registrant and Richard Connelly (filed as Exhibit 10.29 to the Form 10-KSB
      filed with the Commission on March 15, 2004 and incorporated herein by
      reference)10.30
    
    Software
      License and Service Agreement between Citadel and DigitalNet Government
      Solutions, LLC dated as of September 24, 2004 (filed as Exhibit 10.1 to
      the Form 10-QSB filed with the Commission on November 15, 2004 and
      incorporated herein by reference)23.1
    
    Consent
      of KBA Group LLP, Independent Registered Public Accounting Firm, filed
      herewith.24.1
    
    Power
      of Attorney (included as part of the signature page of this Annual Report
      on Form 10-KSB).31.1
    
    Certification
      of Principal Executive Officer, filed herewith.31.2
    
    Certification
      of Principal Financial Officer, filed herewith.32.1
    
    Certification
      of Chief Executive Officer and Chief Financial Officer Pursuant to 18
      U.S.C. Section 1350, As Adopted Pursuant to Section 906 of the
      Sarbanes-Oxley Act of 2002, filed herewith.


**55**
 Table of Contents





CITADEL SECURITY SOFTWARE INC.


DECEMBER
31, 2004


TABLE OF
CONTENTS




PageReport of Independent Registered Public Accounting Firm
    F-2Balance Sheets as of December 31, 2004 and 2003
    F-3Statements of Operations for the years ended December 31, 2004
      and 2003
    F-4Statement of Stockholders' Equity for the year ended December
      31, 2003
    F-5Statement of Stockholders' Equity for the year ended December
      31, 2004
    F-6Statements of Cash Flows for the years ended December 31, 2004
      and 2003
    F-7Notes to Financial Statements
    F-9





**F-1**
 Financial Table of Contents





REPORT OF INDEPENDENT REGISTERED PUBLIC ACCOUNTING FIRM








The Board
of Directors and Stockholders


Citadel
Security Software Inc.





We have
audited the accompanying balance sheets of Citadel Security Software Inc., (the
"Company") as of December 31, 2004 and 2003 and the related statements of
operations, stockholders' equity and cash flows for the years then ended. These
financial statements are the responsibility of the Company's management. Our
responsibility is to express an opinion on these financial statements based on
our audits.





We
conducted our audits in accordance with the standards of the Public Company
Accounting Oversight Board (United States). Those standards require that we plan
and perform the audits to obtain reasonable assurance about whether the
financial statements are free of material misstatement. An audit includes
examining, on a test basis, evidence supporting the amounts and disclosures in
the financial statements. An audit also includes assessing the accounting
principles used and significant estimates made by management, as well as
evaluating the overall financial statement presentation. We believe that our
audits provide a reasonable basis for our opinion.





In our
opinion, the financial statements referred to above present fairly, in all
material respects, the financial position of Citadel Security Software Inc. as
of December 31, 2004 and 2003 and the results of its operations and its cash
flows for the years then ended in conformity with accounting principles
generally accepted in the United States of America.








/s/
KBA Group LLP


KBA Group
LLP


Dallas,
Texas


February
4, 2005, except for Notes I, N and R to which the date is March 30,
2005


**F-2**
 Financial Table of Contents





CITADEL SECURITY SOFTWARE INC.


BALANCE
SHEETS





DECEMBER
      31,2004
    
    2003ASSETSCURRENT
      ASSETSCash
      and cash equivalents
    
    $
    9,838,154
    
    $
    5,092,161Accounts
      receivable-trade, less allowance of $209,000 and $78,500
    
    
    615,749
    
    
    1,699,154Prepaid
      expenses and other current assets
    
    
    1,466,354
    
    
    214,655Total
      current assets
    
    
    11,920,257
    
    
    7,005,970PROPERTY
      AND EQUIPMENT, net of accumulated depreciation
      of $726,444 and $1,213,427
    
    
    6,356,362
    
    
    635,748CAPITALIZED
      SOFTWARE DEVELOPMENT COSTS, net of accumulated amortization
      of $4,433,065 and $3,145,138
    
    
    4,048,452
    
    
    2,075,169OTHER
      ASSETS
    
    
    83,439
    
    
    17,243TOTAL
      ASSETS
    
    $
    22,408,510
    
    $
    9,734,130LIABILITIES
      AND STOCKHOLDERS' EQUITYCURRENT
      LIABILITIESCurrent
      portion of long-term debt
    
    $
    1,327,273
    
    $
    -Accounts
      payable and accrued expenses
    
    
    3,040,665
    
    
    1,372,826Payroll
      tax obligations
    
    
    350,093
    
    
    252,317Accrued
      compensation
    
    
    1,063,577
    
    
    516,128Accrued
      preferred stock dividends payable
    
    
    187,500
    
    
    -Current
      portion of deferred revenue
    
    
    2,462,851
    
    
    2,805,195Notes
      and advances payable to related parties
    
    
    -
    
    
    16,903Total
      current liabilities
    
    
    8,431,959
    
    
    4,963,369Long-term
      debt, less current portion
    
    
    1,989,393
    
    
    -Deferred
      revenue, less current portion
    
    
    480,172
    
    
    -Other
      non-current liabilities
    
    
    714,466
    
    
    -PREFERRED
      STOCK, $1,000 stated value per share; 1,000,000
      shares authorized; 15,000 and 0 shares issued
      and outstanding at December 31, 2004 and 2003, liquidation
      preference of $15,187,500
    
    
    10,701,847
    
    
    -COMMON
      STOCK, $.01 par value per share; 50,000,000
      shares authorized; 29,845,730 and
      27,830,511 shares issued and outstanding at
      December 31, 2004 and 2003
    
    
    298,457
    
    
    278,305ADDITIONAL
      PAID-IN CAPITAL
    
    
    44,248,609
    
    
    41,109,824ACCUMULATED
      DEFICIT
    
    
    (44,456,393
    )
    
    (36,617,368
    )STOCKHOLDERS'
      EQUITY
    
    
    10,792,520
    
    
    4,770,761TOTAL
      LIABILITIES AND STOCKHOLDERS' EQUITY
    
    $
    22,408,510
    
    $
    9,734,130





The
accompanying notes are an integral part of these financial
statements.




**F-3**
 Financial Table of Contents





CITADEL SECURITY SOFTWARE INC.


STATEMENTS
OF OPERATIONS





YEARS
      ENDEDDECEMBER
      31,2004
    
    2003RevenueLicense
      fees
    
    $
    12,361,585
    
    $
    5,198,010Customer
      support and services
    
    
    2,891,570
    
    
    658,286Total
      revenue
    
    
    15,253,155
    
    
    5,856,296Costs
      of revenueSoftware
      amortization
    
    
    1,287,927
    
    
    473,881Customer
      support and services costs
    
    
    1,507,661
    
    
    288,323Shipping
      and other costs
    
    
    36,496
    
    
    56,544Total
      costs of revenue
    
    
    2,832,084
    
    
    818,748Operating
      expensesSelling,
      general and administrative expense
    
    
    17,550,485
    
    
    6,388,396Product
      development expense
    
    
    1,995,612
    
    
    392,967Depreciation
      expense
    
    
    670,782
    
    
    207,924Write-off
      of property and equipment
    
    
    77,786
    
    
    -Total
      operating expenses
    
    
    20,294,665
    
    
    6,989,287Operating
      loss
    
    
    (7,873,594
    )
    
    (1,951,739
    )Interest
      income
    
    
    107,261
    
    
    -Interest
      expense
    
    
    (82,612
    )
    
    (3,036,342
    )Other
      income (expense)
    
    
    9,920
    
    
    (35,500
    )Write-off
      of note receivable from related party
    
    
    -
    
    
    (225,000
    )Loss
      before income taxes
    
    
    (7,839,025
    )
    
    (5,248,581
    )Provision
      for income taxes
    
    
    -
    
    
    -Net
      loss
    
    
    (7,839,025
    )
    
    (5,248,581
    )Preferred
      stock dividends
    
    
    (664,940
    )
    
    -Accretion
      of preferred stock beneficialconversion
    feature
    
    
    (215,397
    )
    
    -Net
      loss to common shareholders
    
    $
    (8,719,362
    )
    $
    (5,248,581
    )Net
      loss per share to common shareholders - basic and diluted
    
    $
    (0.30
    )
    $
    (0.24
    )Weighted
      average common shares outstanding - basic and diluted
    
    
    29,336,894
    
    
    22,134,040





The
accompanying notes are an integral part of these financial
statements.





**F-4**
 Financial Table of Contents




**CITADEL
SECURITY SOFTWARE INC.**


**STATEMENT
OF STOCKHOLDERS' EQUITY**


Common
      StockNumber
      ofShares
    
    Amount
    
    Additional
      Paid-in
      Capital
    
    Accumulated
      Deficit
    
    TotalBalances
      at December 31, 2002
    
    
    15,255,577
    
    $
    152,555
    
    $
    28,889,332
    
    $
    (31,368,787
    )
    $
    (2,326,900
    )Issuance
      of common stock for cash net of transaction fees
    
    
    3,275,000
    
    
    32,750
    
    
    2,364,717
    
    
    
    
    
    2,397,467Common
      stock issued with convertible notes payable, recorded as debt discount
    
    
    1,082,800
    
    
    10,828
    
    
    1,010,017
    
    
    
    
    
    1,020,845Beneficial
      conversion feature of convertible notes payable, recorded as debt discount
    
    
    
    
    
    
    
    
    1,543,310
    
    
    
    
    
    1,543,310Fair
      value of warrants issued as transaction fee in conjunction with issuance
      ofconvertible notes payable, recorded as debt issuance
      costs
    
    
    
    
    
    
    
    
    121,725
    
    
    
    
    
    121,725Common
      stock issued upon conversion of convertible notes payable and accrued
      interest
    
    
    2,348,079
    
    
    23,481
    
    
    2,787,399
    
    
    
    
    
    2,810,880Fair
      value of warrants issued in lieu of cash for services
    
    
    
    
    
    
    
    
    64,140
    
    
    
    
    
    64,140Common
      stock issued pursuant to the exercise of stock options
    
    
    393,660
    
    
    3,937
    
    
    195,124
    
    
    
    
    
    199,061Common
      stock issued pursuant to the exercise of stock options in exchange for
      reduction of a note payable to a former director
    
    
    862,500
    
    
    8,625
    
    
    267,375
    
    
    
    
    
    276,000Common
      stock issued pursuant to the exercise of warrants
    
    
    3,534,895
    
    
    35,349
    
    
    3,593,895
    
    
    
    
    
    3,629,244Issuance
      of common stock held in reserve at Distribution Date for settlement of CT
      Holdings liabilities
    
    
    250,000
    
    
    2,500
    
    
    (2,500
    )
    
    
    
    
    -Issuance
      of common stock per commitment upon conversion of CT Holdings convertible
      note payable
    
    
    675,000
    
    
    6,750
    
    
    (6,750
    )
    
    
    
    
    -Issuance
      of common stock in settlement of liability to former employee
    
    
    25,000
    
    
    250
    
    
    35,250
    
    
    
    
    
    35,500Common
      stock issued as compensation
    
    
    50,000
    
    
    500
    
    
    82,000
    
    
    
    
    
    82,500Fair
      value of common stock and stock options issued to consultants in lieu of
      cash for services
    
    
    78,000
    
    
    780
    
    
    164,790
    
    
    
    
    
    165,570Net
      loss
    
    
    -
    
    
    -
    
    
    -
    
    
    (5,248,581
    )
    
    (5,248,581
    )Balances
      at December 31, 2003
    
    
    27,830,511
    
    $
    278,305
    
    $
    41,109,824
    
    $
    (36,617,368
    )
    $
    4,770,761


The accompanying notes are an integral part of these
financial statements.





**F-5**
 Financial Table of Contents




**CITADEL SECURITY SOFTWARE INC.**
 **STATEMENT
OF STOCKHOLDERS' EQUITY**


Preferred
      Stock
    
    Common
      StockNumber
      ofShares
    
    Amount
    
    Number
      ofShares
    
    Amount
    
    AdditionalPaid-in Capital
    
    AccumulatedDeficit
    
    TotalBalances
      at December 31, 2003
    
    
    -
    
    $
    -
    
    
    27,830,511
    
    $
    278,305
    
    $
    41,109,824
    
    $
    (36,617,368
    )
    $
    4,770,761Issuance
      of comvertible preferred stock net of transcation fees
    
    
    15,000
    
    
    13,797,283
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    13,797,283Fiar
      value of warrants issued in conjunction with preferred stock
    
    
    
    
    
    (2,326,184
    )
    
    
    
    
    
    
    
    2,326,184
    
    
    
    
    
    -Fair
      value of beneficial conversion feature of convertible preferred stock
    
    
    
    
    
    (984,649
    )
    
    
    
    
    
    
    
    984,649
    
    
    
    
    
    -Accretion
      of beneficial conversion feature
    
    
    
    
    
    215,397
    
    
    
    
    
    
    
    
    (215,397
    )
    
    
    
    
    -Preferred
      stock dividends
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    (664,939
    )
    
    
    
    
    (664,939
    )Common
      stock issued pursuant to the exercise of stock options
    
    
    
    
    
    
    
    
    350,219
    
    
    3,502
    
    
    332,555
    
    
    
    
    
    336,057Common
      stock issued pursuant to the exercise of warrants
    
    
    
    
    
    
    
    
    165,000
    
    
    1,650
    
    
    214,900
    
    
    
    
    
    216,550Exercise
      of conversion right
    
    
    
    
    
    
    
    
    1,500,000
    
    
    15,000
    
    
    (15,000
    )
    
    
    
    
    -Fair
      value of warrants issued in conjunction with bank lines of credit
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    45,838
    
    
    
    
    
    45,838Fair
      value of stock options with modified terms issued to a former employee
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    129,995
    
    
    
    
    
    129,995Net
      loss
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    (7,839,025
    )
    
    (7,839,025
    )-
    
    
    -
    
    
    -
    
    
    -
    
    
    -
    
    
    -
    
    
    -Balances
      at December 31, 2004
    
    
    15,000
    
    $
    10,701,847
    
    
    29,845,730
    
    $
    298,457
    
    $
    44,248,609
    
    $
    (44,456,393
    )
    $
    10,792,520





**F-6**
 Financial Table of Contents




CITADEL SECURITY SOFTWARE INC.


STATEMENTS
OF CASH FLOWS





YEARS
      ENDEDDECEMBER
      31,2004
    
    2003CASH
      FLOWS FROM OPERATING ACTIVITIESNet
      loss
    
    $
    (7,839,025
    )
    $
    (5,248,581
    )Adjustments
      to reconcile net loss to net cashused
      in operating activities:Depreciation
      and amortization
    
    
    1,958,709
    
    
    681,806Write-off
      of property and equipment
    
    
    77,786
    
    
    -Provision
      for returns, allowances and bad debts
    
    
    130,500
    
    
    58,500Stock
      based compensation expense
    
    
    129,995
    
    
    -Amortization
      of debt issuance costs recognized as interest expense
    
    
    16,052
    
    
    333,725Beneficial
      conversion feature of convertible debt recognized
      as interest expense
    
    
    -
    
    
    1,543,310Common
      stock issued in conjunction with convertible debt
      recognized as interest expense
    
    
    -
    
    
    1,067,928Common
      stock issued to an officer as
      compensation expense
    
    
    -
    
    
    82,500Common
      stock, warrants and stock options issued
      for services
    
    
    -
    
    
    265,210Write-off
      of note receivable from related party
    
    
    -
    
    
    225,000Changes
      in operating assets and liabilitiesAccounts
      receivable - trade
    
    
    952,905
    
    
    (1,590,989
    )Prepaid
      expenses and other current assets
    
    
    (1,198,994
    )
    
    (158,458
    )Other
      assets
    
    
    (10,014
    )
    
    -Accounts
      payable and accrued expenses
    
    
    898,611
    
    
    98,511Payroll
      tax obligations
    
    
    97,776
    
    
    (536,245
    )Accrued
      compensation
    
    
    547,449
    
    
    250,688Deferred
      revenue
    
    
    137,828
    
    
    2,655,002NET
      CASH USED IN OPERATING ACTIVITIES
    
    
    (4,100,422
    )
    
    (272,093
    )CASH
      FLOWS FROM INVESTING ACTIVITIESPurchases
      of property and equipment
    
    
    (5,038,193
    )
    
    (411,211
    )Capitalized
      software development costs
    
    
    (3,261,210
    )
    
    (1,897,497
    )Issuance
      of note receivable to CT Holdings
    
    
    -
    
    
    (225,000
    )NET
      CASH USED IN INVESTING ACTIVITIES
    
    
    (8,299,403
    )
    
    (2,533,708
    )CASH
      FLOWS FROM FINANCING ACTIVITIESNet
      proceeds from issuance of preferred stock
    
    
    13,797,283
    
    
    -Borrowings
      of long-term debt
    
    
    3,500,000
    
    
    -Payments
      of long-term debt
    
    
    (183,334
    )
    
    -Debt
      issue costs
    
    
    (26,396
    )
    
    -Payment
      of preferred stock dividends
    
    
    (477,439
    )
    
    -Proceeds
      of notes and advances from related parties
    
    
    -
    
    
    888,522Payments
      on notes and advances from related parties
    
    
    (16,903
    )
    
    (1,463,160
    )Proceeds
      from notes payable to shareholders
    
    
    -
    
    
    2,570,000Payments
      on notes payable to shareholders
    
    
    -
    
    
    (537,000
    )Proceeds
      from issuance of common stock
    
    
    -
    
    
    2,397,467Proceeds
      from exercise of warrants
    
    
    216,550
    
    
    3,629,244Proceeds
      from exercise of stock options
    
    
    336,057
    
    
    199,060Proceeds
      on notes receivable from issuance of common stock
    
    
    -
    
    
    201,000NET
      CASH PROVIDED BY FINANCING ACTIVITIES
    
    
    17,145,818
    
    
    7,885,133Net
      increase in cash and cash equivalents
    
    
    4,745,993
    
    
    5,079,332Cash
      and cash equivalents at the beginning of the year
    
    
    5,092,161
    
    
    12,829Cash
      and cash equivalents at the end of the year
    
    $
    9,838,154
    
    $
    5,092,161





**** The
accompanying notes are an integral part of these financial
statements.




**F-7**
 Financial Table of Contents





CITADEL
SECURITY SOFTWARE INC.


STATEMENTS
OF CASH FLOWS (continued)





YEARS
      ENDEDDECEMBER
      31,2004
    
    2003Supplemental
      cash flow information:Interest
      paid
    
    $
    54,989
    
    $
    38,252Income
      taxes paid
    
    $
    -
    
    $
    -Non-cash
      investing items:Note
      payable issued as settlement of accounts payable
    
    $
    -
    
    $
    50,000Leasehold
      improvements funded by landlord
    
    $
    836,448
    
    $
    -Non-cash
      financing items:Preferred
      stock dividend accrued
    
    $
    187,500
    
    $
    -Beneficial
      conversion feature ofconvertible preferred
      stock
    
    $
    984,649
    
    $
    -Accretion
      of beneficial conversion feature of convertible preferred
      stock
    
    $
    215,397
    
    $
    -Fair
      value of warrants issued in connection withsale of preferred
      stock
    
    $
    2,326,184
    
    $
    -Issuance
      of common stock through exercise ofexchange right by
      officer
    
    $
    15,000
    
    $
    -Fair
      value of warrants issued in conjunction with bank linesof credit
      recorded as deferred financing costs
    
    $
    45,838
    
    $
    -Exercise
      of stock options in exchange for note payable plusaccrued interest
      due former director
    
    $
    -
    
    $
    276,000Conversion
      of note payable plus accruedinterest into shares of common
      stock
    
    $
    -
    
    $
    2,810,881Note
      payable issued for financing feesrecorded as debt issuance
      costs
    
    $
    -
    
    $
    212,000Warrants
      to purchase common stock issued with convertiblenote payable
      recorded as debt issuance cost
    
    $
    -
    
    $
    121,725Beneficial
      conversion feature of convertible notespayable recorded as debt
      discount
    
    $
    -
    
    $
    1,543,310Common
      stock issued with convertible notes payablerecorded as debt
      discount
    
    $
    -
    
    $
    1,020,845





The
accompanying notes are an integral part of these financial
statements.




**F-8**
 Financial Table of Contents





**CITADEL SECURITY SOFTWARE INC.**


**NOTES
TO FINANCIAL STATEMENTS**


**DECEMBER
31, 2004**





**NOTE
A - NATURE OF BUSINESS AND SUMMARY OF SIGNIFICANT ACCOUNTING
POLICIES**





The
accompanying financial statements of Citadel Security Software Inc. (the
"Company" or "Citadel") have been prepared in accordance with generally accepted
accounting principles.





Description
of Business





Citadel
provides enterprise vulnerability management and policy compliance and
enforcement solutions that enable organizations to reduce the risk associated
with vulnerabilities. Citadel develops and markets full life cycle vulnerability
management software solutions including Hercules®, ConnectGuardTM and AssetGuardTM
powered by automated vulnerability remediation ("AVR") technology which allows
enterprises to neutralize security vulnerabilities across Windows, Linux, and
Unix platforms. SecurePCTM and NetOFFTM are security management solutions for
networks and personal workstations which are designed to secure and manage
personal computers as well as local area networks. With Citadel's solutions,
enterprises are able to realize cost and process efficiencies, proactively
manage the latest threats and vulnerabilities, and demonstrate compliance with
corporate mandates or government legislation. Vulnerabilities are one of the
fastest growing threats to enterprise network security, and since its inception
in 1996, Citadel has been developing software products and services to mitigate
the risk of security vulnerabilities. Patent applications have been filed for
the Hercules AVR technology processes.





The
Company's security software business was formed in 1996 as the result of the
acquisition of several technology businesses operated by a business incubator
from 1996 through May 17, 2002 at which time Citadel was spun out from its
former parent as a stand alone company. The Company is a Delaware corporation
and is headquartered in Dallas, Texas with an additional office in Reston,
Virginia. On April 30, 2004 the Company’s stock moved from the OTCBB to the
Nasdaq SmallCap Market and trades under the symbol "CDSS". Citadel’s website can
be found at www.citadel.com.





Liquidity





At
December 31, 2004 the Company had cash and cash equivalents of approximately
$9.8 million, a net working capital position of approximately $3.5 million and
stockholders’ equity of approximately $10.8 million. On February 10, 2004, in
return for gross proceeds of $15,000,000, the Company issued 15,000 shares of
the preferred stock (convertible into 3,000,000 shares of common stock at the
initial conversion price of $5.00 per share) and warrants to purchase 1,200,000
shares of common stock. The net proceeds from the preferred stock financing,
were approximately $13,800,000, after placement agent fees, as well as
accounting and legal fees and were used for working capital and other corporate
purposes. In April 2004, the Company secured a revolving credit line from a bank
of $750,000 for operations and term loan credit facilities totaling $2,750,000
for use to acquire the capital equipment necessary to support the Company's
business plan. The $750,000 revolving line of credit was later converted by the
bank as a term loan line of credit for the acquisition of equipment. The Company
borrowed $3,500,000 against the lines of credit to partially fund approximately
$5,000,000 of capital expenditures in 2004.





The
Company believes that cash generated from the preferred stock financing, the
credit facilities provided by the bank, existing cash balances and cash
equivalents along with the cash balances expected to be generated from the
execution of the 2005 operating plans will be sufficient to meet cash
requirements for the next twelve months. However the Company may be required, or
could elect, to seek additional funding prior to that time. Future capital
requirements will depend on many factors, including the receipt of cash from
licenses of the Company's products, the rate of revenue growth, the timing and
extent of spending to support product development initiatives and expansion of
sales and marketing, the timing of introductions of new products, enhancements
to existing products, and the general market acceptance of the Company's
products. There can be no assurance that that additional equity or debt
financing will be available on acceptable terms or at all. Sources of liquidity
beyond twelve months, in the Company's opinion, will be then current cash
balances, funds from operations and debt or equity financing that may be
available.





**F-9**
 Financial Table of Contents





Use of
Estimates





The
preparation of financial statements in conformity with generally accepted
accounting principles requires management to make estimates and assumptions that
affect the amounts reported in the financial statements. Actual results could
differ from those estimates.





Revenue
Recognition





The
Company's customers consist of large and small corporations, healthcare
organizations, financial institutions and government and educational agencies.
The Company's revenue recognition policies have been designed to follow the
guidance provided by Statement of Position (SOP) 97-2, "Software Revenue
Recognition," as amended by SOP 98-9 and Staff Accounting Bulletin (SAB) 104,
"Revenue Recognition." Revenue from license fees is generally recognized when a
fixed fee order has been received, delivery has occurred to the customer through
electronic download or if software media and documentation is shipped, when
shipped if delivery terms are FOB "Origin" or when delivered if delivery terms
are FOB "Destination". In addition, revenue is recognized only when the
collectibility of the invoiced amounts is probable and acceptance criteria, if
any, have been met. Customer support contracts provide the customer the right to
telephone support, software updates, point releases of new features and
functionality, and vulnerability remediation updates on a when and if available
basis. Customer support contracts are sold separately from the license and the
related revenue is recognized ratably over the term of the support contract. In
arrangements that include multiple elements, including perpetual software
licenses and maintenance and/or services revenue is allocated to the undelivered
components based on vendor specific objective evidence (“VSOE”) and recognized
based on management's estimate of the fair value of each undelivered component
as described in SOP 97-2, SOP 98-9 and SAB 104.





Customers
may obtain a license from Citadel's direct sales organization, or license
products through promotions or agreements with independent third party resellers
and strategic partners. The Company's products are not licensed through retail
distribution channels. Once properly licensed for an evaluation or permanent
installation, the customer has a choice to download the Company’s products from
its secure website or to have the media and documentation shipped directly to
them. A customer may return a product only under very limited circumstances
during the first thirty days from shipment for a replacement if the media is
damaged or for a full refund if the software does not perform in accordance with
written specifications. Accordingly, the Company records a provision for returns
against license revenue in the same period the revenue is recorded. The
provision is subject to estimation by management and has been based on
historical product returns, the average invoice size, revenue volume and other
known data as well as market and economic conditions. An allowance for returns,
allowances and bad debts of $209,000 has been estimated and recorded at December
31, 2004. The estimate of the allowance for returns, allowances and bad debts
may fluctuate from period to period due to factors including but not limited to
the value of actual returns, the average dollar value of licenses granted during
the period, the relative license revenue volume for the period and changes in
financial condition of individual customers.





Current
reseller agreements generally do not provide for a contractual right of return,
future price concessions, or minimum purchase commitments. Payment is not
contingent upon the reseller's future licensing of products. Revenue generated
from products licensed through various marketing channels where the right of
return might expressly or implicitly exist is reduced by reserves for estimated
product returns. Such reserves are estimates developed by management based on
returns history and current economic and market trends. Management determined
that no reserve for returns from resellers was required at December 31, 2004.





As a
convenience to government customers, the Company’s products may be licensed
through government contractors, including system integrators. These government
contractors hold the preferred purchasing and contracting vehicles for the
various government agencies. The Company’s contracts with these government
contractors do not contain an express right of return, however, these government
contractors may order products in advance of receiving the order from the
government agency. When aware of these circumstances, the Company defers revenue
recognition until the government contractor has received the authorization to
deploy the products to the end user government agency.





**F-10**
 Financial Table of Contents





At
December 31, 2003, deferred revenue included the invoiced value of a December
2003 product shipment for an order received from a government systems integrator
of approximately $1.7 million consisting of approximately $1.4 million in
license fees and $0.3 million for post sale customer support services. Although
the order was a fixed-fee order and shipment had occurred in December 2003 and
the Company determined that the collection of the revenue was probable, the
Company deferred revenue recognition because the government systems integrator
had not concluded negotiations with the end user government agency and had not
delivered the software licenses to the government agency. During the quarter
ended June 30, 2004, the systems integrator cancelled the order to the Company
because, according to the cancellation notice, the systems integrator and the
government agency had not concluded contract negotiations and the eventual terms
of the systems integrator’s order from the government agency would most likely
be different than the terms originally proposed in December 2003. Accordingly,
the Company reduced deferred revenue and accounts receivable by approximately
$1.7 million in June 2004.





The
Company also offers its products to customers under subscription licenses with
one year to five year terms. The customer may renew the subscription at the end
of the subscription term or may convert the subscription into a perpetual use
license at any time for an additional fee. Under a subscription license the
customer receives the right to use the product, to post sale customer support
and in the case of the Company's product Hercules, to the vulnerability remedy
database for the term of the subscription and for as long as the customer meets
its payment obligation. The subscription fee payment is generally due in equal
payments at the beginning of the subscription term and then on each anniversary
date thereafter. Revenue from subscriptions is recognized ratably over the term
of the subscription. If a customer fails to adhere to the payment terms of the
subscription, the revenue recognized is limited to the ratable recognition of
the amount of payments actually received. No subscription revenue was recognized
in the twelve months ended December 31, 2004 or 2003.





The
Company's product development strategy is architected for the current and future
releases of Microsoft Windows, UNIX, Linux, Mac and other well established
operating systems. The operating systems supported are well established and the
Company believes that this cross platform strategy reduces the potential
exposure to product obsolescence due to rapid changes in customer preferences or
technological obsolescence due to the introduction of new operating systems or
computing products. However, it is possible that these factors may change in the
future as the Company's business model is adapted to changes in technology,
changes in customer buying patterns and changes in the software industry's
revenue licensing models.





Software
Development Costs





The
Company follows the guidance in Statement of Financial Accounting Standards
("SFAS") No. 86, "Accounting for the Costs of Computer Software to be Sold,
Leased or Otherwise Marketed," to account for internally-generated software
development costs associated with new products and significant enhancements to
existing software products. These software development costs are expensed as
incurred until technological feasibility has been established. Software
development costs that qualify for capitalization include the salaries and
benefits of the software engineers assigned to the development projects,
internal and external quality assurance testing costs, overhead allocations
primarily associated with rent and facilities costs and the costs of outsourced
development activities including independent product testing and certification
labs. Software development costs not qualifying for capitalization are reported
as product development expense in the statements of operations. Capitalized
software development costs, including purchased software, if any, are amortized
using the greater of the revenue method or the straight-line method generally
with useful lives of three years or less. At each balance sheet date the Company
evaluates the estimated net realizable value of each software product and when
required, records write-downs of net book value to net realizable value of any
products for which the net book value is in excess of net realizable value. The
net realizable value is the estimated future gross revenue of each product
reduced by the estimated future costs of completing and disposing of that
product, including the costs of completing in process development and customer
support. The Company determined that no write-down of capitalized software
development costs was required at December 31, 2004 or 2003, respectively. A
summary of capitalized costs, expenses and amortization discussed above is
presented in the following table:





**F-11**
 Financial Table of Contents





Years
      EndedDecember 31,2004
    
    2003Product
      development expense, net of capitalized softwaredevelopment
      costs
    
    
    
    
    $
    1,995,612
    
    $
    392,967Software
      development costs capitalized
    
    
    
    
    
    3,261,210
    
    
    1,897,497Software
      amortization expense
    
    
    
    
    
    1,287,927
    
    
    473,881





Net Loss
per Common Share





Basic net
loss per common share is computed by dividing net loss to common shareholders by
the weighted average number of shares of common stock outstanding during the
period. Diluted net income per share is computed using the weighted average
number of common shares outstanding plus potentially dilutive common shares
outstanding during the periods, including the assumed conversions of dilutive
securities such as preferred stock, options, and warrants. For the years ended
December 31, 2004 and 2003, basic and diluted net loss per common share are
identical because the number of shares assumed in the conversion of the
preferred stock, options and warrants outstanding would be antidilutive and are
therefore excluded from the computation of diluted loss per common share. The
effect of Citadel stock options for 7,993,000 shares of Citadel common stock and
1,434,881 Citadel warrants outstanding at December 31, 2004 have been excluded
from the weighted average shares computation as they are antidilutive. At
December 31, 2003 the effect of Citadel stock options for 6,846,000 shares of
Citadel common stock and 165,000 Citadel warrants outstanding at December 31,
2003 have been excluded from the weighted average shares computation as they are
antidilutive. In addition, the effect of the as if conversion of the preferred
stock outstanding at December 31, 2004 into 3,000,000 shares of common stock has
been excluded from the computation of net loss per share to common shareholders
as the effect is antidilutive.








Cash and
Cash Equivalents





The
Company considers all highly liquid investments purchased with an initial
maturity of three months or less to be cash equivalents.





Accounts
Receivable and Concentrations of Credit Risk





Trade
accounts receivable are stated at the amount the Company expects to collect. The
Company maintains allowances for doubtful accounts for estimated losses
resulting from the inability of its customers to make required payments.
Management considers the following factors when determining the collectibility
of specific customer accounts: customer credit worthiness, past transaction
history with the customer, current economic industry trends, and changes in
customer payment terms. If the financial condition of the Company’s customers
were to deteriorate, adversely affecting their ability to make payments,
additional allowances would be required. Based on management’s assessment, the
Company provides for estimated uncollectible amounts through a charge to expense
and a credit to a valuation allowance. Balances that remain outstanding after
the Company has used reasonable collection efforts are written off through a
charge to the valuation allowance and a credit to accounts receivable.





**F-12**
 Financial Table of Contents





Impairment
of Long-Lived Assets


In
accordance with SFAS No. 144, “Accounting for the Impairment or Disposal of
Long-Lived Assets”, the Company reviews its long-lived assets for impairment
whenever events or changes in circumstances indicate that the carrying amount of
an asset may not be recoverable and exceeds its fair value. If conditions
indicate an asset might be impaired, the Company estimates the future cash flows
expected to result from the use of the asset and its eventual disposition. The
impairment would be measured by the amount by which the asset exceeds its fair
value typically represented by the future discounted cash flow associated with
the asset.


Income
Taxes





Income
taxes are accounted for using the asset and liability method. Deferred income
tax expenses are provided based upon estimated future tax effects of differences
between the carrying amounts of assets and liabilities for financial reporting
purposes and the amounts used for income tax purposes calculated based upon
provisions of enacted laws.





Advertising
Expense





The
Company expenses costs associated with advertising as they are incurred and
includes these costs in selling, general and administrative expense. Advertising
expense, including design and production of product collaterals, industry trade
shows and printing, for the years ended December 31, 2004 and 2003 was
approximately $1,183,000 and $220,000, respectively.





Stock-Based
Compensation





The
Company accounts for stock-based employee compensation arrangements in
accordance with provisions of Accounting Principles Board ("APB") Opinion No.
25, "Accounting for Stock Issued to Employees," and follows the disclosure
provisions of SFAS No. 123, "Accounting for Stock-Based Compensation" as amended
by SFAS No. 148, "Accounting for Stock-Based Compensation-Transition and
Disclosure, an amendment of FASB Statement No. 123". Under APB Opinion No. 25,
compensation expense for employees is based on the excess, if any, on the date
of grant, between the fair value of the Company's stock over the exercise price.





The
Company accounts for equity instruments issued to non-employees in accordance
with the provisions of SFAS No. 123 and SFAS No. 148 and Emerging Issues Task
Force ("EITF") Issue No. 96-18, "Accounting for Equity Instruments That Are
Issued to Other Than Employees for Acquiring, or in Conjunction with Selling,
Goods or Services." All transactions in which goods or services are the
consideration received for the issuance of equity instruments are accounted for
based on the fair value of the consideration received or the fair value of the
equity instrument issued, whichever is more reliably measurable. The measurement
date of the fair value of the equity instrument issued is the earlier of the
date on which the counterparty's performance is complete or the date on which it
is probable that performance will occur.





**F-13**
 Financial Table of Contents





If the
Company had recognized compensation expense, in accordance with SFAS No. 123 and
148, based upon the fair value at the grant date for options granted to
employees, officers and directors during the year ended December 31, 2004 and
2003 the pro forma effect on net loss and net loss per share would have been as
follows:





Years
      EndedDecember 31,2004
    
    2003Net
      loss to common shareholders as reported
    
    $
    (8,719,362
    )
    $
    (5,248,581
    )Add:
      Stock-based employee compensation expenseincluded
      in reported net loss
    
    
    129,995
    
    
    -Deduct:
      Stock-based employee compensationexpense
      determined under fair value based method
    
    
    (1,916,398
    )
    
    (1,073,445
    )Pro
      forma net loss to common shareholders
    
    $
    (10,505,765
    )
    $
    (6,322,026
    )Net
      loss per share to common shareholders:As
      reported - basic and diluted
    
    $
    (0.30
    )
    $
    (0.24
    )Pro
      forma - basic and diluted
    
    $
    (0.36
    )
    $
    (0.29
    )





Fair
Value of Financial Instruments





The
Company's financial instruments, including cash and cash equivalents, accounts
receivable, accounts payable and notes payable are carried at cost, which
approximates fair value.





Recent
Accounting Pronouncements


On
December 16, 2004, the Financial Accounting Standards Board (“FASB”) issued FASB
Statement No. 123 (revised 2004), Share-Based Payment ("SFAS No. 123R"), which
is a revision of FASB Statement No. 123, Accounting for Stock-Based
Compensation. SFAS No. 123R supersedes APB Opinion No. 25, Accounting for Stock
Issued to Employees, and amends FASB Statement No. 95, Statement of Cash Flows.
Generally, the approach in SFAS No. 123R is similar to the approach described in
SFAS No. 123. However, SFAS 123R requires all share-based payments to employees,
including grants of employee stock options, to be recognized in the income
statement based on their fair values. Pro forma disclosure is no longer an
alternative. The Company expects to adopt SFAS No. 123R on January 1, 2006.


The
Company is evaluating the impact of adopting SFAS 123R and expects that it will
record substantial non-cash stock compensation expenses. The adoption of SFAS
123R is not expected to have a significant effect on the Company's financial
condition or cash flows but is expected to have a significant effect on the
Company's results of operations. The future impact of the adoption of SFAS 123R
cannot be predicted at this time because it will depend on the levels of
share-based payments granted by the Company in the future. However, had the
Company adopted SFAS 123R in prior periods, the impact of the standard would
have approximated the impact of SFAS 123 as described in the pro forma net loss
attributable to common shareholders included in the *Stock-Based*  *Compensation* policy
footnote.





**NOTE
B - CONCENTRATION OF CREDIT RISK**





At
December 31, 2004, the Company had approximately $9,700,000 in cash and cash
equivalents at financial institutions which were in excess of the FDIC insured
limits.





The
Company performs credit evaluations of its customers’ financial condition and
does not require collateral from them. At December 31, 2004 the Company had
current accounts receivable of approximately $458,000, or 74% of total accounts
receivable outstanding due from three customers, of which approximately $193,000
was due from a U.S. government systems integrator. At December 31, 2003
approximately 100% of the Company’s gross accounts receivable was due from a
single U.S. government systems integrator, but not the same systems integrator
as at December 31, 2004. Allowances for credit losses are maintained at levels
considered adequate by management.





**F-14**
 Financial Table of Contents





At
December 31, 2003 deferred revenue included the invoiced value of a December
2003 product shipment for an order received from a systems integrator of
approximately $1,700,000 million consisting of approximately $1,400,000 million
in license fees and $300,000 for post sale customer support services. Although
the order was a fixed-fee order, shipment had occurred in December 2003 and the
Company determined that the collectibility of the revenue was probable, the
Company deferred revenue recognition for this $1,700,000 because the systems
integrator had not concluded negotiations with the end user government agency
and had not deployed the software licenses to the government agency. During the
quarter ended June 30, 2004, the systems integrator cancelled the order to the
Company because, according to the cancellation notice, the systems integrator
and the government agency had not concluded contract negotiations and the
eventual terms of the systems integrator’s order from the government agency
would most likely be different than the terms originally proposed in December
2003. Accordingly, the Company reduced deferred revenue and accounts receivable
by approximately $1,700,000. Deferred revenue at December 31, 2004 was
approximately $2,943,023 consisting of the unearned revenue associated with the
remaining terms of post sales customer support and service agreements in force
at December 31, 2004. Of that amount $480,172 was for services to be performed
beyond twelve months from the balance sheet date and accordingly have been
classified as a non-current liability on the balance sheet.





**NOTE
C - PREPAID EXPENSES AND OTHER CURRENT ASSETS**





The
components of prepaid expenses and other current assets consist of the items
listed in the table below:





December
      31,2004
    
    2003Prepaid
      commissions
    
    $
    695,371
    
    $
    -Prepaid
      marketing and advertising expenses
    
    
    387,727
    
    
    87,885Prepaid
      insurance premiums
    
    
    227,337
    
    
    96,699Prepaid
      software and hardware maintenance contracts
    
    
    147,205
    
    
    30,071Employee
      travel advances receivable
    
    
    8,714
    
    
    -$
    1,466,354
    
    $
    214,655





**NOTE
D - PROPERTY AND EQUIPMENT**





Property
and equipment is stated at cost and depreciation is computed using the
straight-line method over the estimated useful lives ranging from one to eight
years. Amortization of leasehold improvements is computed using the
straight-line method over the lesser of the useful life of the asset or the
remaining term of the lease. Major classes of property and equipment are as
follows:





December
      31,2004
    
    2003Furniture
    
    $
    980,714
    
    $
    240,232Office
      equipment
    
    
    384,377
    
    
    87,101Computer
      equipment and internal use software
    
    
    3,429,681
    
    
    1,398,168Leasehold
      improvements
    
    
    2,288,034
    
    
    123,6747,082,806
    
    
    1,849,175Less
      accumulated depreciation and amortization
    
    
    (726,444
    )
    
    (1,213,427
    )Net
      property and equipment
    
    $
    6,356,362
    
    $
    635,748





**F-15**
 Financial Table of Contents





In May
2004 the Company signed an 8 year lease for approximately 33,500 square feet of
office space in Dallas, Texas. The Company moved into the new office space in
November 2004 and at that time abandoned the certain furniture, equipment and
leasehold improvements in place at the prior office resulting in a write-off of
property and equipment of $77,786. The write-off consisted of following
assets:





Furniture
    
    $
    240,232Office
      equipment
    
    
    87,101Computer
      equipment and internal use software
    
    
    761,804Leasehold
      improvements
    
    
    143,4941,232,631Less
      accumulated depreciation and amortization
    
    
    (1,154,845
    )Net
      book value of property and equipment written off to operations
    
    $
    77,786








**NOTE
E - ACCOUNTS PAYABLE AND ACCRUED EXPENSES**





Accounts
payable and accrued expenses at December 31, 2004 and December 31, 2003 are
comprised of the following:





December
      31,2004
    
    2003Accounts
      payable, trade
    
    
    
    
    $
    1,695,566
    
    $
    853,840Accrued
      rent
    
    
    
    
    
    251,823
    
    
    71,279Accrued
      sales and franchise taxes
    
    
    
    
    
    350,974
    
    
    53,400Other
      accrued expenses
    
    
    
    
    
    742,302
    
    
    144,857Settlement
      liabilities
    
    
    
    
    
    -
    
    
    249,450$
    3,040,665
    
    $
    1,372,826





**NOTE
F - PAYROLL TAX OBLIGATIONS**





The
payroll tax obligation of $350,093 represents payroll taxes accrued at December
31, 2004 that are expected to be remitted in the first quarter of 2005. At
December 31, 2003 the accrued payroll tax obligation amount was $252,317.





**NOTE
G - ACCRUED COMPENSATION**





Accrued
compensation at December 31, 2004 and December 31, 2003 are comprised of the
following:





December
      31,2004
    
    2003Accrued
      salaries and wages
    
    
    
    
    $
    -
    
    $
    188,263Accrued
      commissions and incentive compensation
    
    
    
    
    
    712,603
    
    
    224,943Accrued
      vacation pay
    
    
    
    
    
    350,974
    
    
    102,922$
    1,063,577
    
    $
    516,128





**F-16**
 Financial Table of Contents


****


**NOTE
H - INCOME TAXES**





The
significant components of the Company's deferred tax liabilities and assets are
as follows:





December 31,Deferred
      tax assets (liabilities)
    
    2004
    
    2003Net
      operating loss carryforwards
    
    $
    4,582,000
    
    $
    1,568,000Accounts
      receivable allowance
    
    
    71,000
    
    
    27,000Accrued
      expenses
    
    
    333,000
    
    
    175,000Capitalized
      software development costs
    
    
    (1,376,000
    )
    
    (707,000
    )Property
      and equipment
    
    
    (121,000
    )
    
    (31,000
    )Total
      deferred tax assets
    
    
    3,489,000
    
    
    1,032,000Valuation
      allowance
    
    
    (3,489,000
    )
    
    (1,032,000
    )Total
      deferred tax assets, net
    
    $
    -
    
    $
    -





The
difference between the provision for income taxes and the amount computed by
applying the federal statutory rate to loss before provision for income taxes is
explained below:





December
      31,2004
    
    2003Benefit
      computed at federal statutory rate
    
    $
    (2,665,000
    )
    $
    (1,785,000
    )Increase
      in valuation allowance
    
    
    2,457,000
    
    
    678,000Permanent
      differences
    
    
    208,000
    
    
    1,107,000$
    -
    
    $
    -





For
federal income tax purposes, at December 31, 2004 the Company had a net
operating loss carryforward of approximately $13,500,000. The net operating loss
carryforward, which is subject to annual limitations as prescribed by the
Internal Revenue Code, is available to offset future taxable income and begins
to expire in 2023. A valuation allowance has been recorded for the entire amount
of the net deferred tax asset due to uncertainty of realization.





**NOTE
I - LONG-TERM DEBT**





On April
15, 2004 the Company completed a Loan and Security Agreement (the "Original
Agreement") with Comerica Bank ("Comerica"), securing credit lines aggregating
$3,500,000. Of this amount, $750,000 was a revolving line of credit which if
used would be secured by accounts receivable defined in the Original Agreement.
The remaining $2,750,000 credit line was available in two tranches to fund
capital equipment expenditures through December 31, 2004. These loans are
secured by the capital equipment acquired with the proceeds of the borrowings as
well as a pledge of substantially all of the Company's assets, including its
intellectual property. Through December 30, 2004 the Company has used the full
amount of the $2,750,000 credit line to fund capital expenditures during 2004.
The revolving line of credit remained unused and on December 30, 2004, Citadel
and Comerica entered into a First Amendment to Loan and Security Agreement (the
"Amendment"), pursuant to which Comerica and Citadel agreed to amend the
Original Agreement dated as of April 15, 2004 between Citadel and Comerica, to
convert $750,000 of available indebtedness under the Original Agreement from
revolving indebtedness to equipment financing. Comerica advanced this $750,000
to Citadel on December 31, 2004.





**F-17**
 Financial Table of Contents


The
Company is required to maintain its cash balances at Comerica and to meet
certain financial, non-financial and other affirmative and restrictive
covenants, including adjusted quick ratio, EBITDA as defined in the Original
Agreement and fixed charged coverage ratio. Prior to December 31, 2004 the
Company recognized that it would not be in compliance with certain of the fixed
charge and adjusted quick ratios and received a waiver from Comerica for the
default so long as Citadel and Comerica restructured the covenants on or before
February 28, 2005. Comerica and Citadel agreed to renegotiate the loan covenants
to bring them more in line with Citadel's operations. On February 28, 2005,
Citadel entered into a commitment letter with Comerica, to amend the Loan
Agreement. Under this commitment letter, Citadel and Comerica agreed to modify
the Loan Agreement's financial covenants, including a liquidity ratio test,
EBITDA requirement and a minimum cash balance on the terms set forth in the
commitment letter. In March 2005, Citadel and Comerica completed the Second
Amendment To Loan and Security Agreement (the "Second Amendment") under
substantially the same terms and conditions of the commitment letter. (See Note
R - Subsequent Events)
 
 During
2004 the Company borrowed the total $3,500,000 in proceeds under the credit
facilities to partially fund the approximately $5,000,000 of capital
expenditures during 2004. The Company made payments against the borrowings of
$183,334. Principal payments of approximately $91,667 plus accrued interest are
payable monthly until April 15, 2007. Beginning in March 2005 an additional
payment of approximately $22,727 plus accrued interest is payable monthly until
December 15, 2007. Interest accrues at a rate of 1.75% above Comerica’s prime
lending rate which was 5.50% at December 31, 2004. Of the total $3,316,666
outstanding under the lines of credit at December 31, 2004, $1,327,273 was
classified as current and the remaining $1,989,393 was classified as
long-term.
 
 Comerica
received warrants to purchase 9,881 shares of common stock in conjunction with
the Original Agreement. The warrants have a seven year term and an exercise
price of $5.06 per share. The fair value of the warrants of $45,838 was
estimated using the Black-Scholes option pricing model and has been recorded as
deferred financing fees and is being amortized to interest expense over the
thirty-six month term of the lines of credit. Under the terms of the Second
Amendment Comerica received additional warrants for 18,050 shares of common
stock at an exercise price of $1.79 per share.


**NOTE
J - OTHER NON-CURRENT LIABILITIES**





During
the year ended December 31, 2004, the Company entered into a lease agreement
with an eight year term for new office space in Dallas, Texas. The lease
agreement included a lease incentive for tenant improvements of $836,448 which
was recorded to leasehold improvements and deferred rent liability. At December
31, 2004, $104,556 was recorded as current deferred rent and $714,466 has been
recorded as a non-current liability. The current and non-current deferred rent
liabilities will be amortized as an offset to rent expense over the remaining
lease term.





**NOTE
K -**  **EXCHANGE
RIGHT**





In
February 2004, the Company’s CEO exercised an exchange right and the Company
issued 1,500,000 shares of common stock to the CEO. The exchange right was
issued to the CEO in June 2001 in connection with the CEO funding and granting a
guarantee of participation by CT Holdings, the Company's former parent, in a
bank bridge loan of an affiliate of CT Holdings. The exchange right permitted
the CEO to exchange up to 5,000,000 (pre 1:1000 reverse split) shares of the
affiliate into up to 6,000,000 shares of CT Holdings common stock including the
right to any dividends. This right resulted in a commitment by Citadel upon
exercise of the exchange right to issue up to 1,500,000 shares of Citadel common
stock. The exercise of this exchange right was conditional upon compliance with
first refusal and co-sale rights by the affiliated company and its majority
shareholder. The Company has accounted for this issuance as an increase of
$15,000 to the par value of common stock and recording an offsetting reduction
to additional paid capital.





**NOTE
L - COMMON STOCK AND WARRANTS ISSUED**  **DURING
2003**





The
January 2003 Issuance of Common Stock and Warrants:





In
January 2003, the Company entered into subscription agreements with 15
accredited investors (the “Accredited Investors”) for the sale of (i) 3,275,000
shares of common stock for gross proceeds of $2,625,000 (before approximately
$228,000 of placement agent as well as legal and accounting fees) and (ii)
warrants to buy 1,637,500 shares of common stock. The warrants have an exercise
price of $1.50 per share, expire in three years and may be terminated by the
Company, at its option, when the closing market price of the Company's common
stock has closed at or above $2.40 per share for ten consecutive trading days.
In addition, the placement agent received warrants to purchase 245,625 shares of
common stock at $1.18 per share, the closing per share price of common stock on
January 29, 2003, and have a five year term.





**F-18**
 Financial Table of Contents





The May
2003 Issuance of Common Stock and New Warrants:





On April
21, 2003, the Company issued 1,637,500 of new warrants to the Accredited
Investors plus 245,625 new warrants to the placement agent and its assignees
(collectively the "New Warrants"). The exercise price of the warrants issued to
the investors and the placement agent in the January 2003 private placement (the
"Prior Warrants") was reduced from $1.50 to $0.80 per share for a period that
ended on May 6, 2003.





In May
2003, Accredited Investors, the placement agent and the placement agent's
assignees holding Prior Warrants to purchase 1,560,559 shares of Citadel common
stock exercised their Prior Warrants, for aggregate gross proceeds of
approximately $1,248,000 to Citadel (before approximately $126,000 of placement
agent, legal and accounting fees). As a result of their exercise of the Prior
Warrants, the expiration date of the New Warrants was extended from May 6, 2003
to the earlier of April 1, 2006 or the date 10 days after the Company provides
the holders notice that the closing market price of the Company's common stock
has closed at or above $2.40 per share for ten consecutive trading days. The New
Warrants have an exercise price of $1.27 per share (the closing market price on
April 17, 2003, the last trading date prior to issuance of the New Warrants).
The remaining 322,566 New Warrants that were originally issued on April 21, 2003
expired unexercised on May 6, 2003. On May 6, 2003, the period to exercise the
Prior Warrants at a reduced price expired, and 112,500 unexercised Prior
Warrants issued to the Accredited Investors returned to an exercise price of
$1.50 per share and 210,066 unexercised Prior Warrants issued to the placement
agent returned to an exercise price of $1.18 per share. In addition, the
placement agent received warrants to purchase 39,014 shares of Citadel common
stock, based on a rate of 2.5% of 1,560,559 of New Warrants that were
outstanding on May 6, 2003. The placement agent's warrants have a per share
exercise price of $1.80, the closing price of Citadel common stock on May 6,
2003 and have a five year term. The proceeds of the transaction were used for
general working capital purposes. The Company filed a registration statement on
Form SB-2 to register the shares issued in the private placement, the shares
issued upon the exercise of Prior Warrants and the shares underlying the New
Warrants and Prior Warrants outstanding at May 6, 2003.





The
Exercise of Prior Warrants, New Warrants and Placement Agent Warrants:





As
discussed above, the New Warrants and the Prior Warrants could be terminated by
the Company, at its option, when the closing market price of the Company's
common stock had closed at or above $2.40 per share for ten consecutive trading
days. On October 31, 2003 the closing market price of the Company's common stock
had exceeded $2.40 per share for the previous ten days and as a result, the
Company notified the warrant holders of its intent to terminate the warrants on
November 10, 2003. On November 10, 2003 proceeds of approximately $2,373,000
were received from the exercise of 314,763 Prior Warrants and 1,560,559 New
Warrants for 1,875,322 shares of stock. In addition, warrants for 99,014 shares
of common stock were exercised by the placement agent for approximately $133,000
of cash proceeds. At December 31, 2004 and 2003, no Prior Warrants remain
outstanding.





The
Issuance and Conversion of 12% Senior Convertible Notes:





In
September 2003 the Company closed a debt financing transaction and received
gross proceeds of $2,120,000 and issued 12% Senior Convertible Promissory Notes
(the "Notes") to a limited number of accredited investors (the "Noteholders").
The Notes and accrued interest were due the sooner of 90 days after issuance or
10 days after the Company received at least $2,000,000 in proceeds from the sale
of equity securities. The net proceeds of the Notes were used for general
working capital purposes. In addition, the Noteholders received 848,000
restricted shares of common stock of the Company with an estimated fair value of
approximately $783,079. The debt discount was fully amortized into interest
expense during the year ended December 31, 2003. In the event of default, for
each month in default, the Noteholders, would have received warrants to purchase
one half of one share for every dollar of principal amount loaned, with an
exercise price of $0.50 per share.





**F-19**
 Financial Table of Contents





Pursuant
to the terms of the Notes, principal and accrued interest may be converted into
shares of common stock of the Company (the "Converted Shares") at a conversion
price of $1.25 per share at the option of the Noteholder at any time prior to
maturity. The difference between the effective conversion price and the
estimated fair market value of the underlying shares of approximately $1,147,479
was recorded as debt discount. This debt discount was amortized over the term of
the notes and has been fully amortized into interest expense during the year
ended December 31, 2003.





In
addition, the placement agent for this transaction received a fee of $212,000
plus warrants to purchase 125,000 shares of common stock at $1.25 per share that
had the same rights as the warrants the Noteholders may receive in the event of
default. The fee of $212,000 plus the estimated fair value of the warrants of
approximately $121,725 was recorded as debt issuance costs and has been fully
amortized to interest expense during the year ended December 31, 2003. On
September 4, 2003, the $212,000 fee plus $50,000 of unpaid fees, unrelated to
the Notes, were rolled into a 12% convertible note payable due 90 days after
issuance with the same terms and conditions as the Notes including registration
rights and default provisions. In conjunction with this note, the Company issued
104,800 shares of common stock to the placement agent having a relative fair
value of approximately $98,250. The note plus accrued interest was convertible
into shares of common stock of the Company at a conversion price of $1.25 per
share. The difference between the effective conversion price and the estimated
fair value of the underlying shares of approximately $150,650 was recorded as
debt discount has been fully amortized into interest expense during the year
ended December 31, 2003. The Company paid the note in full on December 31, 2003.





As of
December 31, 2003 holders of all $2,120,000 principal amount of the Notes had
elected to convert the Notes plus approximately $49,000 of accrued interest into
approximately 1,735,000 shares of the Company’s common stock.





The
Convertible Shareholder Notes:





On July
16, 2003 the Company entered into a $200,000, 8% note payable with a
shareholder. The note was originally due September 1, 2003 and was personally
guaranteed by the Company's Chief Executive Officer. The note was convertible
into 200,000 shares of common stock at a conversion price of $1.00 per share.
The fair value of the conversion feature of approximately $118,187 was recorded
as debt discount and was fully amortized as interest expense in the year ended
December 31, 2003. In the event of payment default the note would accrue
interest at 18% per annum. In conjunction with this note, the Company issued
50,000 shares of common stock in exchange for $500 in cash. The relative fair
value of the shares of approximately $50,687 was recorded as interest expense
during the year ended December 31, 2003. The due date of the note was later
extended by the noteholder to October 31, 2003 and 30,000 additional shares of
common stock were issued to the noteholder in exchange for $300. The Company
recorded debt discount of $39,450 representing the difference between the
proceeds of $300 and the relative fair value of the 30,000 shares of common
stock. The debt discount was fully amortized to interest expense during the year
ended December 31, 2003. In October 2003, the shareholder converted the
principal amount of the note plus $4,252 of accrued interest into 204,252 shares
of the Company’s common stock.





On July
17, 2003 the Company entered into a $250,000 8% note payable with another
shareholder. The note was originally due September 17, 2003 and was personally
guaranteed by the Company's Chief Executive Officer. A principal payment of
$50,000 was due and paid in August 2003. In conjunction with this note, the
Company issued 50,000 shares of its common stock for $500, to be offset against
accrued interest. The Company recorded a note discount of approximately $49,679
representing the difference between the proceeds of $500 and the relative fair
value of the stock. This discount was fully amortized to interest expense in the
year ended December 31, 2003. The maturity date was later extended to October
31, 2003 and the Company agreed to give the noteholder a right to convert the
note plus accrued interest into shares of common stock at a conversion price of
$1.25 per share. The difference between the effective conversion price and the
relative fair value of the shares of approximately $73,344 was recorded as a
debt discount and has been fully amortized into interest expense in the year
ended December 31, 2003. In October 2003, the shareholder converted the
principal amount of the note plus $5,962 of accrued interest into 164,769 shares
of the Company’s common stock.





**F-20**
 Financial Table of Contents





On April
1, 2002, prior to the Distribution, CT Holdings entered into a $600,000
non-interest bearing convertible note payable due April 1, 2003 to a
shareholder. The note payable was convertible at the option of the shareholder,
into a maximum of 2,700,000 shares of CT Holdings common stock and 675,000
shares of Citadel common stock. During the year ended December 31, 2003 this
note was converted and 675,000 shares of the Company's common stock were issued
to the noteholder.





**NOTE
M -**  **PREFERRED
STOCK ISSUANCE**





On
February 10, 2004 the Company completed a private placement of $15,000,000 in
gross proceeds for the issuance of 15,000 shares of its Series A Convertible
Preferred Stock ("Series A Preferred") and five-year warrants ("Warrants") for
1.2 million shares of common stock. The Series A Preferred has a maturity of
four years and is convertible into common stock of Citadel at a conversion price
of $5.00 per share, a premium over the closing price on the commitment date of
the transaction. The Series A Preferred have a liquidation preference in an
amount equal to their stated value of $1,000 per share plus accrued and unpaid
dividends, aggregating $15,187,500 at December 31, 2004. Holders of the Series A
Preferred have liquidation preference rights over common stockholders. Citadel
also has the right to automatically convert the Series A Preferred into common
stock upon achieving certain milestones. On the maturity date, the Company
shall, at its option, either (i) require that each share of the Series A
Preferred then outstanding automatically convert into shares of common stock or
(ii) pay to the holder thereof cash in the amount of the liquidation preference
for each share of Series A Preferred then outstanding. Holders of the Preferred
Shares have no voting rights with respect to the business, management or affairs
of the Company; provided that the Company shall provide each Holder with prior
notification of each meeting of stockholders.





Dividends
on the preferred stock are payable quarterly in cash at a 5% annual rate or 6%
if paid in shares of common stock at Citadel’s option and if certain milestones
are met. The company paid $477,439 of preferred stock dividends during 2004 and
had accrued dividends payable of $187,500 at December 31, 2004. The conversion
and exercise prices are subject to adjustment in certain events, and the
investor has the right to require Citadel to redeem the securities in certain
limited events.





Net
proceeds received were approximately $13,797,000 after payment of placement fees
of $1,125,000 as well as legal, accounting and filing fees of approximately
$78,000. In addition to the placement fees, the placement agents for the
transaction received warrants to purchase 225,000 shares of common stock at an
exercise price of $5.15 per share, a premium to the market price at the
commitment date, and have the same terms and conditions as the Warrants. Using
the Black-Scholes pricing model the fair value of the Series A Preferred, the
Warrants and the placement agents warrants were estimated at approximately
$11,471,000, $1,915,000 and $411,000, respectively, with the fair value of all
of the warrants recorded as a credit to additional paid in capital. The relative
fair values of the Preferred Stock and the warrants were estimated and as a
result, it was determined that the non-cash relative fair value of the
beneficial conversion feature of the Preferred Stock was approximately $985,000
which is being accreted to additional paid in capital over the four year term of
the preferred stock. Of this amount, $215,397 was accreted in the year ended
December 31, 2004.





**F-21**
 Financial Table of Contents





**NOTE
N - COMMITMENTS AND CONTINGENCIES**





Leases





As of
December 31, 2004 future minimum lease payments under non-cancelable operating
leases were as follows:





2005
    
    $
    751,6202006
    
    
    751,6202007
    
    
    657,4762008
    
    
    610,4042009
    
    
    610,404Thereafter
    
    
    1,729,478Total
    
    $
    5,111,002





At
December 31, 2004 the Company had entered into approximately $600,000 of
non-cancelable purchase orders for information technology equipment, furniture
and renovations related to the new leasehold improvements. Rent expense for the
years ended December 31, 2004 and 2003 was $522,803 and $197,282,
respectively.





Commitment
to Issue Stock





On May
17, 2002 Citadel was spun off from its former parent company, CT Holdings, Inc.
On May 1, 2002, CT Holdings reserved shares of its common stock (together with
dividends and distributions on these shares) for issuance in connection with the
settlement of certain of its liabilities to certain parties. CT Holdings has
reached settlements on all but one of the parties. Because the negotiation for
the settlement of this liability has not been concluded, and if and when
concluded, Citadel would be required to issue shares of its common stock, 12,500
shares of common stock have been held in reserve at December 31, 2004 to issue
if and when CT Holdings enters into a final settlement agreement with the
remaining party.





Guarantees





FASB
Interpretation No. 45, “Guarantor’s Accounting and Disclosure Requirements for
Guarantees, Including Indirect Guarantees of Indebtedness of Others” (FIN 45)
requires certain guarantees to be recorded at fair value and requires a
guarantor to make disclosures, even when the likelihood of making any payments
under the guarantee is remote. For those guarantees and indemnifications that do
not fall within initial recognition and measurement requirements of FIN 45, the
Company must continue to monitor the conditions that are subject to the
guarantees and indemnifications, as required under existing generally accepted
accounting principles, to identify if a loss has been incurred. If the Company
determines that it is probable that a loss has been incurred, any such estimable
loss would be recognized. The initial recognition and measurement requirements
do not apply to the Company’s product warranties or to the provisions contained
in the majority of the Company’s software license agreements that indemnify
licensees of the Company’s software from damages and costs resulting from claims
alleging that the Company’s software infringes the intellectual property rights
of a third party. The Company has not received any requests for payment under
these provisions and has not been required to make payments pursuant to these
provisions. The Company has not identified any losses that are probable under
these provisions and, accordingly, the Company has not recorded a liability
related to these indemnification provisions .





Legal
Proceedings





In
January, February and March 2005, seven virtually identical lawsuits were filed
against Citadel, Steven B. Solomon, the Chief Executive Officer and a Director
of the Company, and Richard Connelly, the Company’s Chief Financial Officer.
These suits have been consolidated in one action styled Ruth R. Lentz v. Citadel
Security Software, Inc., et al., Civil Action No. 3:05-CV-0100-D, in the United
States District Court for the Northern District of Texas. Each case was filed on
behalf of a putative class of persons and/or entities who purchased the
Company’s securities between February 12, 2004 and December 16, 2004, inclusive.
The suits seek recovery of unspecified damages under Sections 10(b) and 20(a) of
the Securities Exchange Act of 1934, as amended, and Rule 10b-5 promulgated
thereunder. The suits were filed after the Company’s announcement on December
17, 2004 that its projection of revenue and earnings for the full year 2004
would be less than previously projected. On March 15, 2005, motions for
appointment as lead plaintiff and for approval of selection of lead counsel were
filed and are pending before the Court for determination. The Company believes
these suits are without merit and intends to vigorously defend them. Currently
the Company is unable to estimate the ultimate liability, if any, related to
these suits, and therefore has not recorded a liability for these suits at
December 31, 2004.





**F-22**
 Financial Table of Contents





The
Company may become involved from time to time in litigation on various matters
which are routine to the conduct of the business. The Company believes that none
of these actions, individually or in the aggregate, will have a material adverse
effect on our financial position or results of operations, though any adverse
decision in these cases or the costs of defending or settling such claims could
have a material adverse effect on our business.





**NOTE
O - SIGNIFICANT CUSTOMERS**





The
following customers represented more than 10% of total revenue in at least one
of the years presented below:





Years
      Ended December 31,2004
    
    2003**End
      User Customer:**Defense
      Information Systems Agency
    
    
    39
    %
    
    0
    %Department
      of Veteran Affairs
    
    
    41
    %
    
    67
    %






Years Ended December 31,**Industry
      Segment:**
    
    2004
    
    2003Corporate
    
    
    12
    %
    
    3
    %Education
    
    
    1
    %
    
    2
    %Financial
      institutions
    
    
    4
    %
    
    8
    %Government
    
    
    82
    %
    
    80
    %All
      other, primarily health
    
    
    1
    %
    
    7
    %





The
Company operates in one business segment, the security software segment, but
licenses it software and offers its services to a diverse group of customers in
the Fortune 2000 in many industries, as well as, governmental agencies at the
federal, state and local levels. Although the customers listed above represent
80% of the 2004 revenue the Company does not expect to rely on any one customer,
group of customers or industry segment for a significant source of recurring
revenue. Revenue from government agencies is anticipated to continue to be the
larger portion of revenue composition by industry segment during 2005.
Therefore, any one customer or groups of customers in the same industry segment
could become a material component of revenue in any future quarter or year.
However, there is no assurance that the distribution of revenue by industry
segment or customer is representative of future revenue projections and the
Company expects that the revenue distribution by industry segment and customer
will vary markedly from period to period.





**NOTE
P - STOCK OPTIONS AND WARRANTS**





The
Company's 2002 Stock Incentive Plan (the "Plan") became effective on May 17,
2002. Under the Plan the Company may grant options to purchase shares of common
stock to eligible participants. On September 21, 2004 the Company's stockholders
approved amendments to the Plan, including an increase in the shares of common
stock reserved for issuance thereunder by 1,500,000 shares of common stock to an
aggregate of 3,000,000 shares. Eligible participants include all employees,
officers, directors and certain consultants to the Company. The Plan allows for
the grant of non-qualified or incentive stock options.





**F-23**
 Financial Table of Contents





Activity
under the Plan for the years ended December 31, 2004 and 2003 was as follows:





Outstanding OptionsOptionsavailable
      for issuance
    
    Numberof options
    
    WeightedaverageexercisepriceBalances
      at December 31, 2002
    
    
    1,066,500
    
    
    433,500
    
    $
    0.54Grants
    
    
    (998,000
    )
    
    998,000
    
    $
    1.60Exercised
    
    
    
    
    
    (160,335
    )
    $
    0.36Cancelled
    
    
    252,665
    
    
    (252,665
    )
    $
    1.00Balances
      at December 31, 2003
    
    
    321,165
    
    
    1,018,500
    
    $
    1.47Authorized
    
    
    1,500,000Grants
    
    
    (854,000
    )
    
    854,000
    
    $
    3.86Exercised
    
    
    
    
    
    (176,889
    )
    $
    1.07Cancelled
    
    
    377,611
    
    
    (377,611
    )
    $
    2.59Balances
      at December 31, 2004
    
    
    1,344,776
    
    
    1,318,000
    
    $
    2.73





The
options granted have a term of 10 years and generally vest over a period of
three years.





The table
below summarizes the range of exercise prices of options outstanding and
exercisable under the Plan at December 31, 2004:





Outstanding
      OptionsRange
      of exercise prices
    
    Numberof options
    
    Weightedaverage
      remainingcontractuallife in years
    
    Weightedaverageexerciseprice$0.32
      to $1.11
    
    
    101,000
    
    
    7.51
    
    $
    0.64$1.14
      to $1.32
    
    
    224,500
    
    
    8.34
    
    $
    1.27$1.37
      to $2.35
    
    
    297,500
    
    
    9.21
    
    $
    1.84$2.49
      to $3.05
    
    
    205,500
    
    
    9.28
    
    $
    2.64$3.13
      to $4.35
    
    
    299,500
    
    
    9.41
    
    $
    4.04$4.40
      to $6.25
    
    
    190,000
    
    
    9.30
    
    $
    5.01











Exercisable
      OptionsRange
      of exercise prices
    
    
    Numberof options
    
    Weightedaverageexerciseprice$0.32
      to $1.11
    
    
    
    72,437
    
    $
    0.64$1.14
      to $1.32
    
    
    
    138,359
    
    $
    1.29$1.37
      to $2.35
    
    
    
    79,362
    
    $
    1.78$2.49
      to $3.05
    
    
    
    31,997
    
    $
    2.60$3.13
      to $4.35
    
    
    
    2,999
    
    $
    3.92$4.40
      to $6.25
    
    
    
    -
    
    $
    -





In
addition, the Company granted options outside of the Plan. The table below
summarizes option grants and exercises outside of the Plan:





**F-24**
 Financial Table of Contents





Outstanding OptionsNumberof options
    
    WeightedaverageexercisepriceBalance
      at December 31, 2002
    
    
    5,466,667
    
    $
    0.33Grants
    
    
    2,075,000
    
    $
    1.62Exercised
    
    
    (1,095,825
    )
    $
    0.38Cancelled
    
    
    (618,342
    )
    $
    0.90Balance
      at December 31, 2003
    
    
    5,827,500
    
    $
    0.72Grants
    
    
    1,447,500
    
    $
    3.69Exercised
    
    
    (173,330
    )
    $
    0.85Cancelled
    
    
    (426,670
    )
    $
    3.25Balance
      at December 31, 2004
    
    
    6,675,000
    
    $
    1.17





The
options granted have a term of 10 years and generally vest over periods of over
periods from one to three years.





The table
below summarizes the range of exercise prices of options outstanding and
exercisable outside of the Plan at December 31, 2004:





Outstanding
    OptionsRange
      of exercise prices
    
    Numberof options
    
    Weighted
      averageremainingcontractuallife in years
    
    Weightedaverageexerciseprice$0.32
      to $0.34
    
    
    4,162,500
    
    
    7.41
    
    $
    0.33$1.11
      to $1.28
    
    
    675,000
    
    
    8.56
    
    $
    1.24$1.65
      to $2.35
    
    
    655,000
    
    
    9.08
    
    $
    1.78$2.49
      to $3.56
    
    
    730,000
    
    
    9.21
    
    $
    3.12$4.20
      to $5.15
    
    
    452,500
    
    
    9.21
    
    $
    4.74





Exercisable OptionsRange
      of exercise prices
    
    Numberof options
    
    Weightedaverageexerciseprice$0.32
      to $0.34
    
    
    4,124,989
    
    $
    0.33$1.11
      to $1.28
    
    
    675,000
    
    $
    1.24$1.65
      to $2.35
    
    
    287,500
    
    $
    1.70$2.49
      to $3.56
    
    
    88,331
    
    $
    2.90$4.20
      to $5.15
    
    
    126,665
    
    $
    4.86





The
weighted-average fair value for the options granted was approximately $3.75 and
$1.06 per share for the years ended December 31, 2004 and 2003 respectively.
This estimate was made using the Black-Scholes option pricing model with the
weighted-average assumptions shown in the table below. The weighted-average
expected volatility was based on the volatility of the trading prices for
Citadel common stock. The risk free rate presented is a weighted average based
on the daily published interest rates for treasury bills with similar maturities
as the estimated option lives.





**F-25**
 Financial Table of Contents


2004
    
    2003Expected
      dividend yield
    
    
    0.0
    %
    
    0.0
    %Risk-free
      interest rate
    
    
    2.55
    %
    
    1.76
    %Expected
      volatility
    
    
    124.0
    %
    
    115.0
    %Expected
      life (in years)
    
    
    5.0
    
    
    5.0





During
the year ended December 31, 2004 the Company agreed to modify the option
agreement to extend the exercise termination date for one terminated employee
and accordingly recognized  the
estimated fair value of the stock options of approximately $130,000 which is
included in general and administrative expense.








**F-26**
 Financial Table of Contents





During
the year ended December 31, 2003, 78,000 shares of common stock plus stock
options for 75,000 shares of common stock were issued for services rendered by
consultants to the Company. The fair value of the shares of common stock and
options was approximately $165,570 and was recorded as general and
administrative expense. In addition, the Company issued 25,000 shares of stock,
with a fair value of approximately $35,500, to a former employee in settlement
of a claim for compensation.


The
warrants issued during 2004 and 2003 were issued in conjunction with the debt
and equity financing transactions (see Notes I, L and M). The proceeds from the
exercise of warrants during the years ended December 31, 2004 and 2003 were
$216,550 and $3,629,244, respectively.




Outstanding WarrantNumberof warrants
    
    WeightedaverageexercisepriceBalance
      at December 31, 2002
    
    
    20,000
    
    $
    0.80Issued
    
    
    3,687,698
    
    $
    1.08Exercised
    
    
    (3,534,895
    )
    $
    1.07Cancelled
    
    
    (7,803
    )
    $
    1.18Balance
      at December 31, 2003
    
    
    165,000
    
    $
    1.31Issued
    
    
    1,434,881
    
    $
    5.15Exercised
    
    
    (165,000
    )
    $
    1.31Cancelled
    
    
    -
    
    $
    -Balance
      at December 31, 2004
    
    
    1,434,881
    
    $
    5.15


****


**NOTE Q
- RELATED PARTY TRANSACTIONS**





During
the year ended December 31, 2004 the Company recorded revenue of approximately
$22,000 primarily for fees from a Hercules license granted to the investment
fund that holds all 15,000 shares of convertible preferred stock issued in
February 2004 convertible into 3,000,000 shares of common stock and warrants to
purchase 1,200,000 shares of common stock. In addition, we recorded revenue of
approximately $7,300 for fees from a Hercules license sold to one of the
placement agents for the preferred stock transaction. The license fees for both
transactions were invoiced at list price with normal payment terms and the total
amounts outstanding had been collected by December 31, 2004 The Company believes
that these transactions were arms length transactions and were properly recorded
in its financial statements.





As part
of the spin off transaction in May 2002, Citadel entered into a transition
services agreement with CT Holdings, its former parent. The agreement provides
that CT Holdings and Citadel provide each other services in such areas as
information management and technology, sharing of office space, personnel and
indirect overhead expenses, employee benefits administration, payroll, financial
accounting and reporting, claims administration and reporting, and other areas
where CT Holdings and Citadel may need transitional assistance and support. The
transition services agreement provides generally that each of Citadel and CT
Holdings will undertake to provide substantially the same level of service and
use substantially the same degree of care as their respective personnel provided
and used in providing such services prior to the execution of the agreement. The
agreement generally extends for a one year term, but may be terminated earlier
under certain circumstances, including a default, and may be renewed for
additional one-year terms. In August 2004, the Board of Directors approved the
extension of the transition services agreement until May 2005. Initially, CT
Holdings agreed to pay Citadel a monthly fee of $20,000, subject to adjustment
on a quarterly basis. The fee was adjusted to $7,500 per month beginning in May
2004. The Company believes that the terms and conditions of the transition
services agreement are as favorable to Citadel as those available from unrelated
parties for a comparable arrangement. At December 31, 2004 and 2003 the Company
has recorded amounts due from CT Holdings pursuant to the transition services
agreement of $530,000 and $390,000, respectively. Due to the uncertainty of
collection the Company has expensed the fees to general and administrative
expense on a monthly basis as incurred.





**F-27**
 Financial Table of Contents





In April
2003, a CT Holdings legal claim associated with a lawsuit was settled for
$225,000 in cash. Citadel advanced $225,000 to CT Holdings in return for a
demand note payable bearing interest at 12% per year and a release for any
potential claims pertaining to the CT Holdings litigation. Since CT Holdings has
a significant cash deficiency and stockholder's deficit this demand note
receivable has been fully reserved in the second quarter of 2003 as there can be
no assurance that this note will be collected. This charge is classified as
"Write-off of note receivable from related party" in the accompanying Statements
of Operations.





During
the year ended December 31, 2004 the Company incurred legal fees in the amount
of approximately $237,000 to a law firm in which an attorney who is a partner
and who was a former CT Holdings' employee and is a relative Citadel's CEO.
During the year ended December 31, 2003 the Company recorded fees of
approximately $165,000 to this attorney.








**NOTE R
- SUBSEQUENT EVENTS**


In March
2005, Citadel entered into a Second Amendment to the Loan and Security Agreement
(the "Second Amendment ") with Comerica. Comerica and Citadel agreed to revise
the loan agreement's covenants to bring them more in line with Citadel's
operations. Under the Second Amendment, Citadel and Comerica agreed to modify
the original loan agreement's financial covenants, including a liquidity ratio
test, EBITDA requirement and a minimum cash balance. The Company is required to
maintain its cash balances at Comerica and to meet certain financial,
non-financial and other affirmative and restrictive covenants, including
liquidity ratio, EBITDA requirement and minimum cash balance. The other material
terms of the credit facilities, including interest rate, security, and final
maturity, remained the same as under the original loan agreement.
 
 Under the
terms of the Second Amendment Comerica received additional warrants for 18,050
shares of common stock at an exercise price of $1.79 per share.




**F-28**
 Financial Table of Contents





**NOTE S
- QUARTERLY INFORMATION (unaudited)**





2004 For Quarter EndedMarch
      31
    
    June
      30
    
    September
      30
    
    December
      31
    
    YearRevenueLicense
      fees
    
    $
    1,819,835
    
    $
    2,922,243
    
    $
    7,071,476
    
    $
    548,031
    
    $
    12,361,585Customer
      support and services
    
    
    502,280
    
    
    521,556
    
    
    701,988
    
    
    1,165,746
    
    
    2,891,5702,322,115
    
    
    3,443,799
    
    
    7,773,464
    
    
    1,713,777
    
    
    15,253,155Costs
      of revenue
    
    
    497,497
    
    
    582,861
    
    
    746,180
    
    
    1,005,546
    
    
    2,832,084Operating
      expenses
    
    
    3,434,885
    
    
    4,710,023
    
    
    6,043,339
    
    
    6,106,418
    
    
    20,294,665Operating
      profit (loss)
    
    
    (1,610,267
    )
    
    (1,849,085
    )
    
    983,945
    
    
    (5,398,187
    )
    
    (7,873,594
    )Interest
      (expense), other incomeand
      other (expense)
    
    
    22,885
    
    
    33,770
    
    
    12,047
    
    
    (34,133
    )
    
    34,569Income
      (loss) before income taxes
    
    
    (1,587,382
    )
    
    (1,815,315
    )
    
    995,992
    
    
    (5,432,320
    )
    
    (7,839,025
    )Provision
      for income taxes
    
    
    -
    
    
    -
    
    
    -
    
    
    -
    
    
    -Net
      income (loss)
    
    
    (1,587,382
    )
    
    (1,815,315
    )
    
    995,992
    
    
    (5,432,320
    )
    
    (7,839,025
    )Preferred
      dividends
    
    
    (102,440
    )
    
    (187,500
    )
    
    (187,500
    )
    
    (187,500
    )
    
    (664,940
    )Accretion
      of beneficial interest
    
    
    (30,771
    )
    
    (61,542
    )
    
    (61,542
    )
    
    (61,542
    )
    
    (215,397
    )Net
      income (loss) attributable to common shareholders
    
    $
    (1,720,593
    )
    $
    (2,064,357
    )
    $
    746,950
    
    $
    (5,681,362
    )
    $
    (8,719,362
    )Net
      loss per share to common shareholders-
      basic
    
    $
    (0.06
    )
    $
    (0.07
    )
    $
    0.03
    
    $
    (0.19
    )
    $
    (0.30
    )-
      diluted
    
    $
    (0.06
    )
    $
    (0.07
    )
    $
    0.02
    
    $
    (0.19
    )
    $
    (0.30
    )Weighted
      average shares outstanding-
      basic
    
    
    28,421,686
    
    
    29,467,112
    
    
    29,664,109
    
    
    29,786,137
    
    
    29,336,894-
      diluted
    
    
    28,421,686
    
    
    29,467,112
    
    
    33,932,949
    
    
    29,786,137
    
    
    29,336,894




**F-29**
 Financial Table of Contents


2003
      For Quarter EndedMarch
      31
    
    June
      30
    
    September
      30
    
    December
      31
    
    YearRevenueLicense
      fees
    
    $
    187,598
    
    $
    686,006
    
    $
    619,034
    
    $
    3,705,372
    
    $
    5,198,010Customer
      support and services
    
    
    86,332
    
    
    93,055
    
    
    110,900
    
    
    367,999
    
    
    658,286273,930
    
    
    779,061
    
    
    729,934
    
    
    4,073,371
    
    
    5,856,296Costs
      of revenue
    
    
    68,800
    
    
    143,214
    
    
    279,798
    
    
    326,936
    
    
    818,748Operating
      expenses
    
    
    1,389,394
    
    
    1,720,121
    
    
    1,684,274
    
    
    2,195,498
    
    
    6,989,287Operating
      profit (loss)
    
    
    (1,184,264
    )
    
    (1,084,274
    )
    
    (1,234,138
    )
    
    1,550,937
    
    
    (1,951,739
    )Interest
      (expense), other incomeand
      other (expense)
    
    
    (53,418
    )
    
    (292,246
    )
    
    (1,204,706
    )
    
    (1,746,472
    )
    
    (3,296,842
    )Loss
      before income taxes
    
    
    (1,237,682
    )
    
    (1,376,520
    )
    
    (2,438,844
    )
    
    (195,535
    )
    
    (5,248,581
    )Provision
      for income taxes
    
    
    -
    
    
    -
    
    
    -
    
    
    -
    
    
    -Net
      loss
    
    $
    (1,237,682
    )
    $
    (1,376,520
    )
    $
    (2,438,844
    )
    $
    (195,535
    )
    $
    (5,248,581
    )Net
      loss per share-
      basic and diluted
    
    $
    (0.07
    )
    $
    (0.06
    )
    $
    (0.11
    )
    $
    (0.01
    )
    $
    (0.24
    )Weighted
      average sharesoutstanding
      - basic and diluted
    
    
    18,300,438
    
    
    21,330,819
    
    
    22,498,271
    
    
    26,314,562
    
    
    22,134,040




**F-30**