ISS GROUP INC
S-1/A, 1998-03-02
PREPACKAGED SOFTWARE
Previous: FWT INC, S-4/A, 1998-03-02
Next: WITTER DEAN SELECT EQUITY TR SELECT 5 INDUSTRIAL PORT 98-2, 487, 1998-03-02



<PAGE>   1
 
   
     AS FILED WITH THE SECURITIES AND EXCHANGE COMMISSION ON MARCH 2, 1998
    
 
   
                                                      REGISTRATION NO. 333-44529
    
================================================================================
 
                       SECURITIES AND EXCHANGE COMMISSION
                             WASHINGTON, D.C. 20549
                             ---------------------
   
                                AMENDMENT NO. 1
    
   
                                       TO
    
 
                                    FORM S-1
                             REGISTRATION STATEMENT
                                     UNDER
                           THE SECURITIES ACT OF 1933
                             ---------------------
 
                                ISS GROUP, INC.
             (Exact name of registrant as specified in its charter)
 
<TABLE>
<S>                              <C>                              <C>
           DELAWARE                           7372                          58-2362189
(State or other jurisdiction of   (Primary Standard Industrial           (I.R.S. Employer
incorporation or organization)     Classification Code Number)        Identification Number)
</TABLE>
 
                      41 PERIMETER CENTER EAST, SUITE 660
                             ATLANTA, GEORGIA 30346
                                 (770) 395-0150
(Address, including zip code, and telephone number, including area code, of the
                   registrant's principal executive offices)
                             ---------------------
                                THOMAS E. NOONAN
                CHAIRMAN, PRESIDENT AND CHIEF EXECUTIVE OFFICER
                                ISS GROUP, INC.
                      41 PERIMETER CENTER EAST, SUITE 660
                             ATLANTA, GEORGIA 30346
                                 (770) 395-0150
 (Name, address, including zip code, and telephone number, including area code,
                             of agent for service)
                                   COPIES TO:
 
<TABLE>
<S>                                                       <C>
             CARMELO M. GORDIAN, P.C.                                   KEITH F. HIGGINS, ESQ.
               S. MICHAEL DUNN, P.C.                                  CHRISTOPHER J. AUSTIN, ESQ.
          BROBECK, PHLEGER & HARRISON LLP                                    ROPES & GRAY
          301 CONGRESS AVENUE, SUITE 1200                               ONE INTERNATIONAL PLACE
                AUSTIN, TEXAS 78701                                   BOSTON, MASSACHUSETTS 02110
                  (512) 477-5495                                            (617) 951-7000
</TABLE>
 
                             ---------------------
    APPROXIMATE DATE OF COMMENCEMENT OF PROPOSED SALE TO THE PUBLIC:  As soon as
practicable after the effective date of this Registration Statement.
    If any of the securities being registered on this Form are to be offered on
a delayed or continuous basis pursuant to Rule 415 under the Securities Act of
1933, as amended, check the following box.  [ ]
    If this Form is filed to register additional securities for an offering
pursuant to Rule 462(b) under the Securities Act, please check the following box
and list the Securities Act registration statement number of the earlier
effective registration statement for the same offering.  [ ] ------------------

    If this Form is a post-effective amendment filed pursuant to Rule 462(c)
under the Securities Act, check the following box and list the Securities Act
registration statement number of the earlier effective registration statement
for the same offering.  [ ] ------------------

    If this Form is a post-effective amendment filed solely to add exhibits to a
registration statement, check the following box and list the Securities Act
registration statement number of the earlier effective registration statement
for the same offering.  [ ] ------------------

    If delivery of the prospectus is expected to be made pursuant to Rule 434,
please check the following box.  [ ]
                             ---------------------
                        CALCULATION OF REGISTRATION FEE
 
   
<TABLE>
<CAPTION>
=======================================================================================================================
                                                                PROPOSED            PROPOSED
                                                                 MAXIMUM             MAXIMUM
        TITLE OF EACH CLASS OF              AMOUNT TO        OFFERING PRICE         AGGREGATE           AMOUNT OF
     SECURITIES TO BE REGISTERED        BE REGISTERED(1)      PER SHARE(2)      OFFERING PRICE(2)  REGISTRATION FEE(3)
- -----------------------------------------------------------------------------------------------------------------------
<S>                                     <C>                <C>                  <C>                <C>
Common Stock, $0.001 par value........  3,450,000 shares         $16.00            $55,200,000           $16,284
=======================================================================================================================
</TABLE>
    
 
   
(1) Includes 450,000 shares that the Underwriters have the option to purchase to
    cover over-allotments, if any.
    
(2) Estimated solely for the purpose of computing the amount of the registration
    fee pursuant to Rule 457(a).
   
(3) At the time of the original filing on January 20, 1998, the registrant paid
    $9,330 of this amount.
    
 
    THE REGISTRANT HEREBY AMENDS THIS REGISTRATION STATEMENT ON SUCH DATE OR
DATES AS MAY BE NECESSARY TO DELAY ITS EFFECTIVE DATE UNTIL THE REGISTRANT SHALL
FILE A FURTHER AMENDMENT THAT SPECIFICALLY STATES THAT THIS REGISTRATION
STATEMENT SHALL THEREAFTER BECOME EFFECTIVE IN ACCORDANCE WITH SECTION 8(A) OF
THE SECURITIES ACT OF 1933, AS AMENDED, OR UNTIL THE REGISTRATION STATEMENT
SHALL BECOME EFFECTIVE ON SUCH DATE AS THE SECURITIES AND EXCHANGE COMMISSION,
ACTING PURSUANT TO SUCH SECTION 8(A), MAY DETERMINE.
 
================================================================================
<PAGE>   2
 
     INFORMATION CONTAINED HEREIN IS SUBJECT TO COMPLETION OR AMENDMENT. A
     REGISTRATION STATEMENT RELATING TO THESE SECURITIES HAS BEEN FILED WITH THE
     SECURITIES AND EXCHANGE COMMISSION. THESE SECURITIES
     MAY NOT BE SOLD NOR MAY OFFERS TO BUY BE ACCEPTED PRIOR TO THE TIME THE
     REGISTRATION STATEMENT BECOMES EFFECTIVE. THIS PROSPECTUS SHALL NOT
     CONSTITUTE AN OFFER TO SELL OR THE SOLICITATION OF ANY OFFER TO BUY
     NOR SHALL THERE BE ANY SALE OF THESE SECURITIES IN ANY STATE IN WHICH SUCH
     OFFER, SOLICITATION OR SALE WOULD BE UNLAWFUL PRIOR TO REGISTRATION OR
     QUALIFICATION UNDER THE SECURITIES LAWS OF ANY SUCH STATE.
 
   
                   SUBJECT TO COMPLETION, DATED MARCH 2, 1998
    
   
                                3,000,000 SHARES
    
 
                        [INTERNET SECURITY SYSTEMS LOGO]
 
                                ISS GROUP, INC.
                                  COMMON STOCK
                          (PAR VALUE $0.001 PER SHARE)
                             ----------------------
   
     Of the 3,000,000 shares of Common Stock offered hereby, 2,685,000 shares
are being sold by the Company and 315,000 shares are being sold by the Selling
Stockholders. See "Principal and Selling Stockholders". The Company will not
receive any of the proceeds from the sale of the shares being sold by the
Selling Stockholders.
    
 
   
     Prior to this Offering, there has been no public market for the Common
Stock of the Company. It is currently estimated that the initial public offering
price per share will be between $14.00 and $16.00. For factors to be considered
in determining the initial public offering price, see "Underwriting".
    
 
   
     SEE "RISK FACTORS" BEGINNING ON PAGE 6 FOR CERTAIN CONSIDERATIONS RELEVANT
TO AN INVESTMENT IN THE COMMON STOCK.
    
 
   
     The Common Stock has been approved for quotation on the Nasdaq National
Market under the symbol "ISSX", subject to official notice of issuance.
    
                             ----------------------
    THESE SECURITIES HAVE NOT BEEN APPROVED OR DISAPPROVED BY THE SECURITIES
       AND EXCHANGE COMMISSION OR ANY STATE SECURITIES COMMISSION NOR HAS
         THE SECURITIES AND EXCHANGE COMMISSION OR ANY STATE SECURITIES
      COMMISSION PASSED UPON THE ACCURACY OR ADEQUACY OF THIS PROSPECTUS.
           ANY REPRESENTATION TO THE CONTRARY IS A CRIMINAL OFFENSE.
                             ----------------------
 
<TABLE>
<CAPTION>
                                       INITIAL PUBLIC   UNDERWRITING   PROCEEDS TO    PROCEEDS TO SELLING
                                       OFFERING PRICE   DISCOUNT(1)     COMPANY(2)       STOCKHOLDERS
                                       --------------   ------------   -----------    -------------------
<S>                                    <C>              <C>            <C>            <C>
Per Share............................   $               $              $                 $
Total(3).............................   $               $              $                 $
</TABLE>
 
- ---------------
 
(1) The Company and the Selling Stockholders have agreed to indemnify the
    Underwriters against certain liabilities, including liabilities under the
    Securities Act of 1933.
 
   
(2) Before deducting estimated expenses of $850,000 payable by the Company.
    
 
   
(3) The Company and the Selling Stockholders have granted the Underwriters an
    option for 30 days to purchase up to an additional 450,000 shares at the
    initial public offering price per share, less the underwriting discount,
    solely to cover over-allotments, if any, of which an option to purchase
    385,000 shares has been granted by the Company and an option to purchase
    65,000 shares has been granted by the Selling Stockholders. The Company will
    not receive any proceeds from the sale of shares by the Selling
    Stockholders. If such option is exercised in full, the total initial public
    offering price, underwriting discount, proceeds to Company and proceeds to
    Selling Stockholders will be $       , $       , $       , and
    $       ,respectively. See "Principal and Selling Stockholders" and
    "Underwriting".
    
                             ----------------------
     The shares offered hereby are offered severally by the Underwriters, as
specified herein, subject to receipt and acceptance by them and subject to their
right to reject any order in whole or in part. It is expected that certificates
for the shares will be ready for delivery in New York, New York, on or about
               , 1998, against payment therefor in immediately available funds.
 
GOLDMAN, SACHS & CO.
                BANCAMERICA ROBERTSON STEPHENS
 
                               UBS SECURITIES
 
                                           WESSELS, ARNOLD & HENDERSON
                             ----------------------
               The date of this Prospectus is             , 1998.
<PAGE>   3
 
   
                 [Graphic with Company Logo and Product Logos]
    
 
     Firecell, Fireblanket, Firewall Scanner, Internet Scanner, Internet
Security Systems, Intranet Scanner, ISS, SAFEsuite, System Security Scanner, S3,
Web Security Scanner and the ISS logo are trademarks of the Company. All other
trademarks or trade names referred to in this Prospectus are the property of
their respective owners.
 
     The Company intends to furnish to its stockholders annual reports
containing audited financial statements examined by its independent auditors.
                             ---------------------
 
     CERTAIN PERSONS PARTICIPATING IN THIS OFFERING MAY ENGAGE IN TRANSACTIONS
THAT STABILIZE, MAINTAIN OR OTHERWISE AFFECT THE PRICE OF THE COMMON STOCK,
INCLUDING OVER-ALLOTMENT, STABILIZING AND SHORT-COVERING TRANSACTIONS IN SUCH
SECURITIES, AND THE IMPOSITION OF A PENALTY BID, IN CONNECTION WITH THE
OFFERING. FOR A DESCRIPTION OF THESE ACTIVITIES, SEE "UNDERWRITING".
                                        2
<PAGE>   4
INDUSTRY-LEADING PROTECTION WITH SAFESUITE


INTERNET SECURITY SYSTEMS (ISS) applies its comprehensive security risk
knowledge base to the security management process, and is a leader in security
detection and response technologies. ISS offers enterprise-wide network
protection through the Adaptive Security Management model - utilizing
SAFEsuite to monitor suspicious activity, detect security weaknesses and
threats, and respond to security risk in information networks.

ISS SAFESUITE is a policy management driven enterprise software solution
consisting of three integrated applications: REALSECURE, a real-time intrusion
detection and response system designed to monitor networks for suspicious
activity; INTERNET SCANNER, a security vulnerability detection and analysis
system designed to recognize and respond to security weaknesses in
applications, operating systems and network services; and SYSTEM SECURITY
SCANNER(S3), a host-based security system designed to detect and react to
internal vulnerabilities in operating systems.

   
         [Product Flow Chart Graphic Depicting Deployment of RealSecure]
    

                  Real-time intrusion detection and response
               High speed Digital FingerPrint attack recognition
                        Automatically respond to threats
<PAGE>   5
   
      [Product Flow Chart Graphic Depicting Internet Scanner Deployment]
    

               Comprehensive vulnerability detection and analysis
                   Corrective action for security weaknesses
                         Intuitive graphical reporting



   
  [Product Flow Chart Graphic Depicting System Security Scanner Deployment]
    



                     Complete host-based security assesment
                  System integrity and configuration analysis
                      Automated vulnerability corrections







                  
<PAGE>   6
 
                               PROSPECTUS SUMMARY
 
     The following summary should be read in conjunction with, and is qualified
in its entirety by, the more detailed information and the Consolidated Financial
Statements and Notes thereto appearing elsewhere in this Prospectus. Except as
otherwise noted, all information in this Prospectus, including share and per
share information, assumes (i) the mandatory conversion into Common Stock of all
outstanding shares of Series A and Series B Redeemable, Convertible Preferred
Stock (the "Convertible Preferred Stock") upon the consummation of the Offering,
(ii) no exercise of stock options after December 31, 1997 and (iii) no exercise
of the Underwriters' over-allotment option. Unless the context otherwise
requires, the terms "Internet Security Systems", "ISS" and the "Company" refer
to ISS Group, Inc. and its consolidated subsidiaries. See "Description of
Capital Stock" and "Underwriting".
 
                                  THE COMPANY
 
     Internet Security Systems is the leading provider of network security
monitoring, detection and response software that protects the security and
integrity of enterprise information systems. The Company's SAFEsuite family of
products enforces "best practice" information protection automatically across
distributed computing environments by monitoring and responding to continuously
changing network security risks. By dynamically detecting and responding to the
security vulnerabilities and real-time threats inherent in open systems,
SAFEsuite products protect distributed computing environments, including
internal corporate networks, extranets and the Internet, from attacks, misuse
and security policy violations. The Company's products rely on an innovative
Adaptive Security Management ("ASM") approach to network security, which entails
continuous security risk monitoring and response to develop and enforce an
active network security policy. ISS pioneered the technology for vulnerability
and threat detection through a dedicated security research and development team
and believes that it has the most comprehensive vulnerability and threat
database in existence. The Company has delivered its network security
monitoring, detection and response solutions to over 1,500 organizations
worldwide, including firms in the Global 2000, U.S. and international government
agencies and major universities. Nine of the ten largest commercial banks in the
United States have licensed the Company's products.
 
     The proliferation of client/server architectures, the growth of the
Internet as a business tool and the emergence of intranets have dramatically
increased the openness of distributed computing environments. Although open
computing environments have many business advantages, their accessibility and
the relative anonymity of users makes these systems, and the integrity of the
information that is stored on them, vulnerable to security threats. According to
the 1997 Annual Information Week/Ernst & Young LLP Information Security Survey
of information technology ("IT") managers and professionals, 42% of all United
States respondents reported malicious acts from external sources, up from 16% in
the previous year, and 43% reported malicious acts by employees, compared with
29% in the previous year. The conflict between the benefits of open systems that
provide easy access to corporate information and the need to protect
mission-critical information and applications from unauthorized use and
disruption requires solutions that allow organizations to implement, enforce and
evaluate an informed security policy.
 
     ISS has developed ASM, a dynamic, process-driven approach to
enterprise-wide network protection. The ASM process relies on the principles of
monitoring, detection and response to the ever-changing vulnerabilities in and
threats to the network protocols, operating systems and applications that
comprise every network system. The Company's monitoring, detection and response
products provide easy-to-use software solutions designed to enable network
managers to centrally define and manage an enterprise-wide security policy for
their existing network system infrastructure, including all Internet protocol-
enabled devices. The Company's SAFEsuite family of products provides the ability
to visualize, measure and analyze real-time security vulnerabilities and control
threats across the entire enterprise network infrastructure, keeping the
organization's IT personnel informed of changing network conditions and
automatically making adjustments as necessary. Through custom policies or by
using the Company's "best-practice" templates, network managers can minimize
security risks without closing off the
 
                                        3
<PAGE>   7
 
organization's network to the benefits of open computing environments and the
Internet. The Company's products extend across a broad range of platforms and
work with the products of leading security and network management vendors to
provide a single point of management and control for an enterprise-wide security
policy across multiple hosts, operating systems and applications. Through the
Company's senior research and development team of security experts known as the
"X-Force", ISS maintains a proprietary and comprehensive knowledge base of
computer exploits and attack methods, including what the Company believes is the
most extensive collection of Windows NT vulnerabilities and threats.
 
     The Company's objective is to be the leading provider of ASM systems that
proactively protect the integrity and security of enterprise-wide information
systems from vulnerabilities, misuse, attacks and other policy violations. ISS
focuses on developing innovative and automated software solutions to provide
customers with a comprehensive framework for protecting their networks by
monitoring for vulnerabilities and real-time threats in order to enforce "best
practice" network and system security policies. The Company is seeking to meet
its objective by continuing its leadership position in security technology,
expanding its domestic sales channels, promoting its professional services
capabilities, expanding its international operations and creating ASM category
awareness.
 
   
     The Company has only a limited operating history upon which an evaluation
of its business and prospects can be based. From its inception through December
31, 1997, the Company's aggregate revenues were less than $19.0 million.
Furthermore, the Company has experienced net losses in each of its three prior
fiscal years and does not expect to achieve profitability in the foreseeable
future. To date, the Company has derived a majority of its revenues from
software licenses and related maintenance fees and services for its Internet
Scanner product; and in 1997, over 80% of the Company's revenues were derived
from that product. The market for the Company's products is in its early stage
and there can be no assurance that the market will grow, or even if it does
grow, that businesses and other organizations will adopt the Company's products.
See "Risk Factors" for further discussion of these and other considerations
relevant to an investment in the shares of Common Stock offered hereby.
    
 
     The Company was incorporated under the laws of Delaware on December 8, 1997
as a holding company for Internet Security Systems, Inc., a Georgia corporation
incorporated on April 19, 1994. Prior to incorporation in Georgia, the Company
operated as an unincorporated association and distributed its first product as
shareware in 1992. The Company's principal executive offices are located at 41
Perimeter Center East, Suite 660, Atlanta, Georgia 30346. Its telephone number
at that location is (770) 395-0150.
 
                                  THE OFFERING
 
   
<TABLE>
<S>                                                       <C>
Common Stock offered by the Company.....................  2,685,000 shares
Common Stock offered by the Selling Stockholders........  315,000 shares
Common Stock to be outstanding after the Offering.......  16,368,928 shares(1)
Proposed Nasdaq National Market symbol..................  ISSX
Use of proceeds.........................................  For general corporate purposes,
                                                          including working capital and
                                                          possible acquisitions. See "Use of
                                                          Proceeds".
</TABLE>
    
 
- ---------------
 
   
(1) Excludes 1,863,850 shares of Common Stock issuable upon exercise of options
    outstanding at December 31, 1997. See "Management -- Board of Directors" and
    "-- Restated 1995 Stock Incentive Plan", "Certain Transactions" and Note 6
    of Notes to Consolidated Financial Statements.
    
 
                                        4
<PAGE>   8
 
                      SUMMARY CONSOLIDATED FINANCIAL DATA
 
     The following table sets forth certain consolidated financial data for the
Company. This information should be read in conjunction with the Consolidated
Financial Statements and Notes thereto appearing elsewhere in this Prospectus.
See "Management's Discussion and Analysis of Financial Condition and Results of
Operations".
 
   
<TABLE>
<CAPTION>
                                                    APRIL 19, 1994
                                                      (INCEPTION)       YEAR ENDED DECEMBER 31,
                                                        THROUGH        -------------------------
                                                   DECEMBER 31, 1994   1995     1996      1997
                                                   -----------------   -----   -------   -------
                                                       (IN THOUSANDS, EXCEPT PER SHARE DATA)
<S>                                                <C>                 <C>     <C>       <C>
STATEMENT OF OPERATIONS DATA:
Revenues.........................................        $  38         $ 257   $ 4,462   $13,467
Operating income (loss)..........................           20          (140)   (1,205)   (4,147)
Net income (loss)................................           20          (140)   (1,131)   (3,919)
Basic and diluted net income (loss) per
  share(1).......................................           --          (.03)     (.14)     (.50)
Weighted average shares used in basic and diluted
  net income (loss) per share calculation(1).....        4,586         5,001     7,916     7,907
Unaudited pro forma net loss per share(1)........                                        $  (.29)
Unaudited weighted average shares used in
  unaudited pro forma net loss per share
  calculation(1).................................                                         13,644
</TABLE>
    
 
   
<TABLE>
<CAPTION>
                                                                   DECEMBER 31, 1997
                                                        ---------------------------------------
                                                                                   PRO FORMA AS
                                                        HISTORICAL   PRO FORMA(2)  ADJUSTED(3)
                                                        ----------   ------------  ------------
                                                                    (IN THOUSANDS)
<S>                                                     <C>          <C>           <C>
BALANCE SHEET DATA:
Cash and cash equivalents.............................   $ 3,929          $ 3,929       $40,535
Working capital.......................................     2,272            2,272        38,878
Total assets..........................................     9,866            9,866        46,472
Long-term debt, net of current portion................        70               70            70
Convertible Preferred Stock...........................     8,878               --            --
Stockholders' equity (deficit)........................    (5,058)           3,820        40,426
</TABLE>
    
 
- ---------------
 
   
(1) See Note 1 of Notes to Consolidated Financial Statements for the
    determination of shares used in computing basic and diluted net income
    (loss) per share and unaudited pro forma net loss per share. Pro forma net
    loss per share is not included for periods prior to 1997 because such
    comparisons are not meaningful due to the conversion of all outstanding
    shares of Convertible Preferred Stock into Common Stock upon consummation of
    the Offering.
    
 
(2) Reflects the conversion of all Convertible Preferred Stock into an aggregate
    of 5,736,957 shares of Common Stock upon consummation of the Offering. See
    Note 4 of Notes to Consolidated Financial Statements.
 
   
(3) Pro forma as adjusted gives effect to the sale by the Company of 2,685,000
    shares of Common Stock offered hereby after deducting estimated underwriting
    discounts and commissions and estimated offering expenses payable by the
    Company. See "Use of Proceeds".
    
 
                                        5
<PAGE>   9
 
                                  RISK FACTORS
 
     In addition to the other information in this Prospectus, prospective
purchasers of the Common Stock offered hereby should carefully consider the
following factors in evaluating the Company and its business.
 
LIMITED OPERATING HISTORY; HISTORY OF LOSSES
 
     The Company was incorporated in April 1994 and has never achieved
profitability, nor does the Company expect to achieve profitability in the
foreseeable future. Accordingly, the Company has only a limited operating
history upon which an evaluation of the Company and its prospects can be based
and is subject to all of the risks inherent in the establishment of a new
business enterprise. The Company's prospects must be considered in light of the
risks, expenses and difficulties frequently encountered by companies in their
early state of development, particularly companies in new and rapidly evolving
markets. To address these risks, the Company must, among other things, respond
to competitive developments, continue to upgrade and expand its product
offerings and continue to attract, retain and motivate qualified personnel.
There can be no assurance that the Company will be successful in addressing such
risks, that the Company's revenue growth will continue in the future or that the
Company will achieve profitability in the future or, if achieved, that the
Company could maintain such profitability on a quarterly or annual basis. See
"Management's Discussion and Analysis of Financial Condition and Results of
Operations".
 
SIGNIFICANT POTENTIAL FLUCTUATIONS IN FUTURE OPERATING RESULTS
 
   
     The Company's future revenues and operating results are uncertain and are
expected to fluctuate from quarter to quarter and from year to year due to a
combination of factors, including the level of demand for the Company's
products, the volume and timing of orders, the level of product and price
competition, the Company's ability to expand its domestic and international
sales and marketing organizations, the Company's ability to develop new and
enhanced products and control costs, the Company's ability to attract and retain
key technical, sales and managerial personnel, the mix of distribution channels
through which the Company's products are sold, the growth in the acceptance of,
and activity on, the Internet and World Wide Web ("Web"), particularly by
corporate, institutional and government users, the growth of private Internet
protocol ("IP") networks (or "intranets"), the extent to which unauthorized
access and use of online information is perceived as a threat to network
security, customer budgets, seasonal trends in customer purchasing, foreign
currency exchange rates and general economic factors. As the Company
increasingly focuses on sales of the Company's product suite rather than
individual products, the Company expects that the sales cycle associated with
the purchase of the Company's products will lengthen. In addition, the amount of
revenues associated with particular licenses can vary significantly based upon
the number of products that are licensed and the number of devices involved in
the installation. The Company has experienced, and may continue to experience
from time to time, large individual license sales which can cause significant
variations in quarterly license revenues. Moreover, small delays in customer
orders can cause significant variability in the Company's license revenues and
results of operations for any particular period. As a result, the timing of
significant orders is unpredictable and, like many software companies, the
Company typically realizes a significant portion of its software license
revenues in the last month of a quarter. The Company establishes its expenditure
levels for product development, sales and marketing and other operating expenses
based, in large part, on its expected future revenues. As a result, if revenues
fall below expectations, operating results and net income are likely to be
adversely and disproportionately affected because only a small portion of the
Company's expenses vary with its revenues.
    
 
     Based upon all of the foregoing, the Company believes that the Company's
quarterly and annual revenues, expenses and operating results are likely to vary
significantly in the future and that period-to-period comparisons of its results
of operations are not necessarily meaningful and, in any event, such comparisons
should not be relied upon as indications of future performance. Moreover,
although the Company's revenues have increased in recent periods, there can be
no assurance that the Company's
                                        6
<PAGE>   10
 
   
revenues will grow in future periods, that they will grow at past rates or that
the Company will achieve profitability on a quarterly or annual basis. Due to
the foregoing or other factors, it is likely that the Company's operating
results may be below market analysts' expectations in some future quarters,
which could materially and adversely affect the market price of the Common
Stock. See "Selected Consolidated Financial Data" and "Management's Discussion
and Analysis of Financial Condition and Results of Operations -- Selected
Quarterly Financial Results".
    
 
COMPETITION
 
     The market for security monitoring, detection and response products and
services is intensely competitive and the Company expects competition to
increase further in the future. There can be no assurance that the Company can
maintain its competitive position against current and potential competitors,
especially those with significantly greater financial, marketing, service,
support, technical and other competitive resources.
 
   
     The Company's principal competitors generally fall within one of three
categories: internal IT departments or consulting firms that assist such
departments, relatively smaller software companies that offer applications with
limited scope and larger software companies that are either in the process of
entering the Company's market or have the potential to develop products to
compete with the Company's products. Due to a lack of awareness of the Company's
products and services or a lack of appreciation of the complexity involved in
the development of automated systems to establish and, more importantly,
maintain comprehensive and effective levels of security within a distributed
computing environment, potential customers often rely on their IT departments to
internally formulate security systems or to retain consultants to undertake such
a project. Second, there are a number of companies that currently market or have
under development software applications to provide network and Internet
security. The Company expects additional competition from these established
competitors and from other emerging companies. Mergers or consolidations among
these competitors or acquisitions of these competitors by larger companies would
make them more formidable competitors to the Company. Recently both Cisco
Systems and Network Associates have announced acquisitions of companies with
products that compete with some of the Company's current product offerings. Many
of these larger companies have longer operating histories, greater name
recognition, access to larger customer bases and significantly greater
financial, technical and marketing resources than the Company. As a result, they
may be able to adapt more quickly to new or emerging technologies and changes in
customer requirements or to devote greater resources to the promotion and sale
of their products than the Company. If these companies were to introduce
products that effectively competed with the Company's products, they could be in
a position to substantially lower the price of their security monitoring,
detection and response products or to bundle such products with their other
products, which would make it more difficult for the Company to compete with
them. There can be no assurance that the Company's current and potential
competitors will not develop security monitoring, detection and response
products that may be more effective than the Company's current or future
products or that the Company's technologies and products will not be rendered
obsolete by such developments. Finally, there are a number of companies,
including Axent Technologies, that currently market and sell various software
products, such as encryption, firewalls, operating system security and virus
detection software, that have been broadly adopted by the Company's customers
and potential customers to provide various levels of security within their
computing environments. Some of these companies have released products which
provide similar functionality as certain of the Company's products. In addition,
vendors of operating system software or networking hardware may in the future
enhance their products to include functionality that is currently provided by
the Company's products. The widespread inclusion of the functionality of the
Company's software as standard features of operating system software or
networking hardware could render the Company's products obsolete and
unmarketable, particularly if the quality of such functionality were comparable
to that of the Company's products. Even if the security monitoring, detection
and response functionality provided as standard features by operating system
software or networking hardware is more limited than that of the Company's
software, there can be no assurance that a significant number of customers would
not elect to accept more limited functionality in lieu of purchasing additional
software.
    
                                        7
<PAGE>   11
 
     For the foregoing reasons, there can be no assurance that the Company will
be able to compete successfully against its current and future competitors.
Increased competition may result in price reductions, reduced gross margins and
loss of market share, any of which would materially and adversely affect the
Company's business, operating results and financial condition. See "Business --
Competition".
 
RAPID TECHNOLOGICAL CHANGE AND NEW PRODUCTS
 
     The market for the Company's products is characterized by rapid
technological advances, including by those seeking to establish more secure
systems and those seeking to compromise such systems, evolving industry
standards in computer hardware and software technology, changes in customer
requirements and frequent new product introductions and enhancements. As a
result, the Company must continually change and improve its products in response
to changes in operating systems, application and networking software, computer
and communications hardware, programming tools and computer language technology.
In particular, the market for Internet and intranet software applications has
only recently begun to develop and is rapidly evolving. Therefore, the Company's
future success will depend upon its ability to continue to enhance its current
product line and to develop and introduce new products that adequately address
and respond to innovations in computer hacking methodologies, keep pace with
technological developments, satisfy increasingly sophisticated customer
requirements and achieve market acceptance. There can be no assurance that the
Company will be successful in developing and marketing, on a timely and
cost-effective basis, fully functional product enhancements or new products that
respond to technological advances by computer hackers and other unauthorized
users of online information, or that its new products will achieve market
acceptance. If the Company does not respond adequately to the need to develop
and introduce new products or enhancements of existing products in a timely
manner, the Company's business, operating results and financial condition would
be materially and adversely affected. See "Business -- Product Development".
 
   
     As a result of the complexities inherent in the security of distributed
computing environments and the broad functionality and performance demanded by
customers for such products, major new product enhancements and new products can
require long development and testing periods to achieve market acceptance. The
Company has on occasion experienced delays in the scheduled introduction of new
and enhanced products. In addition, software programs as complex as those
offered by the Company may contain undetected errors or "bugs" when first
introduced or as new versions are released that, despite testing by the Company,
are discovered only after a product has been installed and used by customers.
The deployment and use of the Company's products by one or more customers, if
not properly completed, has resulted in the past and may result in the future in
temporary disruptions to the operation of the customer's networking system,
which may adversely affect the Company's relationship with such customers. There
can be no assurance that errors will not be found in future releases of the
Company's software, or that any such errors will not impair the market
acceptance of these products and materially and adversely affect the Company's
business, operating results and financial condition.
    
 
     The processes and methodologies used by computer hackers to access or
sabotage networks and intranets are ever changing and generally not recognized
until launched against one or more targets. Therefore, the Company, in most
cases, is unable to anticipate these processes and methodologies. To the extent
that customers' computing environments are compromised, such customers may
perceive the Company's products as ineffective in protecting their systems,
which may result in a reduction in orders from such customers and the loss of
customer goodwill, which could adversely affect the Company's business,
operating results and financial condition.
 
MANAGEMENT OF GROWTH
 
     The Company's business has grown rapidly in the last three years, with
total revenues increasing from $257,000 in 1995 to over $13 million in 1997 and
the total number of employees increasing from seven in 1995 to 141 in 1997. This
expansion has resulted in substantial growth in the scope of the Company's
infrastructure, including operating and financial applications and the
geographic area of its
                                        8
<PAGE>   12
 
operations and customers. Recent rapid growth has placed and, if such growth
continues, is expected to continue to place, a significant strain on the
Company's management and operations. In particular, the Company is in the
process of upgrading its internal financial and reporting systems to enhance
management's ability to obtain and more timely analyze information derived from
its domestic and international operations. There can be no assurance, however,
that the Company's existing or future controls, systems or procedures will be
adequate to support the Company's operations. The Company's ability to manage
its future growth, if any, will require the Company to continually improve its
financial and management controls, reporting systems and procedures on a timely
basis, implement new systems as necessary and expand, train and manage its
employee workforce. There can be no assurance that the Company will be able to
manage any future expansion successfully, and any inability to do so would have
a material adverse effect on the Company's business, operating results and
financial condition. See "Management's Discussion and Analysis of Financial
Condition and Results of Operations -- Overview".
 
   
RISKS ASSOCIATED WITH THE EMERGING MARKET FOR SECURITY MONITORING, DETECTION AND
RESPONSE PRODUCTS
    
 
   
     The market for the Company's products is rapidly evolving. There can be no
assurance that Internet protocols will continue to be used to facilitate
communications or that the market for security monitoring, detection and
response systems in general will continue to expand. Continued growth of this
market will depend, in large part, upon the continued expansion of Internet
usage and in the number of organizations adopting or expanding intranets, the
ability of their respective infrastructures to support an increasing number of
users and services, the public recognition of the potential threat posed by
computer hackers and other unauthorized users and the continued development of
new and improved services for implementation across the Internet and between the
Internet and intranets. If the necessary infrastructure or complementary
products and services are not developed in a timely manner and, consequently,
the market for products to monitor Internet and intranet security fails to grow
or grows more slowly than the Company currently anticipates, the Company's
business, operating results and financial condition would be materially and
adversely affected. See "Business -- Industry Background".
    
 
   
     Although the demand for Internet security systems and firewalls has grown
in recent years, the market for security monitoring, detection and response
software is still nascent and there can be no assurance that this market will
grow or that, even if the market does grow, businesses will adopt the Company's
products. Historically, network and Internet security monitoring, detection and
response has been addressed by applications and solutions that have largely been
developed by the internal IT departments of organizations having large computing
systems with a particular need for such products, including the U.S. Government,
banking and financial institutions, technology firms and universities. In
addition, many organizations do not separately budget for information security
products. The Company has spent, and intends to continue to spend, considerable
resources educating potential customers about the vulnerabilities associated
with their Internet, intranet and networking systems and about the features and
functions of the Company's SAFEsuite products. However, there can be no
assurance that such expenditures will enable SAFEsuite products to achieve any
additional degree of market acceptance, and if the market for SAFEsuite products
fails to grow or grows more slowly than the Company currently anticipates, the
Company's business, operating results and financial condition would be
materially and adversely affected. See "Management's Discussion and Analysis of
Financial Condition and Results of Operations" and "Business -- Sales and
Marketing" and " -- Competition".
    
 
PRODUCT CONCENTRATION
 
     The Company currently derives a majority of its revenues from software
licenses and related maintenance fees and services for its Internet Scanner
product. In 1997, the Company derived over 80% of its revenues from Internet
Scanner and the Company expects that Internet Scanner-related revenues,
including maintenance contracts, will continue to account for a majority of the
Company's revenues for the foreseeable future. As a result, the Company's future
operating results are dependent upon continued market acceptance of Internet
Scanner and enhancements thereto. There can be no assurance
 
                                        9
<PAGE>   13
 
that Internet Scanner will achieve continued market acceptance or that the
Company will be successful in marketing its SAFEsuite products or product
enhancements. A decline in demand for, or market acceptance of, Internet Scanner
as a result of competition, technological change or other factors would have a
material adverse effect on the Company's business, operating results and
financial condition.
 
INTERNATIONAL OPERATIONS
 
     The Company derived approximately 4% and 21% of its total revenues from
sales to customers outside North America in 1996 and 1997, respectively. The
Company opened sales offices in Belgium in February 1996, Japan in February
1997, England in April 1997, France in April 1997 and Canada in December 1997,
and believes that its future growth will require continued expansion of its
operations in international markets. In order to expand internationally, the
Company must establish additional foreign operations and hire additional
personnel. To the extent that the Company is unable to do so in a timely and
effective manner, the Company's growth, if any, in international sales will be
limited, and the Company's business, operating results and financial condition
could be materially and adversely affected. To date, the Company's revenues from
international operations have primarily been denominated in United States
dollars, although some sales have been denominated in foreign currencies. An
increase in the value of the United States dollar relative to foreign currencies
would make the Company's products more expensive and, therefore, potentially
less competitive in those markets. In addition, even if international operations
are successfully expanded, there can be no assurance that the Company will be
able to maintain or increase international market demand for its products.
 
     The Company's international operations are subject to risks inherent in
international business activities, including, in particular, management of an
organization spread over various countries, longer accounts receivable payment
cycles in certain countries, compliance with a variety of foreign laws and
regulations, unexpected changes in regulatory requirements, overlap of different
tax structures, foreign currency exchange rate fluctuations, import and export
licensing requirements, trade restrictions, changes in tariff and freight rates
and regional economic conditions. There can be no assurance that such factors
will not have a material adverse effect on the Company's future international
sales and, consequently, the Company's business, operating results and financial
condition. See "Management's Discussion and Analysis of Financial Condition and
Results of Operations" and "Business -- Sales and Marketing".
 
INCREASING RELIANCE ON INDIRECT DISTRIBUTION CHANNELS
 
   
     Although direct sales to date have accounted for a majority of the
Company's revenues, ISS expects that it will increasingly distribute its
products to end users through various indirect distribution channels, including
channel partners, value added resellers ("VARs"), original equipment
manufacturers ("OEMs"), Internet service providers ("ISPs") and systems
integrators. The Company's relationships with many of its channel partners have
been established within the last 18 months, and the Company is unable to predict
the extent to which these channel partners will be successful in marketing and
selling licenses for the Company's products. The Company is dependent on the
marketing and sales efforts of these channel partners, many of whom also market
and sell competitive products or are able, under the terms of their agreements,
to market and sell competitive products. While no one channel partner accounted
for more than 10% of the Company's consolidated revenues in 1997, the loss of
several of the Company's major channel partners without replacement, either to
competitive products offered by other companies or products developed internally
by these channel partners, could have a material adverse effect on the Company's
business, operating results and financial condition. In addition, there can be
no assurance that the Company will be able to effectively manage potential
conflicts among channel partners, that economic conditions or industry demand
will not adversely affect these or other indirect channel partners or that these
channel partners will not devote greater resources to marketing and supporting
the products of other companies. The Company's future performance will also
depend, in part, on its ability to attract additional channel partners that will
be able to market and support the Company's products effectively, especially in
markets in which the Company has not previously
    
 
                                       10
<PAGE>   14
 
   
distributed its products. In addition, the Company depends in large part upon
its channel partners for product installation and support for such channel
partners' customers. There can be no assurance that revenue from channel
partners that accounted for significant revenues in past periods will continue,
or if continued will reach or exceed historical levels. In addition, there can
be no assurance that the Company's channel partners will continue to provide
adequate installation and support to end users or will provide installation and
support for new products. If the Company's channel partners fail to provide
adequate installation and support, end users of the Company's products could
cease using, or improperly implement and operate, such products, which could
result in a substantial increase in customer support costs to the Company and
thereby materially and adversely affect the Company's business, operating
results and financial condition. See "Business -- Sales and Marketing".
    
 
DEPENDENCE UPON KEY PERSONNEL
 
   
     The Company's future operating results depend in significant part upon the
continued service of a relatively small number of key technical and senior
management personnel, especially Thomas E. Noonan, the Company's Chairman of the
Board, President and Chief Executive Officer, and Christopher Klaus, the
Company's founder and Chief Technology Officer, neither of whom is bound by an
employment agreement. The Company currently has key-man life insurance coverage
for each of Messrs. Noonan and Klaus, which the Company intends not to renew
following completion of the Offering. The Company's future success also depends
on its continuing ability to attract and retain other highly qualified technical
and managerial personnel. Competition for such personnel is intense, and the
Company has at times in the past experienced difficulty in recruiting qualified
personnel, especially engineers experienced in network security issues. There
can be no assurance that the Company will retain its key managerial and
technical employees or that it will be successful in attracting, assimilating or
retaining other highly qualified technical and managerial personnel in the
future. The loss of any member of the Company's key technical and senior
management personnel or the inability to attract and retain additional qualified
personnel could have a material adverse effect on the Company's business,
operating results and financial condition. See "Management".
    
 
INTELLECTUAL PROPERTY RIGHTS; USE OF LICENSED TECHNOLOGY; TRADEMARK ISSUES
 
     The Company relies primarily on a combination of copyright and trademark
laws, trade secrets, confidentiality procedures and contractual provisions to
protect its proprietary rights. The Company also believes that factors such as
the technological and creative skills of its personnel, new product
developments, frequent product enhancements, name recognition and reliable
product maintenance are essential to establishing and maintaining a technology
leadership position. The Company seeks to protect its software, documentation
and other written materials under the trade secret and copyright laws, which
afford only limited protection. The Company has also submitted one United States
patent application. There can be no assurance that a patent will issue from this
application or, if issued, that such patent would provide meaningful competitive
advantages to the Company. The Company generally licenses SAFEsuite products to
end users in object code (machine-readable) format. Certain customers have
required the Company to maintain a source-code escrow account with a third-party
software escrow agent, and a failure by the Company to perform its obligations
under any of the related license and maintenance agreements, or the insolvency
of the Company, could conceivably cause the release of the Company's source code
to such customers. Despite the Company's efforts to protect its proprietary
rights, unauthorized parties may attempt to copy aspects of the Company's
products or to obtain and use information that the Company regards as
proprietary. Policing unauthorized use of the Company's products is difficult,
and while the Company is unable to determine the extent to which piracy of its
software products exists, software piracy can be expected to be a persistent
problem. In addition, the laws of some foreign countries do not protect the
Company's proprietary rights to as great an extent as do the laws of the United
States. There can be no assurance that the Company's competitors will not
independently develop similar technology.
 
                                       11
<PAGE>   15
 
     Although the Company is not aware that any of its products infringes the
proprietary rights of third parties, there can be no assurance that third
parties will not claim infringement by the Company with respect to current or
future products. The Company expects that software product developers will
increasingly be subject to infringement claims as the number of products and
competitors in the Company's industry segment grows and the functionality of
products in different industry segments overlaps. Any such claims, with or
without merit, could be time consuming, result in costly litigation, cause
product shipment delays or require the Company to enter into royalty or
licensing agreements. Such royalty or licensing agreements, if required, may not
be available on terms acceptable to the Company or at all, which could have a
material adverse effect upon the Company's business, operating results and
financial condition.
 
     The name "Internet Security Systems" is currently not subject to trademark
registration in the United States, and may not be a name for which trademark
protection is available due to its general use in a variety of security-related
applications. Although the Company has in the past asserted and intends to
continue to assert its rights with respect to the name "Internet Security
Systems" and has in the past taken and will take action against any use of such
name in a manner that may create confusion for its products in relevant markets,
there can be no assurance that the Company will be successful in such efforts,
which could have a material adverse effect upon the Company's business,
operating results and financial condition. See "Business -- Proprietary Rights
and Trademark Issues".
 
PRODUCT LIABILITY; RISK OF PRODUCT DEFECTS
 
   
     The Company's products are used to monitor and enhance network security,
which is typically a critical function for organizations. As a result, the
licensing and support of products by the Company may entail the risk of product
liability and related claims. Although the Company's license agreements
typically contain provisions that are designed to limit the Company's exposure
to potential product liability or related claims, including provisions that
limit the Company's liability for special, consequential or incidental damages,
there can be no assurance that such provisions will be enforceable under the
laws of applicable domestic or foreign jurisdictions. In addition, the Company
currently has products liability insurance coverage in the amount of $2.0
million that, subject to customary exclusions, covers claims resulting from
failure of the Company's products or services to perform the function or to
serve the purpose intended. To the extent that any claims are not covered by
such insurance, the Company's business, operating results and financial
condition may be materially and adversely affected by a successful product
liability claim, particularly since the Company's products are used in critical
processes within its customers' computing systems.
    
 
     In addition, software products as complex as those offered by the Company
may contain undetected errors or result in failures when first introduced or
when new versions are released. In particular, the personal computer hardware
environment is characterized by a wide variety of non-standard configurations
that make pre-release testing for programming or compatibility errors very
difficult and time-consuming. Despite testing by the Company and by current and
potential customers, there can be no assurance that errors will not be found in
new products or enhancements after commencement of commercial shipments. The
occurrence of these errors could result in adverse publicity, loss of or delay
in market acceptance or claims by customers against the Company, any of which
could have a material adverse effect upon the Company's business, operating
results and financial condition. See "Business -- Products" and "-- Product
Development".
 
RISK OF TARGETED ATTACKS AGAINST THE COMPANY
 
     Due to the Company's notoriety in monitoring, detecting and thwarting the
activities of computer hackers, the Company in the past has been, and expects in
the future that it will continue to be, a target of attacks by computer hackers
who seek to infiltrate the Company's internal network system to obtain sensitive
data and information or create bugs or viruses in an attempt to sabotage the
functionality of the Company's products. There can be no assurance that the
Company will be able to respond to such
 
                                       12
<PAGE>   16
 
attacks in a timely or effective manner and any failure to do so could have a
material adverse effect upon the Company's business, operating results and
financial condition.
 
GOVERNMENT REGULATION OF TECHNOLOGY EXPORTS
 
     A number of governments have imposed controls, export license requirements
and restrictions on the export of certain technology, specifically with respect
to encryption technology. Although the Company has incorporated encryption
technology into its products, the Company has been able to receive prior
approvals or authorizations to sell its products in foreign markets. There can
be no assurance, however, that current export controls will not be extended to
cover the Company's products which may have a material adverse effect on the
Company's business, operating results and financial condition.
 
   
YEAR 2000 COMPLIANCE
    
 
   
     Many currently installed computer systems and software products are coded
to accept only two-digit entries in the date code field. Beginning in the year
2000, these date code fields will need to accept four-digit entries to
distinguish 21st century dates from 20th century dates. As a result, computer
systems and software used by many companies may need to be upgraded to comply
with such "Year 2000" requirements. Significant uncertainty exists in the
software industry concerning the potential effects associated with such
compliance. Although all of the products currently offered by the Company are
designed to be Year 2000 compliant, there can be no assurance that the Company's
products contain all necessary date code changes, or that, in the year 2000, the
Company's products will be compatible with third-party software that may be
integrated or used in conjunction with the Company's products.
    
 
NO PRIOR MARKET FOR THE COMMON STOCK; POSSIBLE VOLATILITY OF SHARE PRICE
 
     Prior to the Offering, there has been no public market for the Common
Stock, and there can be no assurance that an active trading market will develop
upon completion of the Offering or, if it does develop, that such market will be
sustained. The initial public offering price of the Common Stock will be
determined by negotiation between the Company and the representatives of the
Underwriters, and may not be representative of the price that will prevail in
the open market. See "Underwriting" for a discussion of the factors to be
considered in determining the initial public offering price.
 
     The market price of the Common Stock after the Offering may be
significantly affected by factors such as the announcement of new products or
product enhancements by the Company or its competitors, technological innovation
by the Company or its competitors, quarterly variations in the Company's results
of operations, and general market conditions or market conditions specific to
particular industries. In particular, the stock prices for many companies in the
technology and emerging growth sector have experienced wide fluctuations which
have often been unrelated to the operating performance of such companies. Such
fluctuations may adversely affect the market price of the Common Stock.
Furthermore, in the past, following periods of volatility in the market price of
a company's securities, securities class action claims have been brought against
the issuing company. There can be no assurance that such litigation will not
occur in the future with respect to the Company. Such litigation could result in
substantial costs and a diversion of management's attention and resources, and
any adverse determination in such litigation could also subject the Company to
significant liabilities, any or all of which could have a material adverse
effect on the Company's business, operating results and financial condition.
 
ANTI-TAKEOVER PROVISIONS
 
     The Company's Certificate of Incorporation (the "Charter") and the
Company's Bylaws (the "Bylaws") contain certain provisions that may have the
effect of discouraging, delaying or preventing a change in control of the
Company or unsolicited acquisition proposals that a stockholder might consider
favorable. The Charter provides the Company's Board of Directors with the
authority to issue up to
 
                                       13
<PAGE>   17
 
50,000,000 shares of Common Stock, and up to 20,000,000 shares of Preferred
Stock in one or more series and to determine the price, rights (including voting
rights), preferences, privileges and restrictions of each such series of
Preferred Stock, without any vote or action by the Company's stockholders. The
rights and preferences of any series of such Preferred Stock could include a
preference over the Common Stock on the distribution of the Company's assets
upon a liquidation or sale of the Company, preferential dividends, redemption
rights, the right to elect one or more directors and other voting rights. The
rights of the holders of the Common Stock will be subject to, and may be
adversely affected by, the rights of the holders of any series of Preferred
Stock that may be issued in the future. The Company has no current plans to
issue Preferred Stock. The existence of large amounts of authorized but unissued
Common Stock could be used to prevent or delay a change in control of the
Company. In addition, the Charter and Bylaws include provisions establishing a
Board of Directors with staggered, three-year terms, requiring supermajority
voting to effect certain amendments to the Charter and Bylaws, limiting the
persons who may call special meetings of stockholders, prohibiting stockholder
action by written consent and establishing advance notice requirements for
nominations for election to the Board of Directors or for proposing matters that
can be acted upon at stockholders' meetings. Certain provisions of Delaware law
and the Company's Restated 1995 Stock Incentive Plan (the "1995 Plan") may also
have the effect of discouraging, delaying or preventing a change in control of
the Company or unsolicited acquisition proposals. See "Management -- Restated
1995 Stock Incentive Plan" and "Description of Capital Stock -- Certain
Anti-Takeover, Limited Liability and Indemnification Provisions".
 
SHARES ELIGIBLE FOR FUTURE SALE; REGISTRATION RIGHTS
 
   
     Sales of substantial amounts of Common Stock in the public market, or the
perception that such sales may occur, could adversely affect the prevailing
market price of the Common Stock or the ability of the Company to raise capital
through a public offering of its equity securities. Upon completion of the
Offering, the Company will have outstanding 16,368,928 shares of Common Stock
(not including shares issuable upon exercise of outstanding stock options).
Under agreements entered into between the representatives of the Underwriters
and each of the Company's officers, directors, principal stockholders and their
respective affiliates (the "Lock-Up Agreements") who beneficially hold, in the
aggregate, 13,683,928 shares of Common Stock (which includes 24,500 shares
acquired in 1998 upon the exercise of stock options) prior to the Offering, no
shares held by such holders will be eligible for sale in the public market for a
period of 180 days following the date of this Prospectus. The Company intends to
file a registration statement under the Securities Act of 1933, as amended (the
"Securities Act"), covering the sale of Common Stock reserved for issuance under
the 1995 Plan. As of December 31, 1997, there were options outstanding under the
1995 Plan to purchase an aggregate of 1,808,350 shares and options issued
outside of the 1995 Plan to purchase 80,000 shares; all shares acquired upon
exercise of options within 180 days of the Offering are or will be subject to
Lock-Up Agreements as required under the 1995 Plan. Following the expiration of
the 180-day term of the Lock-Up Agreements, 16,084,741 shares, including the
3,000,000 shares offered hereby and approximately 466,513 shares subject to
options that will be exercisable on or before the end of such term, will be
eligible for sale in the public market subject, in some cases, to the
requirements of Rule 144 or Rule 701 under the Securities Act. Goldman, Sachs &
Co. in its sole discretion and at any time without notice, may release all or
any portion of the securities subject to the Lock-Up Agreements. Any such
decision to release securities would likely be based upon individual stockholder
circumstances, prevailing market conditions and other relevant factors. Any such
release could have a material adverse effect upon the price of the Common Stock.
See "Underwriting".
    
 
   
     After the Offering, holders of 6,493,457 shares of Common Stock are
currently entitled to certain demand and piggy-back registration rights with
respect to such shares and holders of an additional 7,145,471 shares of Common
Stock are currently entitled to piggy-back registration rights. If the Company
were required to register the shares held by such holders pursuant to the
exercise of their demand or piggy-back registration rights, such sales could
have an adverse effect upon the Company's ability to raise needed capital. See
"Shares Eligible for Future Sale".
    
 
                                       14
<PAGE>   18
 
CONCENTRATION OF SHARE OWNERSHIP
 
   
     Upon completion of the Offering, the directors, executive officers and
principal stockholders of the Company and their respective affiliates will
beneficially own approximately 72.4% of the outstanding Common Stock
(approximately 72.0% if the Underwriters' over-allotment option is exercised in
full). As a result, these stockholders will be able to exercise significant
influence over all matters requiring stockholder approval, including the
election of directors and approval of significant corporate transactions. Such
concentration of ownership may have the effect of delaying or preventing a
change in control of the Company. See "Principal and Selling Stockholders".
    
 
DISCRETION AS TO USE OF PROCEEDS
 
     The Company has not yet identified specific uses of a significant portion
of the net proceeds from the Offering. Therefore, the Company's management will
retain broad discretion to allocate the net proceeds from the Offering to uses
that the stockholders may not deem desirable, and there can be no assurance that
the proceeds can or will yield a significant return. See "Use of Proceeds".
 
IMMEDIATE AND SUBSTANTIAL DILUTION
 
   
     The midpoint of the filing range of the initial public offering price is
substantially higher than the book value per share of the outstanding Common
Stock. As a result, investors purchasing Common Stock in the Offering will incur
immediate and substantial dilution of the net tangible book value per share of
the Common Stock of $12.53 from such mid-point of the filing range. In addition,
the Company has issued options to acquire Common Stock at prices significantly
below the mid-point of the filing range of the initial public offering price. To
the extent such outstanding options are exercised, there will be further
dilution to investors in the Offering. See "Dilution".
    
 
                                       15
<PAGE>   19
 
                                USE OF PROCEEDS
 
   
     Based on an assumed initial public offering price of $15.00 per share, the
net proceeds from the sale of shares of Common Stock to be sold by the Company
will be approximately $36,606,000 (approximately $41,977,000 if the Underwriters
exercise their over-allotment option in full) after deduction of estimated
underwriting discounts and commissions and estimated offering expenses payable
by the Company.
    
 
     The principal purposes of the Offering are to increase the Company's equity
capital, to create a public market for the Common Stock, to facilitate future
access by the Company to public equity markets, to provide liquidity to certain
of the Company's existing stockholders and to provide increased visibility and
credibility to the Company in a marketplace where many of its competitors are
publicly-held companies.
 
     The Company currently intends to use the net proceeds of the Offering for
working capital and general corporate purposes, including financing accounts
receivable and capital expenditures made in the ordinary course of its business,
as well as for possible acquisitions of businesses, products and technologies
that are complementary to those of the Company. Although the Company has not
identified any specific businesses, products or technologies that it may
acquire, nor are there any current agreements or negotiations with respect to
any such transactions, the Company from time to time evaluates such
opportunities. Pending such uses, the net proceeds will be invested in
government securities and other short-term, investment-grade, interest-bearing
instruments. The Company will not receive any proceeds from the sale of Common
Stock by the Selling Stockholders.
 
                                DIVIDEND POLICY
 
     The Company has never declared or paid any cash dividends on its capital
stock other than a $10,000 dividend paid in each of 1994 and 1995, and does not
intend to pay any cash dividends on its Common Stock in the foreseeable future.
The Company's bank credit facility currently permits the payment of cash
dividends only to the extent that the Company maintains certain financial ratios
and a specified minimum net worth. For a description of the Company's credit
facility, see Note 3 of Notes to Consolidated Financial Statements.
 
                                       16
<PAGE>   20
 
                                    DILUTION
 
   
     At December 31, 1997, the pro forma net tangible book value of the Company
was approximately $3,820,000, or $0.28 per share of Common Stock. Pro forma net
tangible book value per share represents the amount of total tangible assets of
the Company reduced by the amount of its total liabilities, divided by the
number of shares of Common Stock outstanding after giving effect to the
mandatory conversion of all shares of Convertible Preferred Stock upon the
consummation of the Offering. After giving effect to the issuance by the Company
of the 2,685,000 shares offered hereby at an assumed initial public offering
price of $15.00 per share and the receipt of the estimated net proceeds
therefrom, the pro forma as adjusted net tangible book value of the Company as
of December 31, 1997 would have been approximately $40,426,000, or $2.47 per
share of Common Stock. This represents an immediate increase in pro forma net
tangible book value of $2.19 per share to existing stockholders and an immediate
dilution of $12.53 per share to new investors purchasing shares of Common Stock
in the Offering. The following table illustrates the per share dilution:
    
 
   
<TABLE>
<S>                                                           <C>     <C>
Assumed initial public offering price per share.............          $15.00
  Pro forma net tangible book value per share as of December
     31, 1997...............................................  $0.28
  Increase per share attributable to new investors..........   2.19
                                                              -----
Pro forma as adjusted net tangible book value per share
  after the Offering........................................            2.47
                                                                      ------
Dilution per share to new investors in the Offering.........          $12.53
                                                                      ======
</TABLE>
    
 
     The following table sets forth, on a pro forma basis as of December 31,
1997, with respect to existing stockholders and new investors in the Offering, a
comparison of the number of shares of Common Stock acquired from the Company,
the percentage of ownership of such shares, the total cash consideration paid,
the percentage of total cash consideration paid and the average price per share.
 
   
<TABLE>
<CAPTION>
                                       SHARES PURCHASED       TOTAL CONSIDERATION
                                     ---------------------   ---------------------   AVERAGE PRICE
                                       NUMBER      PERCENT     AMOUNT      PERCENT     PER SHARE
                                     -----------   -------   -----------   -------   -------------
<S>                                  <C>           <C>       <C>           <C>       <C>
Existing stockholders(1)...........   13,658,428     83.6%   $ 9,080,000     18.4%      $ 0.66
New investors(1)...................    2,685,000     16.4     40,275,000     81.6        15.00
                                     -----------    -----    -----------    -----
          Total....................   16,343,428    100.0%   $49,355,000    100.0%
                                     ===========    =====    ===========    =====
</TABLE>
    
 
- ---------------
 
   
(1) The net effect of sales by the Selling Stockholders in the Offering will be
    to reduce the number of shares held by existing stockholders to 13,368,928
    shares, or 81.7% of the total number of shares of Common Stock outstanding
    after the Offering, and to increase the number of shares held by new
    investors to 3,000,000 shares, or 18.3% of the total number of shares of
    Common Stock outstanding after the Offering.
    
 
   
     The preceding table assumes no exercise of any stock options outstanding as
of December 31, 1997, except for 20,000 shares that were acquired by a Selling
Stockholder in January 1998 upon the exercise of a stock option with an exercise
price of $0.15 per share, which shares will be sold in the Offering. As of
December 31, 1997, there were stock options outstanding to purchase a total of
1,888,350 shares of Common Stock with a weighted average exercise price of $2.71
per share, all of which are exercisable, and 1,184,650 additional shares
reserved for issuance under the 1995 Plan.
    
 
                                       17
<PAGE>   21
 
                                 CAPITALIZATION
 
     The following table sets forth, as of December 31, 1997, the cash position
and capitalization of the Company (i) on a historical basis; (ii) on a pro forma
basis, giving effect to the conversion of each share of Convertible Preferred
Stock into one share of Common Stock, which will occur upon the consummation of
the Offering; and (iii) on a pro forma basis, as adjusted to give effect to the
sale of the Common Stock offered hereby and the receipt of the estimated net
proceeds therefrom as described under "Use of Proceeds".
 
   
<TABLE>
<CAPTION>
                                                                       DECEMBER 31, 1997
                                                              ------------------------------------
                                                                                        PRO FORMA
                                                              HISTORICAL   PRO FORMA   AS ADJUSTED
                                                              ----------   ---------   -----------
                                                                         (IN THOUSANDS)
<S>                                                           <C>          <C>         <C>
Cash and cash equivalents...................................   $ 3,929      $ 3,929      $40,535
                                                               =======      =======      =======
Long-term debt, less current portion(1).....................   $    70      $    70      $    70
  Redeemable, Convertible Preferred Stock, $0.001 par value,
     5,736,957 shares authorized............................
     Series A Redeemable, Convertible Preferred Stock,
       3,650,000 shares authorized, 3,650,000 shares issued
       and outstanding (historical) and none issued or
       outstanding (pro forma and pro forma as adjusted)....     3,621           --           --
     Series B Redeemable, Convertible Preferred Stock,
       2,086,957 shares authorized, 2,086,957 shares issued
       and outstanding (historical), and none issued or
       outstanding (pro forma and pro forma as adjusted)....     5,257           --           --
Stockholders' equity (deficit):
  Preferred Stock, $0.001 per value, 20,000,000 shares
     authorized, none issued or outstanding(2)..............        --           --           --
  Common Stock, $0.001 par value, 50,000,000 shares
     authorized, 7,921,471 shares (historical), 13,658,428
     shares (pro forma) 16,343,428 shares (pro forma as
     adjusted) issued and outstanding, respectively(3)......         8           14           16
  Additional paid-in capital................................       124        8,996       45,599
  Accumulated deficit.......................................    (5,190)      (5,190)      (5,190)
                                                               -------      -------      -------
     Total stockholders' equity (deficit)...................    (5,058)       3,820       40,426
                                                               -------      -------      -------
Total capitalization........................................   $(4,988)     $ 3,890      $40,496
                                                               =======      =======      =======
</TABLE>
    
 
- ---------------
 
(1) See Note 3 of Notes to Consolidated Financial Statements.
 
(2) The 20,000,000 shares of authorized Preferred Stock includes 3,650,000
    shares designated as Series A Convertible Preferred Stock and 2,086,957
    shares designated as Series B Convertible Preferred Stock.
 
   
(3) Pro forma and pro forma as adjusted Common Stock excludes 1,888,350 shares
    issuable upon the exercise of outstanding options as of December 31, 1997,
    and an additional 1,184,650 shares reserved for future issuance as of
    December 31, 1997 pursuant to the 1995 Plan. See "Management -- Restated
    1995 Stock Incentive Plan," "Certain Transactions" and Note 6 of Notes to
    Consolidated Financial Statements.
    
 
                                       18
<PAGE>   22
 
                      SELECTED CONSOLIDATED FINANCIAL DATA
 
     The following selected consolidated financial data of the Company is
qualified by reference to, and should be read in conjunction with, the
Consolidated Financial Statements and Notes thereto and the other financial
information appearing elsewhere in this Prospectus. The financial data set forth
below for each of the three years in the period ending December 31, 1997, and as
of December 31, 1996 and 1997, has been derived from the audited Consolidated
Financial Statements of the Company appearing elsewhere in this Prospectus. The
financial data for the period from inception (April 19, 1994) through December
31, 1994, and as of December 31, 1994 and 1995, has been derived from audited
financial statements of the Company not included in this Prospectus. Historical
results are not necessarily indicative of the results that may be expected in
the future. See "Management's Discussion and Analysis of Financial Condition and
Results of Operations".
 
   
<TABLE>
<CAPTION>
                                                  APRIL 19, 1994
                                                    (INCEPTION)        YEAR ENDED DECEMBER 31,
                                                      THROUGH        ---------------------------
                                                 DECEMBER 31, 1994    1995      1996      1997
                                                 -----------------   -------   -------   -------
                                                      (IN THOUSANDS, EXCEPT PER SHARE DATA)
<S>                                              <C>                 <C>       <C>       <C>
STATEMENT OF OPERATIONS DATA:
Revenues:
  Licenses.....................................       $   38         $   246   $ 4,233   $10,936
  Support services.............................           --              11       229     2,531
                                                      ------         -------   -------   -------
                                                          38             257     4,462    13,467
Costs and expenses:
  Cost of revenues.............................           --               4        18       676
  Research and development.....................            5              97     1,225     3,434
  Sales and marketing..........................           11             252     3,768    11,731
  General and administrative...................            2              44       656     1,773
                                                      ------         -------   -------   -------
                                                          18             397     5,667    17,614
                                                      ------         -------   -------   -------
Operating income (loss)........................           20            (140)   (1,205)   (4,147)
Interest income, net...........................           --              --        74       228
                                                      ------         -------   -------   -------
Net income (loss)..............................       $   20         $  (140)  $(1,131)  $(3,919)
                                                      ======         =======   =======   =======
Basic and diluted net income (loss) per
  share(1).....................................       $   --         $  (.03)  $  (.14)  $  (.50)
Weighted average shares used in basic and
  diluted net income (loss) per share
  calculation (2)..............................        4,586           5,001     7,916     7,907
Unaudited pro forma net loss per share(1)......                                          $  (.29)
                                                                                         =======
Unaudited weighted average shares used in
  unaudited pro forma net loss per share
  calculation(2)...............................                                           13,644
                                                                                         =======
</TABLE>
    
 
<TABLE>
<CAPTION>
                                                                     DECEMBER 31,
                                                         -------------------------------------
                                                          1994      1995      1996      1997
                                                         -------   -------   -------   -------
                                                                    (IN THOUSANDS)
<S>                                                      <C>       <C>       <C>       <C>
BALANCE SHEET DATA:
Cash and cash equivalents..............................  $     9   $     6   $ 2,007   $ 3,929
Working capital (working capital deficit)..............       10       (26)    2,298     2,272
Total assets...........................................       10       176     4,380     9,866
Long-term debt, net of current portion.................       --        --       140        70
Convertible Preferred Stock............................       --        --     3,614     8,878
Stockholders' equity (deficit).........................       10        (7)   (1,160)   (5,058)
</TABLE>
 
- ---------------
 
(1) Computed on the basis described in Note 1 of Notes to Consolidated Financial
    Statements.
   
(2) See Note 1 of Notes to Consolidated Financial Statements for the
    determination of shares used in computing basic and diluted net income
    (loss) per share and unaudited pro forma net loss per share. Pro forma net
    loss per share is not included for periods prior to 1997 because such
    comparisons are not meaningful due to the conversion of all outstanding
    shares of Convertible Preferred Stock to Common Stock upon consummation of
    the Offering.
    
                                       19
<PAGE>   23
 
                    MANAGEMENT'S DISCUSSION AND ANALYSIS OF
                 FINANCIAL CONDITION AND RESULTS OF OPERATIONS
 
     The following discussion should be read in conjunction with the
Consolidated Financial Statements and related Notes thereto included elsewhere
in this Prospectus. This discussion contains forward-looking statements that
involve risks and uncertainties. The Company's actual results may differ
materially from those anticipated in these forward-looking statements as a
result of certain factors, including, but not limited to, those set forth under
"Risk Factors" and elsewhere in this Prospectus.
 
OVERVIEW
 
     Internet Security Systems is the leading provider of network security
monitoring, detection and response software that protects the security and
integrity of enterprise information systems. The Company's products rely on an
innovative Adaptive Security Management ("ASM") approach to network security
which entails continuous security risk monitoring and response to develop an
active and informed network security policy. From inception through December 31,
1995, the Company was considered to be in the development stage with activities
primarily related to raising capital, recruiting personnel, conducting research
and development activities, purchasing operating assets, building the Internet
Security Systems identity and establishing the market for ASM products. During
1996 and 1997, the Company continued to invest in research and development,
expand its marketing activities, build domestic and international sales channels
and develop its general and administrative infrastructure.
 
     Historically, the Company has generated substantially all its revenues from
the license and related maintenance of its SAFEsuite products. In particular,
most of the Company's revenues to date have been generated from the Company's
Internet Scanner product, which was first introduced in 1992 and is currently
offered in version 5.0. RealSecure, introduced in the fourth quarter of 1996,
and System Security Scanner ("S3"), introduced in the first quarter of 1997,
have generated lesser amounts of revenue for the Company. The Company has also
derived a small portion of its revenue from responses to customer requests for
training and implementation services, on a time and materials basis, to assist
in the successful deployment of its products within customer networks,
development of customers' security policies and assessing the effectiveness of
security policy decisions. The Company believes that each of its current
products and products in development, together with professional services, will
represent important revenue sources in the future.
 
     The Company recognizes its license revenue upon (i) delivery of software
or, if the customer has evaluation software, delivery of the software key, and
(ii) issuance of the related license, assuming that no significant vendor
obligations or customer acceptance rights exist. In October 1997, the American
Institute of Certified Public Accountants issued Statement of Position ("SOP")
No. 97-2, Software Revenue Recognition, which the Company adopted, effective
January 1, 1997. Such adoption had no effect on the Company's methods of
recognizing revenue from its license and maintenance activities. Prior to 1997,
the Company's revenue policy was in accordance with the preceding authoritative
guidance provided by SOP No. 91-1, Software Revenue Recognition. Revenues from
perpetual licenses are recorded as license revenues in the statements of
operations. Support service revenues include maintenance, term license revenues
and professional services. Maintenance is a separate component of each contract
and is recognized ratably over the contract term. Term licenses, which allow
customer use of the product and maintenance for a specified period, generally
twelve months, are also recognized ratably over the contact term. Professional
services revenues are recognized as such services are performed. Research and
development expenditures have been charged to operations as incurred. The
Company has not capitalized any such development costs under Statement of
Financial Accounting Standards ("SFAS") No. 86.
 
     Pricing is based on the number of devices or engines being managed by the
customer, scaled to provide discounts when the managed system is larger or
several SAFEsuite products are licensed concurrently. Annual maintenance, which
is virtually always purchased in conjunction with the licensing of a product, is
a separate component that is offered for a fee generally equal to 20% of the
perpetual
 
                                       20
<PAGE>   24
 
license fee and recognized ratably over the contract term. Maintenance packages
typically include telephone support, product updates, access to the Company's
security advisory notices and error corrections. ISS recommends that its
customers renew their maintenance contracts and, to date, most customers have
done so. Because of the dynamic nature of vulnerabilities and threats to
distributed computing environments, the Company's ongoing program of security
updates and increased awareness created by the Company's products, the Company
believes that a substantial majority of its customers will continue to renew
their maintenance contracts.
 
     Licenses originate principally from the Company's direct sales force and
telephone sales operations. Indirect sales channels, including resellers,
security consultants, ISPs and OEMs that incorporate the Company's products into
their own product offerings, are also important sources of revenues. Indirect
channels provide less revenue per license to ISS since the channel partners
usually receive discounts ranging from 35% to 50% of list price.
 
     The Company's business has grown rapidly in the last three years, with
total revenues increasing from $257,000 in 1995 to $13.5 million in 1997.
However, ISS has experienced net losses in each of these years and, as of
December 31, 1997, had an accumulated deficit of $5.2 million. These losses
resulted from significant costs incurred in the development and sale of the
Company's products and services. During this period, the number of ISS employees
increased from seven at December 31, 1995 to 141 at December 31, 1997. The
Company currently expects to expand its sales and marketing operations, to
continue an aggressive international expansion, to increase its investment level
in product development and its proprietary database, and to improve its internal
operating and financial infrastructure in support of the Company's business
plan, all of which will increase operating expenses. As a result, ISS expects to
continue to incur losses for the foreseeable future.
 
     Because the market for the Company's products has only recently emerged,
period-to-period comparisons of its operating results are not meaningful.
Although ISS has experienced significant revenue growth recently, there can be
no assurance that such growth rates are sustainable and they should not be
relied upon as predictive of future performance. The Company's prospects must be
considered in light of the risks, expenses and difficulties frequently
encountered by companies in the early stage of development, particularly
companies in new and rapidly evolving markets. There can be no assurance that
the Company will be successful in addressing such risks and difficulties or that
ISS will achieve profitability in the future. See "Risk Factors -- Limited
Operating History; History of Losses","--Significant Potential Fluctuations in
Operating Results" and " -- Management of Growth".
 
                                       21
<PAGE>   25
 
RESULTS OF OPERATIONS
 
     The following table sets forth certain consolidated historical operating
information for the Company, as a percentage of total revenues, for the periods
indicated.
 
<TABLE>
<CAPTION>
                                                                 YEAR ENDED DECEMBER 31,
                                                                -------------------------
                                                                 1995      1996     1997
                                                                ------    ------    -----
<S>                                                             <C>       <C>       <C>
PERCENTAGE OF TOTAL REVENUES:
Revenues:
  Licenses..................................................      95.7%     94.9%    81.2%
  Support services..........................................       4.3       5.1     18.8
                                                                ------    ------    -----
                                                                 100.0     100.0    100.0
Costs and expenses:
  Cost of revenues..........................................       1.6       0.4      5.0
  Research and development..................................      37.7      27.5     25.5
  Sales and marketing.......................................      98.1      84.4     87.1
  General and administrative................................      17.1      14.7     13.2
                                                                ------    ------    -----
                                                                 154.5     127.0    130.8
                                                                ------    ------    -----
Operating loss..............................................     (54.5)    (27.0)   (30.8)
Interest income, net........................................        --       1.7      1.7
                                                                ------    ------    -----
Net loss....................................................     (54.5)%   (25.3)%  (29.1)%
                                                                ======    ======    =====
</TABLE>
 
     REVENUES
 
     The Company's revenues increased from $257,000 in 1995, to $4.5 million in
1996 and to $13.5 million in 1997. During these periods, Internet Scanner was
the Company's primary revenue-generating product with license revenues
accounting for approximately 96%, 93% and 66% of the Company's total revenues in
1995, 1996 and 1997, respectively. Maintenance revenue related to all licenses
and annual contracts for product usage and support accounted for approximately
4%, 5% and 18% of total revenues in 1995, 1996 and 1997, respectively. The
balance of revenues originated from the Company's more recent product offerings,
S3 and RealSecure, and professional services provided on a time and materials
basis. The Company had no customer that accounted for more than 10% of its
revenues in 1997. The Company recognized over 95% of its revenues in 1995 and
1996 from sales to customers within North America; however, international
operations were significantly expanded in 1997 and represent an increasing
source of the Company's revenues. In 1997, revenues from customers outside North
America were $2.8 million, representing approximately 21% of total revenues.
 
     COST OF REVENUES
 
     Cost of revenues includes packaging and distribution costs for the
Company's software products which, since the Company uses the Internet to
provide product updates and keys necessary to activate a customer's software, is
a minor cost. This category also includes the costs related to the Company's
professional services offerings, which were provided by a dedicated employee
group beginning in 1997 and is expected to be an area of future personnel growth
in 1998. Gross margins were 98.4% in 1995, 99.6% in 1996 and 95.0% in 1997. The
Company's gross margins will decline in future years if, as anticipated,
professional services become a more significant portion of the Company's
business.
 
     RESEARCH AND DEVELOPMENT
 
     Research and development expenses consist of salary and related costs of
the Company's research and development personnel, including costs for employee
benefits, computer equipment and support services used in product and technology
development. This includes the "X-Force", a team composed of security experts
dedicated to understanding, documenting and coding new vulnerability checks,
real-time threats and attack signatures and solutions to global security issues.
The Company believes that this primary research, which aids in the design of new
products and product enhancements to respond to an ever-changing risk profile,
is an essential ingredient for retaining its leadership position in its market-
                                       22
<PAGE>   26
 
   
place. Accordingly, the Company has increased its research and development
expenses from $97,000 in 1995, to $1.2 million in 1996 and to $3.4 million in
1997, representing approximately 38%, 27% and 25% of revenues, respectively. ISS
expects that research and development expenses will continue to increase in
absolute dollars, and approximate the 1997 level as a percentage of revenues, as
the Company recruits and hires additional experienced security experts and makes
other investments in research and development. The Company does not expect to
incur significant costs to make its products Year 2000 compliant because it
believes its products are currently designed to properly function through and
beyond the year 2000.
    
 
     SALES AND MARKETING
 
     Sales and marketing expenses consist primarily of salaries and travel,
commissions, advertising, maintenance of the ISS Web site, trade show expenses,
personnel recruiting costs and costs of marketing materials. Sales and marketing
expenses were $252,000 in 1995, $3.8 million in 1996 and $11.7 million in 1997,
representing approximately 98%, 84% and 87% of total revenues, respectively.
This increase in absolute dollars is primarily the result of a significant
increase in the number of regional United States sales locations, increased
commissions commensurate with increased direct sales revenues and expanded
international operations in the Europe and Asia/Pacific regions. The Company
anticipates that sales and marketing expenses will continue to increase in
absolute dollars, but decrease as a percentage of revenues, as it continues to
expand its direct sales force and telephone sales operations and hires
additional marketing and business development personnel to promote its indirect
sales distribution channels.
 
     GENERAL AND ADMINISTRATIVE
 
   
     General and administrative expenses were $44,000 in 1995, $656,000 in 1996
and $1.8 million in 1997, representing approximately 17%, 15% and 13% of
revenues, respectively. Such expenses consisted primarily of salaries and
personnel and related costs for the Company's executive, administrative, finance
and human resources personnel, support services and professional services fees.
The Company anticipates that these expenses will approximate 1997 levels as a
percentage of revenues, but will increase in absolute dollars in 1998 as it
upgrades internal and financial reporting systems to enhance management's
ability to obtain and analyze information about its domestic and international
operations. The Company believes that the upgrade of these reporting systems
will result in all of its internal systems being operational through and beyond
the year 2000 without significant additional expense to the Company. Also, the
Company anticipates additional costs related to being a public company,
including annual and other public reporting costs, directors' and officers'
liability insurance, investor relations programs and professional services fees.
    
 
     INCOME TAXES
 
     No provision for federal, state or foreign income taxes has been recorded
because the Company has experienced cumulative net losses since inception. As of
December 31, 1997, ISS had net operating loss carryforwards of approximately
$3.9 million for federal tax purposes which will expire, if not utilized, in
2011 and 2012. The Company also has approximately $295,000 of net operating loss
carryforwards related to its foreign operations which will expire, if not
utilized, in 2011. The Company has not recognized any benefit from the future
use of such loss carryforwards because management's evaluation of all the
available evidence in assessing the realizability of the tax benefits of such
loss carryforwards indicates that the underlying assumptions of future
profitable operations contain risks that do not provide sufficient assurance to
recognize such tax benefits currently.
 
                                       23
<PAGE>   27
 
SELECTED QUARTERLY FINANCIAL RESULTS
 
   
     The following tables set forth unaudited consolidated statements of
operations data for the eight quarters ended December 31, 1997, as well as such
data expressed as a percentage of the Company's total revenues for the periods
indicated. This data has been derived from unaudited interim consolidated
financial statements that, in the opinion of management, include all adjustments
(consisting only of normal recurring adjustments) necessary for a fair
presentation of such information when read in conjunction with the Company's
Consolidated Financial Statements and Notes thereto appearing elsewhere in this
Prospectus. The operating results for any quarter are not necessarily indicative
of results for any future period.
    
 
<TABLE>
<CAPTION>
                                                                     QUARTER ENDED
                                ---------------------------------------------------------------------------------------
                                MAR. 31,   JUNE 30,   SEPT. 30,   DEC. 31,   MAR. 31,   JUNE 30,   SEPT. 30,   DEC. 31,
                                  1996       1996       1996        1996       1997       1997       1997        1997
                                --------   --------   ---------   --------   --------   --------   ---------   --------
                                                                    (IN THOUSANDS)
<S>                             <C>        <C>        <C>         <C>        <C>        <C>        <C>         <C>
CONSOLIDATED STATEMENT OF
  OPERATIONS DATA:
Revenues:
  Licenses....................   $  360     $  885     $  940      $2,048     $1,872     $2,150     $ 2,767    $ 4,147
  Support services............        8         19         88         114        353        521         706        951
                                 ------     ------     ------      ------     ------     ------     -------    -------
                                    368        904      1,028       2,162      2,225      2,671       3,473      5,098
Costs and expenses:
  Cost of revenues............        1          4          2          11         87        137         176        276
  Research and development....      176        275        332         442        493        569         895      1,477
  Sales and marketing.........      242        871        965       1,690      1,754      2,342       3,051      4,584
  General and
    administrative............       95        153        155         253        320        301         443        709
                                 ------     ------     ------      ------     ------     ------     -------    -------
                                    514      1,303      1,454       2,396      2,654      3,349       4,565      7,046
                                 ------     ------     ------      ------     ------     ------     -------    -------
Operating loss................     (146)      (399)      (426)       (234)      (429)      (678)     (1,092)    (1,948)
Interest income, net..........       18         29         15          12         35         68          66         59
                                 ------     ------     ------      ------     ------     ------     -------    -------
Net loss......................   $ (128)    $ (370)    $ (411)     $ (222)    $ (394)    $ (610)    $(1,026)   $(1,889)
                                 ======     ======     ======      ======     ======     ======     =======    =======
</TABLE>
 
<TABLE>
<CAPTION>
                                                                     QUARTER ENDED
                                ---------------------------------------------------------------------------------------
                                MAR. 31,   JUNE 30,   SEPT. 30,   DEC. 31,   MAR. 31,   JUNE 30,   SEPT. 30,   DEC. 31,
                                  1996       1996       1996        1996       1997       1997       1997        1997
                                --------   --------   ---------   --------   --------   --------   ---------   --------
<S>                             <C>        <C>        <C>         <C>        <C>        <C>        <C>         <C>
AS A PERCENTAGE OF TOTAL
  REVENUES:
Revenues:
  Licenses....................     97.8%      97.9%      91.4%       94.7%      84.1%      80.5%       79.7%      81.3%
  Support services............      2.2        2.1        8.6         5.3       15.9       19.5        20.3       18.7
                                 ------     ------     ------      ------     ------     ------     -------    -------
                                  100.0      100.0      100.0       100.0      100.0      100.0       100.0      100.0
Costs and expenses:
  Cost of revenues............      0.3        0.4        0.2         0.5        3.9        5.1         5.1        5.4
  Research and development....     47.8       30.4       32.3        20.4       22.2       21.3        25.8       29.0
  Sales and marketing.........     65.8       96.4       93.9        78.2       78.8       87.7        87.8       89.9
  General and
    administrative............     25.8       16.9       15.1        11.7       14.4       11.3        12.7       13.9
                                 ------     ------     ------      ------     ------     ------     -------    -------
                                  139.7      144.1      141.5       110.8      119.3      125.4       131.4      138.2
                                 ------     ------     ------      ------     ------     ------     -------    -------
Operating loss................    (39.7)     (44.1)     (41.5)      (10.8)     (19.3)     (25.4)      (31.4)     (38.2)
Interest income, net..........      4.9        3.2        1.5         0.5        1.6        2.6         1.9        1.1
                                 ------     ------     ------      ------     ------     ------     -------    -------
Net loss......................    (34.8)%    (40.9)%    (40.0)%     (10.3)%    (17.7)%    (22.8)%     (29.5)%    (37.1)%
                                 ======     ======     ======      ======     ======     ======     =======    =======
</TABLE>
 
                                       24
<PAGE>   28
 
   
     During the Company's short history, its operating results have varied on a
quarterly basis and may fluctuate significantly in the future on a quarterly and
annual basis as a result of a combination of factors. These factors include the
level of demand for the Company's products, the volume and timing of orders, the
level of product and price competition, the Company's ability to expand its
domestic and international sales and marketing organizations, the Company's
ability to develop new and enhanced products, the Company's ability to attract
and retain key technical, sales and managerial personnel, the mix of
distribution channels through which the Company's products are sold, the growth
in the acceptance of, and activity on, the Internet and the Web, particularly by
corporate, institutional and government users, the level of growth of intranets,
the extent to which unauthorized access and use of online information is
perceived as a threat to network security, customer budgets, seasonal trends in
customer purchasing, foreign currency exchange rates and general economic
factors. In addition, the amount of revenues associated with particular licenses
can vary significantly based upon the number of products licensed and the number
of devices involved in the installation. The Company has experienced, and may
continue to experience from time to time, large individual license sales which
can cause significant variability in license revenues and results of operations
for any particular period. As a result, the timing of significant orders is
unpredictable and, like many software companies, the Company typically realizes
a significant portion of software license revenues in the last month of the
quarter. The Company establishes its expenditure levels for product development,
sales and marketing and other operating expenses based, in large part, on its
expected future revenues. As a result, if revenues fall below expectations,
operating results and net income are likely to be adversely and
disproportionately affected because only a small portion of the Company's
expenses vary with its revenues.
    
 
LIQUIDITY AND CAPITAL RESOURCES
 
     Since its inception, the Company has financed its operations primarily
through sales of its equity securities in private placements. In February 1996
and February 1997, the Company received aggregate net proceeds of $8.9 million
from the sale of Convertible Preferred Stock, which shares will automatically
convert into Common Stock upon consummation of the Offering.
 
     Net cash used in operating activities of approximately $1.6 million for the
year ended December 31, 1997 resulted from $3.9 million in net operating losses
partially offset by a decrease in working capital. Although revenue growth
increased accounts receivable by $2.1 million in 1997, working capital decreased
as accounts payable and accrued expenses grew $2.7 million and deferred revenues
increased $1.5 million. The increase in deferred revenues was attributable to
the growth of maintenance contracts and term licenses, which are recognized
ratably as revenue over the contract term.
 
     Cash provided by financing activities of $5.2 million in 1997 consisted
primarily of the proceeds from the issuance of Convertible Preferred Stock which
has been invested in short-term investments. Purchase of computer equipment used
in conducting the Company's business represented the primary component of cash
used in investing activities.
 
     As of December 31, 1997, the Company had $3.9 million of cash and cash
equivalents. The Company believes that the net proceeds of this Offering,
together with existing cash, cash equivalents and short-term investments, will
be sufficient to fund its anticipated operating losses and to meet its working
capital and anticipated capital expenditures for at least the next 12 months.
The Company currently intends to use the net proceeds of the Offering for
working capital and general corporate purposes, including financing accounts
receivable and capital expenditures made in the ordinary course of its business,
as well as for possible acquisitions of businesses, products and technologies
that are complementary to those of the Company. Although the Company has not
identified any specific businesses, products or technologies that it may
acquire, nor are there any current agreements or negotiations with respect to
any such transactions, the Company from time to time evaluates such
opportunities. Pending such uses, the net proceeds will be invested in
government securities and other short-term, investment-grade, interest-bearing
instruments.
 
                                       25
<PAGE>   29
 
                                    BUSINESS
 
OVERVIEW
 
     Internet Security Systems is the leading provider of network security
monitoring, detection and response software that protects the security and
integrity of enterprise information systems. The Company's SAFEsuite family of
products enforces "best practice" information protection automatically across
distributed computing environments by monitoring and responding to continuously
changing network security risks. By dynamically detecting and responding to the
security vulnerabilities and real-time threats inherent in open systems,
SAFEsuite products protect distributed computing environments, including
internal corporate networks, extranets and the Internet, from attacks, misuse
and security policy violations. The Company's products rely on an innovative
Adaptive Security Management ("ASM") approach to network security, which entails
continuous security risk monitoring and response to develop and enforce an
active network security policy. ISS pioneered the technology for vulnerability
and threat detection through a dedicated security research and development team
and believes that it has the most comprehensive vulnerability and threat
database in existence. The Company has delivered its network security
monitoring, detection and response solutions to over 1,500 organizations
worldwide, including firms in the Global 2000, U.S. and international government
agencies and major universities. Nine of the ten largest commercial banks in the
United States have licensed the Company's products.
 
INDUSTRY BACKGROUND
 
     The rise of client/server computing in recent years has driven the need for
connectivity beyond local area networks ("LANs") to enterprise-wide networks
spanning multiple LANs and wide area networks ("WANs"). Concurrently with the
shift to distributed computing architectures, the use of the Internet by
organizations has grown dramatically, driven largely by the development of the
Web and graphically intuitive browsers, the proliferation of multimedia personal
computers and the emergence of compelling Web-based content and commerce
applications. International Data Corporation ("IDC") estimated in a July 1997
report that at the end of 1997 there would be over 29 million Web users in the
United States and over 50 million users worldwide, with the number expected to
increase to 94 million in the United States and 175 million worldwide by the end
of 2001. Additionally, IDC estimates that the number of devices accessing the
Web will increase from 64 million at the end of 1997 to 331 million by the end
of 2001.
 
   
     Growth of the Internet has to date been fueled primarily by the increased
use of e-mail, general information browsing and the exchange of non-sensitive
data. However, organizations are increasingly connecting their enterprise
networks to the Internet to extend beyond these limited uses, thus facilitating
and supporting a number of more valuable and sensitive activities, including
business-to-business transactions, electronic data interchange (EDI), Web-based
access to account and benefits information, secure messaging and online retail
purchases and payments. The proliferation of client/server architectures and the
growth of the Internet as a business tool has led to the emergence of
"intranets" -- private enterprise information systems that use Internet
protocols ("IP") and applications to share information and services both within
and outside the enterprise network. As a result, businesses are able to share
internal information and to run enterprise applications across geographically
dispersed facilities, and customers, remote employees, suppliers and other
business partners are able to inexpensively link into each other's enterprise
information systems. In its July 1997 report, IDC projected that 9 million users
in the U.S. and 13 million users worldwide had bought or would buy goods or
services in Web-based transactions during 1997, with that number expected to
grow to 42 million and 68 million users, respectively, by 2001. In addition, IDC
estimates that commerce over the Internet will grow from less than $11 billion
in 1997 to more than $223 billion in 2001.
    
 
                                       26
<PAGE>   30
 
THE NEED FOR NETWORK SECURITY
 
   
     Although open computing environments have many business advantages, their
accessibility and the relative anonymity of users makes these systems, and the
integrity of the information that is stored on them, vulnerable to security
threats. Distributed computing systems contain an organization's mission-
critical applications, such as payroll, financial reports, customer and supplier
records and manufacturing and engineering designs. The advent and widespread
adoption of open systems, together with their inherent vulnerabilities, present
inviting opportunities for computer hackers, curious or disgruntled employees,
contractors and competitors to compromise or destroy sensitive information
within the system or to otherwise disrupt the normal operation of the system. In
addition, client/server computing environments are inherently complex, typically
involving a variety of hardware, operating systems, networking protocols and
applications supplied by a multitude of vendors, making these networks difficult
to manage, monitor and protect from unauthorized access. Each application,
operating system and device introduced to a network contains additional
vulnerabilities that may be exploited by an unauthorized network user. Newly
introduced versions of products like Windows NT and Sun Solaris, which are
designed to maximize connectivity both within and among networks, create many
more new vulnerabilities. To adequately secure a network, IT managers must have
the resources to not only correctly configure the security measures in each
system, but also to understand the risks created by any change to existing
systems on the network. Exacerbating this situation is the limited supply of
personnel knowledgeable in information security issues.
    
 
     These factors create an urgent need for enterprises to protect their
information systems from unauthorized access and misuse. The security risks are
real. According to the 1997 Annual Information Week/Ernst & Young LLP
Information Security Survey of IT managers and professionals, 42% of all United
States respondents reported malicious acts from external sources, up from 16% in
the previous year, 43% reported malicious acts from employees as compared to 29%
in the previous year, and 55% reported insufficient IT professionals to monitor
network security. Despite the convenience and the compelling economic incentives
for the use of IP networks, they cannot reach their full potential as a platform
for global communication and commerce until the current lack of security
associated with these networks is adequately resolved.
 
     Organizations have generally responded to perceived security threats by
implementing passive point tools designed to protect individual components of
their internal networks from unauthorized use or outside attacks. Some security
concerns are being addressed through encryption, firewalls and other
technologies, but these technologies can be circumvented. Encryption protects
information during transmission, but it does not typically protect information
at either the source or the destination. A "firewall" controls the flow of data
between an internal network and outside networks or the Internet. While
firewalls are necessary for access control, they must be initially configured,
and regularly reconfigured, to accommodate new applications, users and business
partners on the network, each of which creates additional risks. Furthermore,
firewalls are vulnerable to hackers and others seeking to compromise network
integrity and fail to protect against an improper use of the systems by internal
authorized users within the network. In addition to encryption and firewalls,
many organizations deploy operating system security mechanisms, such as user
authentication, passwords and multi-level access rights, to prevent unauthorized
access to information by external as well as internal users. Implementation
issues such as easily-guessed passwords or default accounts left on newly
installed devices diminish the effectiveness of these measures. Passive point
tools do not address the fundamental issue that "open" systems are, by
definition, open and that their inherent utility is itself the source of their
vulnerability. This conflict between the benefits of open systems and the risks
of their unauthorized use or disruption has not been widely recognized or
addressed by IT managers.
 
     To be effective, passive point tools that secure specific elements of an
enterprise network need to be coordinated through an enterprise-wide computer
security policy with systems to automatically enforce and evaluate the
effectiveness of that policy. Many organizations have developed security
policies that address the appropriate use of network resources, the proper
configuration of network services, operating systems and applications and
actions to be taken if there is a violation of such policy or an
                                       27
<PAGE>   31
 
attack on the network; however, such organizations have not had the systems to
automatically enforce and implement such policies across their entire IT
infrastructure. Without such systems, the dynamic nature of enterprise networks
causes the organization's actual security practice to diverge from the stated
security policy, potentially exposing the organization to additional
unanticipated risks. Direct observation of vulnerabilities and threats can allow
an organization to define and automatically enforce an integrated,
enterprise-wide security policy that can be managed centrally and implemented on
a distributed basis. Because of the shortage of personnel trained in network
security issues, any security solution must be easy to use by both management
and the organization's existing IT personnel. An effective network security
solution also needs to work with existing security technologies as well as be
flexible enough to incorporate new technologies.
 
THE ISS SOLUTION
 
   
     ISS has developed Adaptive Security Management, a dynamic, process-driven
approach to enterprise-wide network protection. The ASM process relies on the
principles of monitoring, detection and response to the ever-changing
vulnerabilities in and threats to the network protocols, operating systems and
applications that comprise every network system. The Company's monitoring,
detection and response products provide easy-to-use software solutions designed
to enable network managers to centrally define and manage an enterprise-wide
security policy for their existing network system infrastructure, including all
IP-enabled devices. The Company's SAFEsuite family of products provides the
ability to visualize, measure and analyze real-time security vulnerabilities and
control threats across the entire enterprise network infrastructure, keeping the
organization's IT personnel informed of changing network conditions and
automatically making adjustments as necessary. Through custom policies or by
using the Company's "best practice" templates, network managers can minimize
security risks without closing off the organization's network to the benefits of
open computing environments and the Internet. The Company's solution reaches
beyond the traditional approaches to network security in the following respects:
    
 
     ADAPTIVE SECURITY MANAGEMENT
 
     ASM is a proactive, risk management-based approach to network security
management that links security practice and security policy through a continuous
improvement process. ASM incorporates four critical processes: (i) continuously
monitoring network traffic and the configuration of devices on the network; (ii)
detecting security risks in network traffic and network devices; (iii)
responding to network security risks to minimize such risks; and (iv) reporting
response actions and updating security policies. The Company's products
incorporate the ASM approach to enable continuous improvement to the security of
the customer's existing systems by identifying and minimizing the security risks
on the network. The Company's SAFEsuite family of products continuously monitors
the network for security risks that violate the customer's security policy and
provides actions to eliminate or minimize the security weaknesses. SAFEsuite is
a critical enhancement to traditional passive security technologies such as
encryption, firewalls and authentication. The Company's products provide a
unique, active component to an organization's overall security infrastructure
that enables end-to-end network protection. The software automatically
identifies systems and activities that are not in compliance with a customer's
policies, and provides a critical feedback mechanism for adjusting the security
levels of networked systems based upon its findings. Without these capabilities,
an organization is limited in its ability to effectively measure and control
security across its enterprise network.
 
     COMPREHENSIVE ENTERPRISE SECURITY SOLUTION
 
     ISS combines ASM principles with its extensive knowledge of network
vulnerabilities and threats to provide scalable security solutions. The Company
sells its products individually as solutions to problems for a particular
network function or as a suite of products that provide a comprehensive network
security framework. The Company's products extend across a broad range of
platforms and work with the products of leading security and network management
vendors to provide a single point of management and control for an
enterprise-wide security policy across multiple hosts, operating systems and
 
                                       28
<PAGE>   32
 
applications. Products are designed to be easily installed, configured, managed
and updated by a system administrator through an intuitive graphical user
interface ("GUI") without interrupting or affecting network operation. The
Company's products generate easy-to-understand reports ranging from
executive-level trend analysis to detailed step-by-step instructions for
eliminating security risks that include automatic links to vendor Web sites for
software patches.
 
     THE "X-FORCE"
 
   
     Because there are few IT professionals specifically trained in network
security issues, the Company created a senior research and development team
composed of security experts who are dedicated to understanding, documenting and
coding new vulnerability tests, real-time threats and attack signatures. The
team is known in the industry as the "X-Force". The X-Force conducts primary
research in the field of vulnerability and threat science, which is the basis of
the core competency of the Company. The Company believes that the X-Force is one
of the largest and most sophisticated groups of IT security experts researching
vulnerability and threat science and therefore represents one of the Company's
competitive advantages. Organizations such as CERT (Computer Emergency Response
Team), the FBI and leading technology companies routinely consult the X-Force on
network security issues. Through the X-Force, ISS maintains a proprietary and
comprehensive knowledge base of computer exploits and attack methods, including
what the Company believes is the most extensive collection of Windows NT
vulnerabilities and threats. To respond to an ever-changing risk profile, the
X-Force continually updates this knowledge base with the latest network
vulnerability information, which aids in the design of new products and product
enhancements.
    
 
STRATEGY
 
     The Company's objective is to be the leading provider of ASM systems that
proactively protect the integrity and security of enterprise-wide information
systems from vulnerabilities, misuse, attacks and other policy violations. ISS
focuses on developing innovative and automated software solutions to provide
customers with a comprehensive framework for protecting their networks by
monitoring for vulnerabilities and real-time threats in order to enforce "best
practice" network and system security policies. Key elements of the Company's
strategy are to:
 
     - CONTINUE LEADERSHIP POSITION IN SECURITY TECHNOLOGY.  The Company intends
      to maintain and enhance its technological leadership in the enterprise
      security market by hiring additional network and Internet security
      experts, broadening the Company's proprietary knowledge base and
      continuing to invest in product development and product enhancements. By
      solidifying its position as the leader in the emerging market for
      monitoring, detection and response software, the Company believes that
      customers and potential customers will view ISS as the firm of choice for
      establishing and maintaining effective security practices and policies.
 
   
     - EXPAND DOMESTIC SALES CHANNELS.  To increase the distribution and
      visibility of its products, ISS plans to execute its enterprise-wide
      systems sales strategy by expanding its regional direct sales program and
      to increase market coverage by establishing additional indirect channels
      with key ISPs, systems integrators, VARs, OEMs and other channel partners
      to address enterprise-wide system opportunities. As the potential customer
      base for network security products encompasses a wide variety of
      industries, the Company believes that a multi-channel sales efforts will
      build customer awareness of the need for the Company's products and enable
      the Company to more rapidly penetrate these industry markets.
    
 
   
     - PROMOTE PROFESSIONAL SERVICES CAPABILITIES.  ISS intends to establish
      long-term relationships with its customers by serving as a "trusted
      advisor" in addressing network security issues. To fulfill this
      responsibility to its customers, the Company will expand its professional
      services capabilities to provide additional security system design,
      planning, installation, testing and consulting services to assist
      customers in the effective adaptation of their security policies as new
      computing products and systems are deployed or new users or infrastructure
      to existing systems are added. By providing professional services, the
      Company can heighten customer awareness
    
 
                                       29
<PAGE>   33
 
      about network security issues, which creates opportunities for ISS to sell
      new products or product enhancements to its existing customers.
 
     - EXPAND INTERNATIONAL OPERATIONS.  ISS plans to aggressively expand its
      international operations to address the rapid global adoption of
      distributed computing environments. Many foreign countries do not have
      laws recognizing network intrusion or misuse as a crime or the resources
      to enforce such laws if they do exist, and therefore, the Company believes
      that organizations in such countries will have greater need for effective
      security solutions. The Company currently maintains international offices
      in Belgium, Canada, England, France, Germany and Japan. ISS plans to
      expand in those regions where businesses, governments and other
      institutional users are using distributed networks and the Internet for
      their mission-critical needs.
 
     - CREATE ASM CATEGORY AWARENESS.  The Company intends to increase and
      broaden awareness of the need for ASM and the Company's enterprise
      monitoring, detection and response systems by increasing its level of
      public relations, educational events, seminars, advertising, direct
      marketing and trade show participation. ISS believes that the risks and
      dangers associated with the adoption of open computing systems have not
      received the same level of general recognition or publicity as have the
      benefits of using such systems. By increasing awareness of the
      vulnerabilities and threats that are endemic to open computing
      environments and the ability to manage such vulnerabilities and threats
      through ASM, the Company can demonstrate to its customers how better
      network protection can be achieved.
 
PRODUCT ARCHITECTURE
 
     The ISS SAFEsuite family of products delivers the Company's ASM approach
through a flexible architecture designed to be integrated with existing security
and network system infrastructures. Passive point tools such as firewalls
provide specific security functionality for components within the network
infrastructure. SAFEsuite enhances the effectiveness of these tools by
monitoring them for threats and vulnerabilities and responding with actions that
align the customer's security practice with its security policy. SAFEsuite
complements network and security management frameworks by providing information
required for informed decisions to minimize security risks while maintaining the
desired level of network functionality. Thus, the Company's products provide a
risk management-based approach to security with scalable deployment of
best-of-breed products and integrated enterprise-wide implementations.
 
     The following depicts the SAFEsuite product architecture:
 
   
CHART
    
 
                                       30
<PAGE>   34
 
     The Adaptive Security Application Programming Interface ("ASAPI") is the
focal point for automated interaction with static security technologies such as
encryption, firewalls and authentication servers. ASAPI is a two-way
communication protocol that allows SAFEsuite products to leverage information
and capabilities available across the network and to proactively adapt
configurations of security subsystems on the network. For example, SAFEsuite
products identify valid Java and ActiveX applets in Web traffic by using the
authentication information available in digital certificates such as those from
VeriSign. When a security risk is identified, ASAPI is used to send a message
directly to the appropriate passive protection tool to eliminate the risk (e.g.,
when an attacker is identified, the firewall is automatically reconfigured to
block the attacker's IP address). ASAPI leverages existing infrastructure
control standards such as Check Point Software Technologies' OPSEC (Open
Platform for Secure Enterprise Connectivity), allowing deployment of the
Company's products without requiring upgrades or changes to the customer's
existing hardware or software.
 
     The SAFEsuite policy management interface lets the customer choose from
"best practice" templates or provides the ability to define a specific policy
that establishes the level of risk appropriate for the network. The individual
products automatically verify compliance with the policy in terms of actual
system configuration and activity present on the network. Graphical reports
express the deviations from the established policy, including the measures
required to reduce the risk. The policy can include automatic intervention by a
SAFEsuite product through ASAPI.
 
     This product architecture allows all the SAFEsuite technologies to connect
directly into common standards, providing comprehensive security reports for the
entire enterprise. To ensure communication confidentiality between individual
SAFEsuite components and to prevent misuse, SAFEsuite uses RSA encryption
algorithms, which have become de facto encryption standards. The SAFEsuite
Security Repository, a database containing information about the devices and
security risks on a customer's network, utilizes an Open Database Connectivity
("ODBC") interface and allows customers to select their preferred database such
as Oracle, Microsoft SQL Server, Sybase, Informix or any ODBC-compliant database
for data storage. All ISS products use a common taxonomy for identifying
specific security issues. The various SAFEsuite products consolidate security
data, enabling the user to quickly determine its risk posture and take
appropriate actions. In addition, SAFEsuite products provide automated decision
support by assessing priorities and providing a graphical representation of
important security risk data sets. This allows key decision-makers to prioritize
their program strategies for effective deployment of resources to minimize
security risks.
 
   
     The SAFEsuite architecture also delivers scalability in deployment options,
usage models and ongoing operations. Each SAFEsuite product can be deployed as a
stand-alone, best-of-breed solution to meet the needs of the local administrator
or departmental user. Through support for remote, multi-level management
consoles and the SAFEsuite Security Repository, enterprise-level users can
analyze security risk conditions for the entire network. The SAFEsuite Security
Repository allows the customer to address both vulnerabilities and threats,
thereby minimizing network security risk and associated costs. SAFEsuite's
frequent updates integrate the latest identified security vulnerabilities and
threats into the operations of an existing ISS product installation.
    
 
                                       31
<PAGE>   35
 
PRODUCTS
 
     The following table lists the SAFEsuite products currently offered by the
Company, and includes a brief description of each product's functionality and
current list pricing:
 
<TABLE>
<CAPTION>
 
                                                                                             INTRODUCTION
                                    DESCRIPTION             SCOPE        U.S. LIST PRICE         DATE
<S>                           <C>                       <C>              <C>               <C>
- ------------------------------------------------------------------------------------------------------------
   NETWORK SECURITY VULNERABILITY DETECTION, ANALYSIS AND REPORTING
- ------------------------------------------------------------------------------------------------------------
 Internet Scanner             Comprehensive security    50 devices           $ 3,495       October 1992
                              assessment for all        100 devices          $ 5,395
                              devices on an enterprise  500 devices          $14,650
                              network
- ------------------------------------------------------------------------------------------------------------
 Intranet Scanner             Security assessment for   10 devices           $   795       August 1996
                              internal devices on an    20 devices           $ 1,495
                              enterprise network        50 devices           $ 2,995
- ------------------------------------------------------------------------------------------------------------
 Firewall Scanner             Security assessment for   1 firewall           $   995       August 1996
                              firewalls and gateways    5 firewalls          $ 4,495
                                                        10 firewalls         $ 7,995
- ------------------------------------------------------------------------------------------------------------
 Web Security Scanner         Security assessment for   1 Web server         $   495       August 1996
                              Web servers               5 Web servers        $ 1,995
                                                        10 Web servers       $ 3,495
- ------------------------------------------------------------------------------------------------------------
   INTERNAL SYSTEM SECURITY VULNERABILITY DETECTION, ANALYSIS AND REPORTING
- ------------------------------------------------------------------------------------------------------------
 System Security              Internal security         5 computers          $ 1,995       January 1997
  Scanner -- S3               assessment for            10 computers         $ 3,495
                              operating systems         20 computers         $ 5,995
- ------------------------------------------------------------------------------------------------------------
 
   NETWORK SECURITY THREAT AND MISUSE DETECTION, ANALYSIS AND RESPONSE
- ------------------------------------------------------------------------------------------------------------
 RealSecure                   Real time attack          1 engine             $ 4,995       December 1996
                              recognition, misuse       5 engines            $19,900
                              detection and response    10 engines           $34,900
                              for networks
- ------------------------------------------------------------------------------------------------------------
</TABLE>
 
     INTERNET SCANNER
 
     Internet Scanner provides automated security vulnerability detection and
analysis for devices on a network and supports the security risk management
process from policy development through implementation. In addition, Internet
Scanner performs scheduled or event-driven probes of network communication
services, operating systems, routers, e-mail and Web servers, firewalls and
applications to identify weaknesses that could be exploited by intruders to gain
access to the network. After selecting from a list of pre-defined "best
practice" templates or customizing a template appropriate for the organization,
Internet Scanner quickly produces a technical security policy document with
detailed implementation instructions. Internet Scanner can then assess the
entire network for compliance with the security policy, identifying the specific
instances where security practice does not match the prescribed policy. Internet
Scanner identifies and prioritizes security risks and generates a wide range of
reports ranging from executive-level trend analysis to detailed step-by-step
instructions for eliminating security risks including automatic links to vendor
Web sites for software patches.
 
                                       32
<PAGE>   36
 
     Internet Scanner is also packaged as separate modules -- Intranet Scanner,
Web Security Scanner and Firewall Scanner -- each targeted for specific market
segments. The Internet Scanner embodies all three network-scanning modules.
 
   
     INTRANET SCANNER.  Intranet Scanner assesses the vulnerability of a network
to attack from intruders who have penetrated a firewall by systematically
probing each network device to identify security vulnerabilities. Network
platforms and devices, including Windows NT and Windows 95, Unix hosts, routers,
e-mail servers, Web servers and firewalls, are among those automatically checked
by Intranet Scanner. Many system operators typically focus security measures on
only those devices within the system that contain the most sensitive
information. Other devices often are left vulnerable, thus enabling unauthorized
users to compromise a less sensitive device (like a Unix printer server) to gain
access that can springboard them into more sensitive systems. Intranet Scanner
scans for such weak-link vulnerabilities in the chain of devices in the network,
including vulnerabilities arising from the use of default and easily-guessable
passwords for devices within the system, misconfigured file system servers and
unprotected Windows NT registry settings. Intranet Scanner not only determines
if an intruder could gain access, but also ascertains if a device is susceptible
to denial of service attacks by vandals who may seek to deny access to or use of
systems by authorized users.
    
 
   
     WEB SECURITY SCANNER.  Web Security Scanner tests the configuration of a
Web server, evaluates the security of the underlying operating system and
determines whether the Web server application has been updated with the latest
security patches. This module searches the Web server's common gateway
interface, active server page scripts and HTML (hypertext mark-up language)
directories to detect whether known vulnerabilities exist within the customer's
Web server system. For private HTML pages that are password protected, Web
Security Scanner assesses vulnerability to a "brute-force attack" (i.e., a
flooding of log-on attempts in an effort to overwhelm password screening and
thereby gain unauthorized access) through checks of easily-guessable or default
passwords. Finally, Web Security Scanner identifies any Java and ActiveX applets
on the Web server that may conflict with the customer's security policy.
    
 
     FIREWALL SCANNER.  Firewall Scanner identifies vulnerabilities by
monitoring the configuration of firewalls through a series of security checks.
The improper configuration of a firewall can seriously compromise the
effectiveness of the firewall as a security measure. Firewall Scanner's checks
include attempting to bypass the firewall by trying to connect through packet
filter-based firewalls, stateful inspection-based firewalls and application
proxy servers. Blocked or permitted connections validate the firewall's
configured filter rules. A firewall permitting an outside connection through to
an inside vulnerable server can provide an intruder with the opportunity to
compromise the entire network. The Firewall Scanner determines whether a SNMP
(simple network management protocol) is enabled on the firewall allowing
sensitive network information to be obtained by intruders and determines whether
a vandal can bring down a firewall through numerous denial of service attacks.
 
     In addition, the Company offers Advanced Packet Exchange ("APX") as a
recent enhancement for Firewall Scanner. APX provides a GUI that facilitates the
creation of low-level custom network packets. It then attempts to transmit them
through the firewalls or routers conducting packet validation. This determines
whether these packets were allowed or blocked at the gateway. By doing so, this
technology enables more precise testing and assessment of the security rules
associated with network access controls.
 
     SYSTEM SECURITY SCANNER
 
   
     System Security Scanner provides a host-based security assessment analyzing
internal security weaknesses. While the Internet Scanner determines
vulnerabilities by scanning devices at the network level, S3 detects
vulnerabilities internally at the system level by having an S3 agent resident on
the devices. These S3 agents allow a continuous security policy to be managed
and controlled across an enterprise from a central point. S3 compares an
organization's stated security policy with the actual configuration of the host
computer for potential security risks, including easily-guessed passwords, user
    
 
                                       33
<PAGE>   37
 
privileges, file system access rights, service configurations, data integrity,
and the existence of Trojan backdoors and suspicious activity that indicate an
intrusion. S3 verifies that the components of the operating system have been
updated with the latest patches from the operating system vendor. Each security
risk is prioritized by S3, which also generates scripts that implement the
appropriate corrective action.
 
     REALSECURE
 
     RealSecure is an automated, real-time intrusion detection, misuse and
response system for computer networks. The RealSecure Attack Recognition Engine,
which unobtrusively analyzes packets of information as they travel across the
network, recognizes hostile activity on a network by interpreting network
traffic patterns that indicate attacks. RealSecure's Suspicious Reassembly
algorithm analyzes packets for unusual formations that can indicate an attack
while simultaneously protecting RealSecure itself from these attacks. When an
attack is recognized, the administrator is alerted via e-mail and an alarm is
displayed on the central management console. In addition, the attack can be
terminated automatically, logged to a database, or recorded for later forensic
analysis. With RealSecure's distributed architecture, customers can install
Attack Recognition Engines throughout their enterprise network to detect and
stop internal misuse as well as attacks from outside the network perimeter.
Increasing network speeds and numbers of attacks geometrically increase the
potential workload for attack recognition solutions. RealSecure utilizes the
Company's Digital FingerPrinting to recognize a large number of attack-patterns
on high-speed networks. Additionally, the Company's Adaptive Filtering Algorithm
tunes the packet filter rules in response to network load, allowing the engine
to effectively function during bursts in network traffic.
 
PRODUCT PRICING
 
     ISS uses a range of fee structures to license its products, depending on
the type of product and the intended use. The vulnerability detection
products -- the Internet Scanner family of products and System Security
Scanner -- are licensed based on the number of devices being scanned. The
pricing scheme is scalable, providing low entry points for departmental users
without capping the Company's revenue for large networks. Pricing for the threat
detection product, RealSecure, is based on the number of engines deployed on the
network. Thus, licensing fees for the Company's products are ultimately
determined by the size of the customer's network, as the size will dictate the
number of devices to be scanned or the number of engines to be deployed for a
given performance level. In addition to license fees, customers virtually always
purchase maintenance agreements in conjunction with their purchase of a software
license for annual maintenance fees equal to 20% of the product's list price;
maintenance agreements include annually renewable telephone support, product
updates, access to the Company's X-Force Security Alerts and error corrections.
The Company's continuing research into new security risks and resultant product
updates provides significant ongoing value, and as a result, a substantial
majority of the Company's customers purchase maintenance agreements. Customers
who use the Company's products to provide IT consulting services have license
agreements that are based on a revenue sharing model. ISS has historically sold
fully-paid perpetual licenses with a renewable annual maintenance fee, but it is
currently in the process of increasing the licensing of its products on a
subscription basis (which includes maintenance) for one or two year periods.
 
SERVICES
 
     ISS offers specialized consulting and training services that are designed
to complement the general knowledge and experience derived by IT professionals
with specific information and assistance to promote customer success in the use
of the Company's products.
 
     The Company's Professional Services Group assists customers in the
successful implementation of the Company's products. The Professional Services
Group's senior operational and technical consultants work with the Company's
customers to identify potential security risks within the customer's operations,
business processes and constraints in order to develop an implementation
strategy that will configure
                                       34
<PAGE>   38
 
products in a manner that balances the customer's need for system security with
ease-of-use and flexibility requirements. In this manner, ISS consultants assist
customers in mapping the deployment of the Company's products to the customer's
network and security policy and the metrics for assessing the effectiveness of
and enforcing the security policy. The Company charges its customers for
professional services on a time and materials basis.
 
   
     In addition to performing consulting services for customers, ISS provides
focused education and training in the use of its products and with respect to
security issues through the ISS University program. Students who complete the
curriculum and pass both a hands-on product test and a written test become ISS
Certified Engineers. See "-- Customer Service and Support".
    
 
PRODUCT DEVELOPMENT
 
     The Company has developed its SAFEsuite products to operate in
heterogeneous computing environments. Products are compatible with other
vendors' products across a broad range of platforms, including Windows NT,
Windows 95, Sun Solaris, SunOS, SGI IRIX, Linux, HP-UX and IBM AIX. The Company
incorporates a modular design to permit plug-and-play capabilities for its
products, although customers often use professional services provided by the
Company or its strategic partners to install and configure products for use in
larger or complex network systems.
 
     The Company employs a two-pronged product development strategy to achieve
its goal of providing the most comprehensive security coverage within the
monitoring, detection and response market. First, the Company will continue to
develop best-of-breed security products to address particular network
configurations. Such new products, and the Company's existing products like
Internet Scanner, System Security Scanner and RealSecure, are updated
approximately every four to six months to add new features, improve
functionality and incorporate responses to vulnerabilities and threats that have
been added to the Company's vulnerability and threat database. These updates are
usually provided as part of separate maintenance agreements sold with the
product license.
 
   
     Second, to complement its existing products and provide more comprehensive
security coverage to networks, the Company is expanding its existing SAFEsuite
products by developing additional enterprise-level products that incorporate ASM
principles. These products will add functionality to the Company's existing
product line by allowing customers to protect their network by continuously
measuring and analyzing the status of their network's security, and by
monitoring and controlling the security risks in real time across the enterprise
network. These new products will be interoperable with existing Company
products, allowing modular implementation.
    
 
     Expenses for product development were $97,000, $1.2 million and $3.4
million in 1995, 1996 and 1997, respectively. All product development activities
are conducted at the Company's principal offices in Atlanta, where, as of
December 31, 1997, 48 personnel were employed in product development teams. In
addition, Company personnel are members of the Computer Security Institute,
Forum for Incident Response and Security Technicians (FIRST), Georgia Tech
Industrial Partners Association and the International Computer Security
Association (ICSA), enabling the Company to actively participate in the
development of industry standards in the emerging market for network and
Internet security systems and products.
 
CUSTOMERS
 
   
     As of December 31, 1997, the Company had licensed versions of its SAFEsuite
family of products to over 1,500 customers. No customer accounted for 10% of the
Company's consolidated revenues in 1996 or 1997. The Company's target customers
include both public and private sector organizations that utilize IP-enabled
information systems to facilitate mission-critical processes in their
operations. The Company's customers represent a broad spectrum of organizations
within diverse sectors, including financial services, technology,
telecommunications, government and services.
    
 
                                       35
<PAGE>   39
 
   
     The following is a list of certain of the Company's customers that have
purchased licenses and services from the Company with an aggregate price of at
least $15,000 and which the Company believes are representative of its overall
customer base.
    
 
FINANCIAL SERVICES
Charles Schwab
First Union
KeyCorp
Merrill Lynch
PNC Bank
 
TECHNOLOGY
Hewlett-Packard
IBM
Intel
Lucent Technologies
Microsoft
NCR
Siemens
   
VeriSign
    
Xerox
 
OTHER
Lockheed Martin
Merck

TELECOMMUNICATIONS
America Online
Bell Atlantic
BellSouth
GTE Internetworking
NETCOM On-Line Communications
Nippon Telephone & Telegraph
 
GOVERNMENT
NASA
Salt River Project
U.S. Department of the Air Force
U.S. Department of the Army
U.S. Department of Defense
U.S. State Department
 
SERVICES
EDS
KPMG Peat Marwick
Price Waterhouse
SAIC
SITA
 
SALES AND MARKETING
 
     SALES ORGANIZATION
 
   
     The Company's sales organization is divided regionally among the Americas,
Europe and the Asia/Pacific regions. In the Americas region, ISS markets its
software primarily through its direct sales organizations augmented by its
indirect channels, including security consultants, VARs and systems consulting
and integration firms. The direct sales organization for the Americas consists
of regionally-based sales representatives and sales engineers and a tele-sales
organization located in Atlanta. At December 31, 1997, the Company's sales
offices were located in the Atlanta, Austin, Boston, Chicago, Cincinnati,
Dallas, Los Angeles, New York, Palo Alto, Philadelphia, San Francisco, Toronto
and Washington, D.C. metropolitan areas. A dedicated group of professionals in
the Atlanta headquarters covers Latin America. As of December 31, 1997, the
Company employed 35 people in the Americas region direct sales organization. The
regionally-based direct sales representatives focus on opportunities where the
Company believes it can realize more than $200,000 in revenues.
    
 
     In the Europe and Asia/Pacific regions, substantially all of the Company's
sales occur through authorized resellers. Internationally, the Company has
established regional sales offices in Brussels, London, Paris, Stuttgart and
Tokyo. Personnel in these offices are responsible for market development,
including managing the Company's relationships with its resellers, assisting
them in winning and supporting key customer accounts and acting as a liaison
between the end user and the Company's marketing and product development
organizations. As of December 31, 1997, 15 employees were located in the
Company's Europe and Asia/Pacific regional offices. The Company expects to
continue to expand its field organization into additional countries in these
regions.
 
                                       36
<PAGE>   40
 
     SECURITY PARTNERS PROGRAM
 
     The Company has established its Security Partners Program to train and
organize security consulting practices, ISPs, systems integrators and VARs to
match the Company's products with their own complementary products and services.
By reselling SAFEsuite products, Security Partners provide additional value for
specific market and industry segments, while maintaining the Company's ongoing
commitment to quality software and guaranteed customer satisfaction. To support
the varying needs of different partners, ISS has established four different
levels of partnership opportunities: Consulting Partners, Premier Partners,
Authorized Partners and Registered Partners. Consulting Partners consist of
general systems integrators and others who use the Company's products to provide
information security services for their clients. Consulting Partners may
purchase travelling licenses that can be used for one concurrent user for one
year. Premier Partners combine sales and integration of encryption, firewall and
authentication technologies with the Company's products. Authorized and
Registered Partners must purchase products from Premier Partners. In addition,
all Security Partners are required to employ a designated number of ISS
Certified Engineers. ISS provides its partners with technical support, sales and
marketing tools, quarterly rebates and other sales incentives and cooperative
marketing funds at varying levels depending on the level of partnership.
 
     MARKETING PROGRAMS
 
   
     The Company conducts a number of marketing programs to support the sale and
distribution of its products. These programs are designed to inform existing and
potential OEMs, resellers and end-user customers about the capabilities and
benefits of the Company's products. Marketing activities include: press
relations and education; publication of technical and educational articles in
industry journals and in the Company's on-line magazine, ISS Alert;
participation in industry tradeshows; product/technology conferences and
seminars; competitive analysis; sales training; advertising; development and
distribution of Company literature; and maintenance of the Company's Web site. A
key element of the Company's marketing strategy is to establish the Company's
products and its ASM model as the leading approach for enterprise-wide security
management. The Company has implemented a multi-faceted program to leverage the
use of the SAFEsuite product family and increase its acceptance through
relationships with various channel partners:
    
 
          STRATEGIC RESELLERS.  Although the Company has numerous resellers,
     certain of these relationships have generated significant leverage for the
     Company in targeted markets. The Company's strategic resellers, which
     include EDS, SAIC, Siemens, Softbank and Tivoli Systems, provide ISS broad
     brand awareness through enhanced marketing activity, access to large sales
     forces, competitive control points and access to larger strategic customer
     opportunities.
 
          CONSULTANTS.  The use of the Company's products by security
     consultants not only generates revenue for the Company from the license to
     the consultant, but also provides the Company with leads to potential end
     users with a concern for network security. Consultants who have generated
     substantial leads for the Company's sales organization include Andersen
     Consulting, Deloitte Touche Tohmatsu International, IBM, KPMG Peat Marwick
     and Price Waterhouse.
 
          ISPS.  The Company licenses its products to certain ISPs to be used as
     part of their value-added services for their customers. With the Company's
     products, ISPs can offer their users perimeter vulnerability scanning and
     assessment, intrusion detection for Web services and applications that
     typically reside outside the firewalled perimeter. ISS licenses its
     products to BellSouth, GTE, PSINet and other ISPs for these purposes and
     receives a percentage of the value-added revenue stream.
 
          OEMS.  A number of vendors of security products, including NCR and ODS
     Networks, have signed OEM agreements with the Company. These agreements
     enable OEMs to incorporate the Company's products into their own security
     offerings to provide a complete security package. The Company receives
     royalties from OEM vendors and increased acceptance of the Company's
 
                                       37
<PAGE>   41
 
     products under these arrangements, which in turn promotes sales of the
     Company's other products to the OEM's customers.
 
   
     The Company typically enters into written agreements with its strategic
resellers, consultants, ISPs and OEMs. These agreements generally do not provide
for firm dollar commitments from the strategic parties, but are intended to
establish the basis upon which the parties will work together to achieve
mutually beneficial objectives.
    
 
   
ADVISORY BOARD
    
 
   
     The Company established an Advisory Board in February 1998, and its members
currently consist of the following individuals of recognized stature in certain
key industries, to further the Company's sales and recruiting efforts:
    
 
   
          SAM NUNN.  Mr. Nunn has been a partner in the Atlanta law firm of King
     & Spalding since January 1997 and is the current co-chair of the
     President's Critical Infrastructure Protection Program sanctioned by
     Executive Order 13010. Previously, he served in the United States Senate
     for four terms starting in 1972. Mr. Nunn is a director of The Coca-Cola
     Company, General Electric Company, Scientific-Atlanta, Inc., Texaco, Inc.
     and Total System Services, Inc.
    
 
   
          JOHN P. IMLAY, JR.  Mr. Imlay is Chairman of Imlay Investments, Inc.,
     and serves on the board of directors of the Atlanta Falcons, Gartner Group,
     Inc., Metromedia International Group, Inc. and several other organizations.
     He was Chairman of Dun & Bradstreet Software Services, Inc., a software
     company, from March 1990 until November 1996. Prior to that he was Chairman
     and Chief Executive Officer of Management Science America, Inc., a company
     that was acquired by Dun & Bradstreet Software Services, Inc.
    
 
   
     The Advisory Board members advise the Company on long-term strategic
growth, including strategies for selling to key industries, recruitment of board
members and other key personnel, and trends in national and international policy
influencing the Company's products and services. The Company also anticipates
that Advisory Board members will provide high visibility for ISS at industry
events and will play key roles in leading Customer User Groups to support the
growth and prominence of the Company. Members of the Advisory Board meet
individually or as a group with the management of the Company from time to time
and are compensated through issuances of Common Stock or options to acquire
Common Stock.
    
 
CUSTOMER SERVICE AND SUPPORT
 
     The Company provides ongoing product support services under its license
agreements. Maintenance contracts are typically sold to customers for a one-year
term at the time of the initial product license and may be renewed for
additional periods. Under its maintenance agreements with its customers, the
Company provides, without additional charge, telephone support, documentation
and software updates and error corrections. Customers that do not renew their
maintenance agreements but wish to obtain product updates and new version
releases are generally required to purchase such items from the Company at
market prices. In general, major new product releases come out annually, minor
updates come out every four to six months and new checks come out every two to
four weeks. All product updates are available to customers with current
maintenance agreements for downloading from the Company's Web site.
 
     The Company believes that providing a high level of customer service and
technical support is necessary to achieve rapid product implementation which, in
turn, is essential to customer satisfaction and continued license sales and
revenue growth. Accordingly, the Company is committed to continued recruiting
and maintenance of a high-quality technical support team. The Company provides
telephone support to customers who purchase maintenance agreements along with
their product license. A team of dedicated engineers trained to answer questions
on the installation and usage of the SAFEsuite products provides telephone
support from 8:00 a.m. to 6:00 p.m., Eastern time, Monday through Friday, from
the
 
                                       38
<PAGE>   42
 
Company's corporate office in Atlanta. The Company provides telephone support 24
hours a day, seven days a week through a call-back procedure to certain
customers who pay an additional fee for the service. In the United States and
internationally, the Company's VARs provide telephone support to their customers
with technical assistance from the Company.
 
     Because security-knowledgeable IT personnel are in extremely short supply
throughout the industry, ISS provides focused education and training in the use
of its products and security issues through the ISS University program.
Education on security effectiveness and minimizing security risks in IT
infrastructure are natural extensions of the Company's position as a provider of
network security monitoring, detection and response systems. ISS University
offers certification on ISS products through the ICE (ISS Certified Engineer)
program. ISS University also offers a CNSE (Certified Network Security Engineer)
degree for network security management. The Company's reputation as a security
expert provides the basis for the value of such security degrees. Leveraging the
efforts of current security training organizations accelerates the acceptance of
the Company's certification program by the industry. Participation hours, or
credits, received from other complementary security training programs, such as
those offered by Computer Security Institute, MIS Training and similar
organizations, can be applied towards the hours required to be completed in the
ISS University program.
 
COMPETITION
 
     The market for monitoring, detection and response products and services is
intensely competitive and the Company expects competition to increase further in
the future. The Company believes that the principal competitive factors
affecting the market for network security products include security
effectiveness, manageability, technical features, performance, ease of use,
price, scope of product offerings, distribution relationships and customer
service and support. Although the Company believes that its SAFEsuite family of
products generally competes favorably with respect to such factors, there can be
no assurance that the Company can maintain its competitive position against
current and potential competitors, especially those with significantly greater
financial, marketing, service, support, technical and other competitive
resources.
 
     The Company's principal competitors generally fall within one of three
categories: internal IT departments or consulting firms that assist such
departments, relatively smaller software companies that offer applications with
limited scope and larger software companies that are either in the process of
entering the Company's market or have the potential to develop products to
compete with the Company's products. Due to a lack of awareness of the Company's
products and services or a lack of appreciation of the complexity involved in
the development of automated systems to establish, and more importantly,
maintain comprehensive and effective levels of security within a distributed
computing environment, potential customers often rely on their IT departments to
internally formulate security systems or to retain consultants to undertake such
a project. However, because experts in security issues are in extremely short
supply, such in-house solutions typically fail to provide a comprehensive and
sophisticated approach to security, are not designed to adapt to changing
security policies and are extremely expensive to develop. The Company expects
that as IT consulting firms learn of the Company's products and their relative
cost, they will be less inclined to undertake projects that require them to
independently develop systems with functionalities similar to the Company's
products.
 
   
     In addition, a number of companies currently market or have under
development software applications to provide network and Internet security. The
Company believes that, to date, none of these relatively smaller companies offer
products that are as robust in features or as comprehensive in scope as the
SAFEsuite family of products. Although it is likely that the product development
efforts of these companies will eventually enable them to offer a line of
products to compete with the Company's current product line, the Company intends
to continue to dedicate significant resources for product development and
recruiting in order to expand the Company's product capabilities ahead of these
competitors. Notwithstanding, the Company expects additional competition from
these established competitors and from other emerging companies. Mergers or
consolidations among these competitors or acquisitions of these companies by
larger competitors would make them more formidable competitors to the Company.
    
                                       39
<PAGE>   43
 
   
Recently, both Cisco Systems and Network Associates have announced acquisitions
of companies with products that compete with some of the Company's current
product offerings. Because the Company believes that Cisco Systems and Network
Associates will integrate these security products with their other product
offerings, the Company believes that its own products will compete favorably
based on the Company's product and platform functionality and Adaptive Security
Management approach. Notwithstanding, many of these larger companies have longer
operating histories, greater name recognition, access to larger customer bases
and significantly greater financial, technical and marketing resources than the
Company. As a result, they may be able to adapt more quickly to new or emerging
technologies and changes in customer requirements or to devote greater resources
to the promotion and sale of their products than the Company. The Company
believes that the entry of these larger companies into its market will require
them to undertake operations that are currently not within their core areas of
expertise, and thus expose them to significant uncertainties in the product
development process or in providing a range of products to comprehensively
address the security risks and vulnerabilities which the SAFEsuite product
family addresses. However, if these companies were to introduce products that
effectively competed with the Company's products, they could be in a position to
substantially lower the price of their security monitoring, detection and
response products or to bundle such products with their other products, which
would make it more difficult for the Company to compete with them. There can be
no assurance that the Company's current and potential competitors will not
develop security monitoring, detection and response products that may be more
effective than the Company's current or future products or that the Company's
technologies and products will not be rendered obsolete by such developments.
    
 
   
     Finally, there are a number of companies that currently market and sell
various software products, such as encryption, firewall, operating system
security and virus detection software, that have been broadly adopted by the
Company's customers and potential customers to provide various levels of
security within their computing environments. Some of these companies have
released products which provide similar functionality as certain of the
Company's products. Axent Technologies markets products that compete with some
of the Company's products. In addition, vendors of operating system software or
networking hardware may in the future enhance their products to include
functionality that is currently provided by the Company's products. The
widespread inclusion of the functionality of the Company's software as standard
features of operating system software or networking hardware could render the
Company's products obsolete and unmarketable, particularly if the quality of
such functionality were comparable to that of the Company's products.
Furthermore, even if the security monitoring, detection and response
functionality provided as standard features by operating systems software or
networking hardware is more limited than that of the Company's software, there
can be no assurance that a significant number of customers would not elect to
accept more limited functionality in lieu of purchasing additional software.
    
 
   
     For the foregoing reasons, there can be no assurance that the Company will
be able to compete successfully against its current and future competitors.
Increased competition may result in price reductions, reduced gross margins and
loss of market share, any of which would materially and adversely affect the
Company's business, operating results and financial condition. See "Risk
Factors -- Competition".
    
 
PROPRIETARY RIGHTS AND TRADEMARK ISSUES
 
     The Company relies primarily on a combination of copyright and trademark
laws, trade secrets, confidentiality procedures and contractual provisions to
protect its proprietary rights. The Company also believes that factors such as
the technological and creative skills of its personnel, new product
developments, frequent product enhancements, name recognition and reliable
product maintenance are essential to establishing and maintaining a technology
leadership position. The Company seeks to protect its software, documentation
and other written materials under the trade secret and copyright laws, which
afford only limited protection. The Company also has submitted one United States
patent application. There can be no assurance that a patent will issue from this
application or, if issued, that
 
                                       40
<PAGE>   44
 
such patent would provide meaningful competitive advantages to the Company. The
Company generally licenses SAFEsuite products to end users in object code
(machine-readable) format. Certain customers have required the Company to
maintain a source-code escrow account with a third-party software escrow agent,
and a failure by the Company to perform its obligations under any of the related
license and maintenance agreements, or the insolvency of the Company, could
conceivably cause the release of the Company's source code to such customers.
The standard form agreement allows the end user to use the SAFEsuite products
solely on the end user's computer equipment for the end user's internal
purposes, and the end user is generally prohibited from sublicensing or
transferring the products.
 
     Despite the Company's efforts to protect its proprietary rights,
unauthorized parties may attempt to copy aspects of the Company's products or to
obtain and use information that the Company regards as proprietary. Policing
unauthorized use of the Company's products is difficult, and while the Company
is unable to determine the extent to which piracy of its software products
exists, software piracy can be expected to be a persistent problem. In addition,
the laws of some foreign countries do not protect the Company's proprietary
rights to as great an extent as do the laws of the United States. There can be
no assurance that the Company's competitors will not independently develop
similar technologies.
 
     Although the Company is not aware that any of its products infringes the
proprietary rights of third parties, there can be no assurance that third
parties will not claim infringement by the Company with respect to current or
future products. The Company expects that software product developers will
increasingly be subject to infringement claims as the number of products and
competitors in the Company's industry segment grows and the functionality of
products in different industry segments overlaps. Any such claims, with or
without merit, could be time consuming, result in costly litigation, cause
product shipment delays or require the Company to enter into royalty or
licensing agreements. Such royalty or licensing agreements, if required, may not
be available on terms acceptable to the Company or at all, which could have a
material adverse effect upon the Company's business, operating results and
financial condition.
 
     The name "Internet Security Systems" is not currently subject to trademark
registration in the United States, and may not be a name for which a trademark
is registrable due to its general use in a variety of security-related
applications. Although the Company has in the past asserted and intends to
continue to assert its rights with respect to the name "Internet Security
Systems" and has taken and will take action against any use of such name in a
manner that may create confusion with the Company's products in relevant
markets, there can be no assurance that the Company will be successful in such
efforts, which could have a material adverse effect upon the Company's business,
operating results and financial condition.
 
EMPLOYEES
 
   
     As of December 31, 1997, the Company had 141 employees, of whom 48 were
engaged in product research and development, 50 were engaged in sales, six were
engaged in customer service and support, six were engaged in professional
services, 19 were engaged in marketing and business development and 12 were
engaged in administrative functions. The Company believes that its relations
with its employees are good.
    
 
FACILITIES
 
   
     The Company is in the process of relocating its Atlanta headquarters and
research and development facilities into approximately 47,000 square feet of
office space to be occupied pursuant to a sublease expiring in June 2002 which
has minimum annual lease obligations of approximately $842,000. Until such
relocation, these operations will continue to be conducted in Atlanta in
facilities totalling approximately 26,000 square feet under leases that
primarily expire in 1998. Under such leases, the Company paid approximately
$407,000 in 1997. The Company also leases office space for its sales and
marketing personnel in Austin, Boston, Chicago, Cincinnati, Dallas, Nashua, New
York, Palo Alto, Philadelphia, San Mateo and Washington, D.C., as well as
Brussels, London, Paris, Stuttgart, Tokyo and Toronto. The Company believes that
its existing facilities are adequate for its current needs and that additional
space will be available as needed.
    
 
                                       41
<PAGE>   45
 
                                   MANAGEMENT
 
DIRECTORS AND EXECUTIVE OFFICERS
 
     Set forth below is certain information concerning the directors and
executive officers of the Company.
 
<TABLE>
<CAPTION>
NAME                                AGE                         POSITION(S)
- ----                                ---                         -----------
<S>                                 <C>    <C>
Thomas E. Noonan..................  37     President, Chief Executive Officer and Chairman of the
                                             Board of Directors
Christopher W. Klaus..............  24     Chief Technical Officer, Secretary and Director
Richard Macchia...................  46     Vice President and Chief Financial Officer
H. Keith Cooley...................  44     Vice President (Engineering)
M. Thomas McNeight................  53     Vice President (Americas Sales)
Alex Bogaerts.....................  48     Vice President (Europe)
Lin Ja Hong.......................  39     Vice President (Asia/Pacific)
Richard S. Bodman.................  59     Director
Robert E. Davoli..................  49     Director
Kevin J. O'Connor.................  36     Director
David N. Strohm...................  49     Director
</TABLE>
 
   
     Mr. Noonan has served as the President and as a Director of ISS since
August 1995, and as its Chief Executive Officer and Chairman of the Board of
Directors since November 1996. Prior to joining ISS, Mr. Noonan served as Vice
President, Sales and Business Development with TSI International, an electronic
commerce company then owned by Warburg Pincus and Dun & Bradstreet, from October
1994 until August 1995. From November 1989 until October 1994, Mr. Noonan held
high-level sales and marketing positions at Dun & Bradstreet Software, a
developer of enterprise business software. Prior to 1989, Mr. Noonan co-founded
Actuation Electronics, a motion control company for precision applications, and
founded Leapfrog Technologies, an object-oriented software development tools
company for networked applications. Mr. Noonan holds a B.S. in mechanical
engineering from the Georgia Institute of Technology and a C.S.S. in business
administration and management from Harvard University.
    
 
   
     Mr. Klaus founded ISS in April 1994 and served as its President until
August 1995 and as its Chief Executive Officer until November 1996. Mr. Klaus
continues to serve the Company as its Chief Technical Officer and as a Director.
Prior to founding ISS, Mr. Klaus developed a shareware version of the Internet
Scanner while attending the Georgia Institute of Technology.
    
 
   
     Mr. Macchia joined ISS as its Vice President and Chief Financial Officer in
December 1997. From December 1989 until December 1997, Mr. Macchia was employed
by First Financial Management Corporation ("FFMC") as its Executive Vice
President (Finance), and by First Data Corporation as its Senior Vice President
(Finance) following its merger with FFMC. Mr. Macchia received a B.B.A. in
accounting from the University of Notre Dame.
    
 
     Mr. Cooley has served as Vice President (Engineering) of ISS since January
1996. Mr. Cooley has over twenty years of executive-level experience in software
development and customer support, most recently as a founding partner for Value
Sourcing Group, an Atlanta-based management consultancy specializing in
information technology, from 1995 to 1996. Prior to that, Mr. Cooley was
employed by Dun & Bradstreet Software for over 16 years where he held various
management and executive-level positions in marketing, development and support,
and ended his tenure as Chief Information Officer. Mr. Cooley holds a B.S. in
industrial engineering from the Georgia Institute of Technology.
 
     Mr. McNeight has served as Vice President (Americas Sales) of ISS since
August 1996. Prior to joining ISS, Mr. McNeight was employed for more than
twenty years in various sales, sales management
 
                                       42
<PAGE>   46
 
   
and executive management positions with technology and service companies, having
most recently been a principle in The Complex Sale, a strategic sales consulting
and training firm, from December 1995 to August 1996. In 1995, Mr. McNeight was
Senior Vice President, Americas Operations, for TSW International, Inc., a
supplier of plant performance and maintenance management software. Additionally,
Mr. McNeight was Chief Executive Officer of Aurum Software Inc., a provider of
sales, marketing and customer service software that was subsequently acquired by
Baan Company, from 1993 to 1994 and, prior to that, spent thirteen years at Dun
& Bradstreet, ending his tenure there as Executive Vice President for the
Americas. Mr. McNeight has a B.S. in chemistry from Oklahoma State University
and an M.S. in management information sciences from Texas Christian University.
    
 
     Mr. Bogaerts joined ISS as its Vice President (Europe) in February 1996.
Before joining ISS, Mr. Bogaerts was an independent technology consultant from
September 1995 to February 1996, and prior to that held sales, marketing and
strategic marketing, and general management positions with Dun & Bradstreet
Software from 1992 to September 1995, and with Ethica N.V., an enterprise IT
management and consulting firm, from 1989 to 1992. Mr. Bogaerts received a
degree in applied economics and management sciences from the University of
Leuven, Belgium, and an M.B.A. through a joint program of the University of
Leuven, the University of Chicago and Cornell University Business Schools.
 
     Mr. Lin has served ISS as Vice President (Asia/Pacific) since January 1997
and manages the Company's Asia/Pacific operations from the Company's office in
Tokyo. Mr. Lin has over twenty years of sales and marketing experience in the
Asia/Pacific software market. From 1984 to December 1996, he held a number of
sales, marketing and development positions with Dun & Bradstreet Technology Asia
(formerly known as Ashisuto KK), most recently as its Vice President and General
Manager of Sales and Operations. Mr. Lin holds a B.A. in business administration
from Aoyama Gakuin University in Tokyo.
 
   
     Mr. Bodman joined the Company's Board of Directors in July 1997. Since May
1996, Mr. Bodman has served as the Managing General Partner of AT&T Ventures,
LLC, which manages numerous venture capital investments. Before joining AT&T
Ventures, LLC, Mr. Bodman served AT&T Corporation in various senior management
positions. Mr. Bodman serves on the board of directors of several public
companies, including Tyco International, Inc., LIN Television, Inc. and Reed
Elsevier plc., and several private companies. Mr. Bodman holds a B.S. in
engineering from Princeton University and an M.S. in industrial management from
the Massachusetts Institute of Technology.
    
 
     Mr. Davoli has been a Director of the Company since February 1996. Mr.
Davoli has been a General Partner of or an advisor to Sigma Partners, a venture
capital firm, since January 1995. Mr. Davoli was President and Chief Executive
Officer of Epoch Systems, Inc., a client/server storage management provider,
from February 1993 to September 1994. From May 1986 through June 1992, Mr.
Davoli was the President and Chief Executive Officer of SQL Solutions, a
relational database management systems consulting and tools company that he
founded and sold to Sybase, Inc. in January 1990. Mr. Davoli serves as a
director of several privately held companies. Mr. Davoli received a B.A. in
history from Ricker College.
 
   
     Mr. O'Connor has served as a Director of the Company since October 1995.
Mr. O'Connor has been the Chief Executive Officer and Chairman of DoubleClick,
Inc. ("DoubleClick"), a provider of Internet advertising services, since January
1996. From September 1994 to December 1995, Mr. O'Connor served as Director of
Research for Digital Communications Associates, a data communications company
(now Attachmate Corporation), and from April 1992 to September 1994, as its
Chief Technical Officer and Vice President, Research. From its inception in May
1983 until its sale in April 1992, Mr. O'Connor served as Vice President,
Research of Intercomputer Communications Corp., a software development company.
Mr. O'Connor received his B.S. in electrical engineering from the University of
Michigan.
    
 
   
     Mr. Strohm has served as a Director of the Company since January 1996.
Since 1980, Mr. Strohm has been an employee of Greylock Management Corporation,
a venture capital group ("Greylock"), and has been a general partner of several
venture capital funds affiliated with Greylock. Mr. Strohm currently serves as a
director of DoubleClick, Banyan Systems, Inc., an enterprise networking software
company,
    
 
                                       43
<PAGE>   47
 
and Legato Systems, Inc., a data storage management software company. Mr. Strohm
received his B.A. from Dartmouth College and his M.B.A. from Harvard Business
School.
 
BOARD OF DIRECTORS
 
   
     The Charter and Bylaws provide that the size of the Board of Directors of
the Company (the "Board") shall be determined by resolution of the Board. The
Board is currently composed of six members. Each director holds office until the
next annual meeting of stockholders or until his or her successor is duly
elected and qualified. The Company's Charter and Bylaws provide that, beginning
with the first annual meeting of stockholders following this Offering, the Board
will be divided into three classes serving for staggered, three-year terms.
Following the completion of the Offering, the Class I directors, who will stand
for election at the Company's 1999 Annual Meeting of Stockholders, will be
Messrs. Bodman and O'Connor; the Class II directors will be Messrs. Noonan and
Strohm; and the Class III directors will be Messrs. Klaus and Davoli.
    
 
     The Board has established a Compensation Committee and an Audit Committee.
The members of the Compensation Committee are Robert E. Davoli, Kevin J.
O'Connor and David N. Strohm, and the members of the Audit Committee are Richard
S. Bodman, Robert E. Davoli and Thomas E. Noonan.
 
     The Audit Committee of the Board was established in January 1998 and
reviews, acts on and reports to the Board with respect to various auditing and
accounting matters, including the selection of the Company's auditors, the scope
of the annual audits, fees to be paid to the auditors, the performance of the
Company's independent auditors and the accounting practices of the Company.
 
     The Compensation Committee of the Board was established in February 1996
and re-authorized in January 1998. The Compensation Committee determines the
salaries and incentive compensation of the officers of the Company and provides
recommendations for the salaries and incentive compensation of the other
employees of the Company. The Compensation Committee also administers the
Company's various incentive compensation, stock and benefit plans.
 
     Except for grants of stock options, directors of the Company generally do
not receive compensation for services rendered as a director. The Company also
does not pay compensation for committee participation or special assignments of
the Board. Following this Offering, each director will be reimbursed for all
out-of-pocket expenses incurred in attending meetings of the Board and
committees thereof. Non-employee Board members will receive option grants at
periodic intervals under the Automatic Option Grant Program of the 1995 Plan and
will also be eligible to receive discretionary option grants under the
Discretionary Option Grant Program of such plan. See "-- Restated 1995 Stock
Incentive Plan".
 
   
     On December 8, 1997, the Company granted to each of Messrs. Bodman, Davoli,
O'Connor and Strohm an option to purchase 20,000 shares of Common Stock at an
exercise price of $7.00 per share. The options are immediately exercisable for
all of the option shares. However, the shares purchasable upon exercise of the
options are unvested, and subject to repurchase at the option exercise price
paid per share, upon an early termination of the optionee's Board service. The
shares subject to each option grant will vest as to 25% of the option shares
upon the optionee's completion of each of the four years of Board service after
the grant date. The options have a maximum term of 10 years measured from the
grant date, subject to earlier termination following the cessation of the
optionee's Board service. The options will immediately vest in the event of (i)
certain changes in the ownership or control of the Company, unless such options
are assumed by the successor corporation or (ii) the death or disability of the
optionee while serving as a Board member.
    
 
     The Bylaws provide for indemnification of directors and officers to the
fullest extent permitted by Delaware law, except if limited by contract. Prior
to consummation of this Offering, the Company will enter into indemnification
agreements with all of its directors and will procure directors' and officers'
liability insurance. In addition, the Charter limits the personal liability of
Board members to the Company or its stockholders for breaches of the directors'
fiduciary duties to the fullest extent permitted by Delaware law. See
"Description of Capital Stock -- Certain Anti-Takeover, Limited Liability and
Indemnification Provisions".
 
                                       44
<PAGE>   48
 
EMPLOYMENT CONTRACTS
 
     The officers serve at the discretion of the Board. The Company does not
presently have an employment contract in effect with any of its executive
officers. The Compensation Committee, as Plan Administrator of the 1995 Plan,
has the authority to provide for the accelerated vesting of the shares of Common
Stock subject to outstanding options held by the Chief Executive Officer and the
Company's other executive officers or any unvested shares actually held by those
individuals under the 1995 Plan, in the event the Company is acquired by merger,
consolidation or asset sale or there is a change in control effected by a
successful tender or exchange offer for more than 50% of the Company's
outstanding voting securities or a change in the majority of the Board as a
result of one or more contested elections for Board membership. Alternatively,
the Compensation Committee may condition such accelerated vesting upon the
individual's position with the Company being replaced with a lesser position or
the termination of the individual's service within a designated period following
the acquisition or take over. In addition, the Company has agreements with
certain management members regarding acceleration of option vesting in the event
of the consummation of a transaction that results in a change of control of the
Company.
 
EXECUTIVE COMPENSATION
 
     Summary Compensation Table.  The following table provides certain summary
information concerning the compensation earned by the Company's Chief Executive
Officer and certain other executive officers of the Company (collectively, the
"Named Officers") whose salary and bonus exceeded $100,000 for services rendered
in all capacities to the Company and its subsidiaries during 1997.
 
   
<TABLE>
<CAPTION>
                                                                                 LONG-TERM
                                                                                COMPENSATION
                                                                                ------------
                                                       ANNUAL COMPENSATION        OPTIONS
                                                      ---------------------        (# OF
NAME AND PRINCIPAL POSITION(S)                         SALARY       BONUS         SHARES)
- ------------------------------                        --------     --------     ------------
<S>                                                   <C>          <C>          <C>
Thomas E. Noonan....................................  $130,000     $ 60,000            --
  President, Chief Executive Officer and Chairman of
  the Board
Alex Bogaerts.......................................    89,000(1)    76,000(1)     25,000
  Vice President (Europe)
H. Keith Cooley.....................................   109,000       26,000            --
  Vice President (Engineering)
Lin Ja Hong.........................................   110,000       43,890        27,500
  Vice President (Asia/Pacific)
M. Thomas McNeight..................................   125,000       91,300            --
  Vice President (Americas Sales)
</TABLE>
    
 
- ---------------
 
   
(1) Mr. Bogaerts' compensation, other than options, was paid to a consulting
    company owned by Mr. Bogaerts.
    
 
                                       45
<PAGE>   49
 
     Option Grants in Last Fiscal Year.  The following table provides certain
information concerning stock options granted to each of the Named Officers
during 1997. No stock appreciation rights were granted to these individuals
during such year.
 
                             OPTION GRANTS IN 1997
 
<TABLE>
<CAPTION>
                                                                                 POTENTIAL REALIZABLE VALUE
                                                                                  AT ASSUMED ANNUAL RATES
                               NUMBER OF    % OF TOTAL                                 OF STOCK PRICE
                               SECURITIES    OPTIONS     EXERCISE                 APPRECIATION FOR OPTION
                               UNDERLYING   GRANTED TO    PRICE                           TERM(2)
                                OPTIONS     EMPLOYEES      PER      EXPIRATION   --------------------------
NAME                           GRANTED(1)    IN 1997      SHARE        DATE          5%             10%
- ----                           ----------   ----------   --------   ----------   ----------      ----------
<S>                            <C>          <C>          <C>        <C>          <C>             <C>
Thomas E. Noonan.............          --          --%   $     --          --     $    --         $    --
Alex Bogaerts................      25,000          2.3       0.60     4/20/07       9,433          23,906
H. Keith Cooley..............          --           --         --          --          --              --
Lin Ja Hong..................      20,000          1.8       0.60      3/9/07       7,547          19,125
                                    7,500            *       7.00    12/30/07      33,016          83,671
M. Thomas McNeight...........          --           --         --          --          --              --
</TABLE>
 
- ---------------
 
* Indicates less than 1%.
 
(1) The options are immediately exercisable in full upon grant; however, the
    shares underlying all options vest over a four-year period at the rate of
    25% per year and are subject to repurchase by the Company at the exercise
    price should the optionee cease employment prior to full vesting. In the
    event that the Company is acquired by merger, consolidation or asset sale,
    the option shares will accelerate in full unless the option is assumed by
    the successor corporation and the Company's repurchase rights with respect
    to the unvested option shares are assigned to such corporation. In the event
    that the option is so assumed by, and the Company's repurchase rights with
    respect to unvested shares are assigned to, the successor corporation and,
    within 12 months following the acquisition, the optionee's position is
    reduced to a lesser position or the optionee's employment is involuntarily
    terminated, the option shares will accelerate in part so that the next
    annual installment of option shares scheduled to vest will immediately vest
    in full and, to the extent the optionee continues in the Company's service,
    each installment of option shares scheduled to vest thereafter will vest on
    each subsequent anniversary of the acceleration date. Each option expires on
    the earlier of (i) ten years from the date of grant, or (ii) termination of
    the optionee's employment with the Company. All options were granted at fair
    market value as determined by the Board of Directors of the Company on the
    date of grant.
 
(2) Future value assumes appreciation in the market value of the Common Stock of
    5% and 10% per year over the ten-year option period as mandated by the rules
    and regulations of the Commission and does not represent the Company's
    estimate or projection of the future value of the Common Stock. The actual
    value realized may be greater than or less than the potential realizable
    values set forth in the table.
 
                                       46
<PAGE>   50
 
     Aggregate Option Exercises in Last Fiscal Year and Fiscal Year-End Option
Values.  No options were exercised by the Named Officers during 1997. The
following table provides certain information concerning option exercises and
option holdings for the fiscal year ended December 31, 1997 with respect to each
of the Named Officers.
 
                             YEAR-END OPTION VALUES
 
<TABLE>
<CAPTION>
                                             NUMBER OF SECURITIES            VALUE OF UNEXERCISED
                                            UNDERLYING UNEXERCISED           IN-THE-MONEY OPTIONS
                                         OPTIONS AT DECEMBER 31, 1997       AT DECEMBER 31, 1997(2)
                                        -------------------------------   ---------------------------
NAME                                    EXERCISABLE(1)    UNEXERCISABLE   EXERCISABLE   UNEXERCISABLE
- ----                                    --------------    -------------   -----------   -------------
<S>                                     <C>               <C>             <C>           <C>
Thomas E. Noonan......................          --                 --     $       --     $       --
Alex Bogaerts.........................      45,000(3)              --        297,000             --
H. Keith Cooley.......................     200,000                 --      1,370,000             --
Lin Ja Hong...........................      27,500(4)              --        128,000             --
M. Thomas McNeight....................     235,000                 --      1,609,750             --
</TABLE>
 
- ---------------
 
(1) The shares purchasable upon exercise of the options are subject to
    repurchase by the Company at the exercise price upon the optionee's
    termination of employment prior to vesting in the shares. The Company's
    repurchase right lapses with respect to, and the optionee vests in, 25% of
    the option shares upon the optionee's completion of each year of service. As
    of December 31, 1997, the number of vested shares for which each Named
    Officer's option was exercisable was as follows: Mr. Bogaerts -- 5,000
    shares; Mr. Cooley -- 50,000; Mr. Lin -- no shares; Mr. McNeight -- 58,750
    shares.
 
(2) Value determined by subtracting the exercise price from the fair market
    value of the Common Stock at December 31, 1997 ($7.00 per share), as
    determined by the Company's Board of Directors, multiplied by the number of
    shares underlying the options.
 
(3) Represents options for 20,000 shares at an exercise price of $0.15 per share
    and options for 25,000 shares at an exercise price of $0.60 per share.
 
(4) Represents options for 20,000 shares at an exercise price of $0.60 per share
    and options for 7,500 shares at an exercise price of $7.00 per share.
 
RESTATED 1995 STOCK INCENTIVE PLAN
 
     The Restated 1995 Stock Incentive Plan was first adopted by the Board of
Directors of Internet Security Systems, Inc. on September 6, 1995 and approved
by the stockholders of Internet Security Systems, Inc. on January 31, 1996. On
December 8, 1997, the Company assumed the 1995 Plan and all outstanding options
thereunder and converted such options on a share-for-share basis into options to
purchase shares of the Company's Common Stock. Three million shares of Common
Stock have been authorized for issuance under the 1995 Plan. In addition, the
share reserve will automatically be increased on the first trading day of each
calendar year, beginning with the 1999 calendar year, by an amount equal to 3%
of the number of shares of Common Stock outstanding on the last trading day of
the immediately preceding calendar year. In no event may any one participant in
the 1995 Plan receive option grants or direct stock issuances for more than
300,000 shares per calendar year.
 
     The 1995 Plan is divided into three separate components: (i) the
Discretionary Option Grant Program under which eligible individuals may, at the
discretion of the Plan Administrator, be granted options to purchase shares of
Common Stock at an exercise price equal to, greater than or less than their fair
market value on the grant date, (ii) the Stock Issuance Program under which such
individuals may, in the Plan Administrator's discretion, be issued shares of
Common Stock directly, through the purchase of such shares at a price equal to,
greater than or less than their fair market value at the time of issuance or as
a bonus for services rendered, and (iii) the Automatic Option Grant Program
under which option grants will automatically be made at periodic intervals to
eligible non-employee Board members to
 
                                       47
<PAGE>   51
 
purchase shares of Common Stock at an exercise price equal to 100% of the fair
market value of such shares on the grant date.
 
     The Discretionary Option Grant Program and the Stock Issuance Program are
administered by the Compensation Committee of the Board. The Compensation
Committee as Plan Administrator has complete discretion to determine which
eligible individuals are to receive option grants or stock issuances, the time
or times when such option grants or stock issuances are to be made, the number
of shares subject to each such grant or issuance, the status of any granted
option as either an incentive stock option or a non-statutory stock option under
the Federal tax laws, the vesting schedule to be in effect for the option grant
or stock issuance and the maximum term for which any granted option is to remain
outstanding. The administration of the Automatic Option Grant Program is
self-executing in accordance with the express provisions of such program.
 
     The exercise price for the shares of Common Stock subject to option grants
made under the 1995 Plan may be paid in cash or in shares of Common Stock (held
for the requisite period necessary to avoid a charge to the Company's earnings
for financial reporting purposes) valued at fair market value on the exercise
date. The option may also be exercised through a same-day sale program without
any cash outlay by the optionee. In addition, the Plan Administrator may provide
financial assistance to one or more optionees in the exercise of their
outstanding options by allowing such individuals to deliver a full-recourse,
interest-bearing promissory note in payment of the exercise price and any
associated withholding taxes incurred in connection with such exercise. During
the 180-day period following the date of this Prospectus, optionees exercising
options under the 1995 Plan will be required to enter into Lock-Up Agreements
with the representatives of the Underwriters.
 
     In the event that the Company is acquired by merger, consolidation or asset
sale, each outstanding option under the Discretionary Option Grant Program which
is not to be assumed by the successor corporation will automatically become
fully exercisable, and all unvested shares under the Stock Issuance Program will
immediately vest, except to the extent the Company's repurchase rights with
respect to those shares are to be assigned to the successor corporation. In the
event an outstanding option is assumed, and the Company's repurchase rights are
assigned to the successor corporation, and, within 12 months following the
merger, consolidation or asset sale either (i) the optionee is offered a lesser
position compared to the position held by the optionee prior to the acquisition
or (ii) the optionee's service is terminated, either involuntarily or through
resignation as a result of being offered a lesser position, then the option will
accelerate in part so that it will become immediately exercisable with respect
to the next annual installment of option shares scheduled to vest. The Plan
Administrator also has the authority under the Discretionary Option Grant and
Stock Issuance Programs to grant options and to structure repurchase rights so
that the shares subject to those options or repurchase rights will automatically
vest in the event the individual is offered a lesser position or the
individual's service is terminated, whether involuntarily or through a
resignation as a result of being offered a lesser position, within a specified
period (not to exceed 12 months) following a change in control of the Company
effected by a successful tender offer for more than 50% of the outstanding
voting stock or by proxy contest for the election of Board members. The Plan
Administrator also has the discretion to provide for the automatic acceleration
of outstanding options and the lapse of any outstanding repurchase rights upon
certain changes in the ownership or control of the Company.
 
   
     In February 1998, the Company entered into an Amended and Restated
Agreement Regarding Acceleration of Vesting of Future Optionees with Greylock
Equity Limited Partnership ("Greylock"), Sigma Associates III, L.P., Sigma
Investors III, L.P. and Sigma Partners III, L.P. (collectively, the "Sigma
Entities"), AT&T Venture Fund II, L.P. and Venture Fund I, L.P. (collectively,
the "AT&T Entities") and Kleiner, Perkins, Caufield & Byers VIII, KPCB
Information Sciences Zaibatsu Fund II and KPCB Java Fund (collectively, the
"KPCB Entities") which provides that in all option grants made after the date of
the agreement, the Company will provide that no more than the greater of (i) 50%
of the unvested shares issued pursuant to such grant or (ii) the options which
would be vested in such optionee's next vesting installment may become
immediately vested in the event that (x) the Company sells, conveys or otherwise
disposes of all or substantially all of its property or business, or merges into
or effects a
    
                                       48
<PAGE>   52
 
   
reorganization with any corporation (other than a wholly-owned subsidiary
corporation) in which the stockholders of the Company immediately prior to the
transaction possess less than 50% of the voting power of the surviving entity
(or its parent), and (y) the optionee is not offered a position with the
surviving entity which (I) offers compensation equivalent to or greater than
that provided to the optionee by the Company immediately prior to the change in
control, and (II) offers duties and responsibilities comparable to those
associated with the position held by the optionee with the Company immediately
prior to the change in control such that the duties and responsibilities of the
optionee with the surviving entity are not materially diminished from those of
the optionee at the Company.
    
 
     Stock appreciation rights are authorized for issuance under the
Discretionary Option Grant Program which provide the holders with the election,
subject to the Plan Administrator's approval, to surrender their outstanding
options for an appreciation distribution from the Company equal to the excess of
(i) the fair market value of the vested shares of Common Stock subject to the
surrendered option over (ii) the aggregate exercise price payable for such
shares. In addition, the Plan Administrator has the authority to grant to
certain officers and directors of the Company limited stock appreciation rights
which, upon a hostile take-over of the Company (as defined in the 1995 Plan),
generally provide the holders with the automatic right to surrender his or her
outstanding options for an appreciation distribution from the Company equal to
the excess of (i) the tender price paid in the hostile take-over for the vested
shares subject to the surrendered options over (ii) the aggregate exercise price
payable for such shares. Such appreciation distribution may be made in cash or
in shares of Common Stock.
 
     The Plan Administrator has the authority to effect the cancellation of
outstanding options under the Discretionary Option Grant Program with the
consent of the affected option holders in return for the grant of new options
for the same or different number of option shares with an exercise price per
share based upon the fair market value of the Common Stock on the new grant
date.
 
     Under the Automatic Option Grant Program, each individual who first joins
the Board as a non-employee Board member after the effective date of this
Offering will receive an option to purchase 50,000 shares of Common Stock on the
date he or she is first elected or appointed to the Board, provided such
individual has not otherwise been in the prior employ of the Company. In
addition, at each Annual Stockholders Meeting, beginning with the 1999 Annual
Meeting, each individual who is to continue to serve as a non-employee Board
member after the meeting will receive an additional option to purchase 5,000
shares of Common Stock.
 
     Each automatic grant will have a term of 10 years, subject to earlier
termination following the optionee's cessation of Board service. Each automatic
option will be immediately exercisable; however, any shares purchased upon
exercise of the option will be subject to repurchase should the optionee's
service as a non-employee Board member cease prior to vesting in the shares. The
initial 50,000-share grant will vest in four equal and successive annual
installments over the optionee's period of Board service. Each additional
5,000-share grant will vest in two equal and successive annual installments over
the optionee's period of Board service measured from the grant date. However,
the shares subject to each outstanding automatic grant will immediately vest
upon (i) certain changes in the ownership or control of the Company or (ii) the
death or disability of the optionee while serving as a Board member.
 
     The Board may amend or modify the 1995 Plan at any time. The 1995 Plan will
terminate on the earlier of (i) September 6, 2005, (ii) the date on which all
available shares have been issued as vested shares or (iii) the termination of
all outstanding options in connection with certain changes in the ownership or
control of the Company.
 
                                       49
<PAGE>   53
 
COMPENSATION COMMITTEE INTERLOCKS AND INSIDER PARTICIPATION
 
     The Board established a Compensation Committee in February 1996. During
1997, Robert E. Davoli, Kevin J. O'Connor and David N. Strohm served as members
of the Compensation Committee. None of these individuals has served at any time
as an officer or employee of the Company. Prior to the establishment of the
Compensation Committee, all decisions relating to executive compensation were
made by the Board. For a description of the transactions between the Company and
members of the Compensation Committee and entities affiliated with such members,
see "Certain Transactions". No executive officer of the Company serves as a
member of the board of directors or compensation committee of any entity which
has one or more executive officers serving as a member of the Board of Directors
or Compensation Committee.
 
                                       50
<PAGE>   54
 
   
                              CERTAIN TRANSACTIONS
    
 
   
SALE OF SERIES A PREFERRED STOCK
    
 
   
     In February 1996, the Company sold an aggregate of 3,650,000 shares of its
Series A Redeemable, Convertible Preferred Stock (the "Series A Preferred
Stock") for $1.00 per share in a private placement exempt from registration
under Section 4(2) of the Securities Act. The purchasers of the Series A
Preferred Stock included, among others, Greylock and the Sigma Entities. The
Series A Preferred Stock will automatically convert into Common Stock on a
one-for-one basis upon the completion of the Offering. Concurrently with the
closing of the financing, David N. Strohm, an employee of Greylock and the
general partner of several venture capital funds associated with Greylock, and
Robert E. Davoli, a general partner of the Sigma Entities, became directors of
the Company.
    
 
   
     In connection with the sale of the Series A Preferred Stock, the Company
entered into an agreement with Greylock and Sigma Partners concerning certain of
the shares of the Common Stock sold by the underwriters of an initial public
offering of the Common Stock to persons designated by the Company ("Directed
Shares"). Under this agreement, in the event that the Company designates any
person to receive Directed Shares, the Company must use its best efforts to
cause (i) Greylock and (ii) the Sigma Entities to receive up to 100,000 Directed
Shares at the initial public offering price. Also in connection with the Series
A Preferred Stock financing, the Company (i) entered into an Agreement Regarding
Acceleration of Vesting of Future Optionees with Greylock and the Sigma
Entities, which was later amended and restated to make certain technical
clarifications, (ii) entered into a Rights Agreement, which was amended and
restated in connection with the sale of the Company's Series B Redeemable,
Convertible Preferred Stock (the "Series B Preferred Stock"), and (iii)
repurchased 100,000 shares of Common Stock from Christopher W. Klaus, a founder,
officer and director of the Company, for $15,000.
    
 
   
SALE OF SERIES B PREFERRED STOCK
    
 
   
     In February 1997, the Company sold an aggregate of 2,086,957 shares of its
Series B Preferred Stock for $2.53 per share in a private placement exempt from
registration under Section 4(2) of the Securities Act. The purchasers of the
Series B Preferred Stock included, among others, (i) Greylock, (ii) the Sigma
Entities, (iii) the AT&T Entities, and (iv) the Kleiner Entities. The Series B
Preferred Stock will automatically convert into Common Stock on a one-for-one
basis upon the completion of the Offering. Richard S. Bodman, the managing
general partner of the AT&T Entities, became a director of the Company in July
1997.
    
 
   
     In connection with the sale of the Series B Preferred Stock, the Company
entered into an agreement with the AT&T Entities and Kleiner, Perkins, Caufield
& Byers ("KPCB") concerning Directed Shares. Under the agreement, in the event
that the Company designates any person to receive Directed Shares, the Company
must use its best efforts to cause each of (i) the AT&T Entities and (ii) KPCB
to receive up to 100,000 Directed Shares at the initial public offering price.
In connection with the sale of the Series B Preferred Stock, the Company also
entered into (i) an Agreement Regarding Acceleration of Vesting of Future
Optionees with the AT&T Entities and the Kleiner Entities, which was later
amended and restated to make certain technical clarifications, and (ii) an
Amended and Restated Rights Agreement. Pursuant to the Amended and Restated
Rights Agreement, purchasers of the Series A Preferred Stock and Series B
Preferred Stock have the right, beginning six months after this Offering and
subject to certain conditions and limitations, to require the Company to file a
registration statement, including, if requested, a shelf registration statement,
under the Securities Act in order to register all or part of their shares of
Common Stock. The Company in certain circumstances, may defer such registrations
and the underwriters have the right, subject to certain limitations, to limit
the number of shares included in such registrations. In the event that the
Company proposes to register any of its securities under the Securities Act,
either for its own account or for the account of other security holders, the
purchasers of the Series A Preferred Stock and Series B Preferred Stock and
certain holders of the Common Stock, including Christopher W. Klaus and Thomas
E. Noonan, the Company's Chairman, President and Chief Executive Officer, are
entitled to include their shares of Common Stock in such registration, subject
to marketing
    
                                       51
<PAGE>   55
 
   
and other limitations. Generally, the Company is required to bear all expenses
associated with such registrations.
    
 
   
AMENDED AND RESTATED AGREEMENT REGARDING ACCELERATION OF FUTURE OPTIONEES
    
 
   
     In February 1998, the Company entered into an Amended and Restated
Agreement Regarding Acceleration of Vesting of Future Optionees with Greylock,
the Sigma Entities, the AT&T Entities and the Kleiner Entities which provides
that in all option grants made after the date of the agreement, the Company will
provide that no more than the greater of (i) 50% of the unvested shares issued
pursuant to such grant or (ii) the options which would be vested in such
optionee's next vesting installment may become immediately vested in the event
that (x) the Company sells, conveys or otherwise disposes of all or
substantially all of its property or business, or merges into or effects a
reorganization with any corporation (other than a wholly-owned subsidiary
corporation) in which the stockholders of the Company immediately prior to the
transaction possess less than 50% of the voting power of the surviving entity
(or its parent), and (y) the optionee is not offered a position with the
surviving entity which (I) offers compensation equivalent to or greater than
that provided to the optionee by the Company immediately prior to the change in
control, and (II) offers duties and responsibilities comparable to those
associated with the position held by the optionee with the Company immediately
prior to the change in control such that the duties and responsibilities of the
optionee with the surviving entity are not materially diminished from those of
the optionee at the Company.
    
 
   
DOUBLECLICK PURCHASES
    
 
   
     During 1997, the Company purchased approximately $125,000 of Internet
advertising services from DoubleClick. Kevin J. O'Connor, who has served as a
director of the Company since September 1995, is the Chairman and Chief
Executive Officer of DoubleClick. Such purchases were made pursuant to purchase
orders involving only the sale of routine services having a determinable market
price, at such market price.
    
 
   
FUTURE TRANSACTIONS
    
 
   
     All future transactions, including loans, between the Company and its
officers, directors, principal stockholders and their affiliates will be
approved by a majority of the Board, including a majority of the independent and
disinterested outside directors on the Board, and will continue to be on terms
no less favorable to the Company than could be obtained from unaffiliated third
parties.
    
 
                                       52
<PAGE>   56
 
                       PRINCIPAL AND SELLING STOCKHOLDERS
 
   
     The following table sets forth certain information regarding beneficial
ownership of the Common Stock as of February 28, 1998 adjusted on a pro forma
basis to reflect the automatic conversion of each share of Convertible Preferred
Stock into one share of Common Stock, and as adjusted to reflect the sale of
shares offered hereby, by (i) each person who is known by the Company to own
beneficially more than five percent of the Common Stock, (ii) each of the
Company's Named Officers and directors, (iii) each of the Selling Stockholders,
and (iv) all current officers and directors as a group. Unless otherwise
indicated, the address for the following stockholders is 41 Perimeter Center
East, Suite 660, Atlanta, Georgia 30346.
    
 
   
<TABLE>
<CAPTION>
                                  SHARES BENEFICIALLY                          SHARES BENEFICIALLY
                                      OWNED BEFORE                                 OWNED AFTER
                                    OFFERING (1)(2)          NUMBER OF           OFFERING(1)(2)
                                ------------------------   SHARES OFFERED   -------------------------
BENEFICIAL OWNER                  NUMBER      PERCENTAGE      FOR SALE         NUMBER      PERCENTAGE
- ----------------                -----------   ----------   --------------   ------------   ----------
<S>                             <C>           <C>          <C>              <C>            <C>
Christopher W. Klaus(3).......    4,373,836      32.0%        100,000          4,273,836      26.1%
Greylock Equity Limited
  Partnership(4)..............    2,657,614      19.4              --          2,657,614      16.2
  755 Page Mill Road, Bldg. A
  Palo Alto, California 94304
Sigma Entities(5).............    1,950,218      14.2              --          1,950,218      11.9
  20 Custom House Street
  Boston, Massachusetts 02110
Thomas E. Noonan(6)...........    1,922,070      14.1         125,000          1,797,070      11.0
Kleiner Perkins Caufield &
  Byers Entities(7)...........    1,429,858      10.5              --          1,429,858       8.7
  2750 Sand Hill Road
  Menlo Park, California 94025
Kevin J. O'Connor(8)..........      713,475       5.2          55,000            658,475       4.0
  DoubleClick
  41 Madison Avenue
  New York, New York 10010
Alex Bogaerts(9)..............       45,000      *                 --             45,000         *
H. Keith Cooley(10)...........      200,000       1.4          20,000            180,000       1.1
Lin Ja Hong(11)...............       27,500      *                 --             27,500         *
M. Thomas McNeight(12)........      235,000       1.7              --            235,000       1.4
Richard S. Bodman(13).........      395,494       2.9              --            395,494       2.4
  c/o AT&T Ventures, L.L.C.
  Two Wisconsin Circle
  Chevy Chase, Maryland 20815
Robert E. Davoli(5)...........    1,950,218      14.2              --          1,950,218      11.9
David N. Strohm(4)............    2,657,614      19.4              --          2,657,614      16.2
Glenn M. McGonnigle(14).......      241,590       1.8          15,000            226,590       1.4
All directors and officers as
  a group(11 persons)(15).....   12,645,207      88.0                         12,345,207      72.4
</TABLE>
    
 
                                       53
<PAGE>   57
 
- ---------------
 
   * Indicates less than 1%.
 (1) Assumes no exercise of the Underwriters' over-allotment option.
 
   
 (2) Beneficial ownership is calculated in accordance with the rules of the
     Commission. In computing the number of shares beneficially owned by a
     person and the percentage ownership of that person, shares of Common Stock
     subject to options held by that person that are currently exercisable or
     become exercisable within 60 days following February 28, 1998, are deemed
     outstanding. However, such shares are not deemed outstanding for the
     purpose of computing the percentage ownership of any other person. Unless
     otherwise indicated in the footnotes to this table, the persons and
     entities named in the table have sole voting and sole investment power with
     respect to all shares beneficially owned, subject to community property
     laws where applicable.
    
   
 (3) Includes 3,560 shares held by Mr. Klaus' family. Mr. Klaus disclaims
     beneficial ownership of such shares. In addition to the number of shares
     shown as offered for sale in the table, Mr. Klaus has granted the
     Underwriters the right to purchase up to an additional 25,000 shares
     pursuant to the Underwriters' over-allotment option.
    
 (4) Includes options immediately exercisable for 20,000 shares of Common Stock
     held by Mr. Strohm and 2,637,614 shares held by Greylock Equity Limited
     Partnership. Mr. Strohm, a director of the Company, is also a General
     Partner of Greylock Equity Limited Partnership. Mr. Strohm disclaims
     beneficial ownership of the shares held by Greylock Equity Limited
     Partnership except to the extent of his pecuniary interest therein arising
     from his general partnership interest therein.
 (5) Includes options immediately exercisable for 20,000 shares of Common Stock
     held by Mr. Davoli, 311,506 shares held by Sigma Associates III, L.P.,
     28,792 shares held by Sigma Investors III, L.P. and 1,589,920 shares held
     by Sigma Partners III, L.P. Mr. Davoli, a director of the Company, is also
     a General Partner of Sigma Management III, L.P., which is the General
     Partner of Sigma Associates III, L.P., Sigma Investors III, L.P. and Sigma
     Partners III, L.P. Mr. Davoli disclaims beneficial ownership of the shares
     held by Sigma Associates III, L.P., Sigma Investors III, L.P. and Sigma
     Partners III, L.P. except to the extent of his pecuniary interest therein
     from his general partnership interest in Sigma Management III, L.P.
 (6) Includes 175,000 shares held in family trusts. In addition to the number of
     shares shown as offered for sale in the table, Mr. Noonan has granted the
     Underwriters the right to purchase up to an additional 25,000 shares
     pursuant to the Underwriters' over-allotment option.
 (7) Includes 393,211 shares held by Kleiner Perkins Caufield & Byers VIII,
     35,746 shares held by KPCB Information Sciences Zaibatsu Fund II and
     1,000,901 shares held by KPCB Java Fund.
 (8) Includes options immediately exercisable for 20,000 shares of Common Stock.
     In addition to the number of shares shown as offered for sale in the table,
     Mr. O'Connor has granted the Underwriters the right to purchase up to an
     additional 15,000 shares pursuant to the Underwriters' over-allotment
     option.
 (9) Includes options immediately exercisable for 45,000 shares of Common Stock.
(10) Includes options immediately exercisable for 180,000 shares of Common
     Stock.
(11) Includes options immediately exercisable for 27,500 shares of Common Stock.
(12) Includes options immediately exercisable for 235,000 shares of Common
     Stock.
(13) Includes options immediately exercisable for 20,000 shares of Common Stock
     and 337,945 shares held by AT&T Venture Fund II, L.P. and 37,549 shares
     held by Venture Fund I, L.P. for which Mr. Bodman serves as a General
     Partner.
   
(14) Includes options immediately exercisable for 85,500 shares of Common Stock.
    
   
(15) Includes options immediately exercisable for 692,500 shares of Common
     Stock.
    
 
                                       54
<PAGE>   58
 
                          DESCRIPTION OF CAPITAL STOCK
 
AUTHORIZED AND OUTSTANDING CAPITAL STOCK
 
   
     The authorized capital stock of the Company consists of 50,000,000 shares
of Common Stock, par value $0.001 per share, and 20,000,000 shares of Preferred
Stock, par value $0.001 per share ("Preferred Stock"). Upon consummation of this
Offering, no shares of Preferred Stock and 16,368,928 shares of Common Stock
(16,753,928 shares if the Underwriters' overallotment option is exercised in
full) will be outstanding. The following summary is qualified in its entirety by
reference to the Company's Charter and Bylaws, copies of which are filed as
exhibits to the Registration Statement of which this Prospectus is a part.
    
 
COMMON STOCK
 
   
     As of December 31, 1997, there were 7,921,471 shares of Common Stock
outstanding that were held by eight stockholders. The holders of Common Stock
are entitled to one vote per share on all matters to be voted upon by the
stockholders. Subject to preferences that may be applicable to any outstanding
Preferred Stock, the holders of Common Stock are entitled to receive ratably
such dividends, if any, as may be declared from time to time by the Board of
Directors out of funds legally available therefor. In addition, the Company's
bank credit facility permits the payment of cash dividends only to the extent
the Company maintains certain financial ratios and a specified minimum net
worth. See "Dividend Policy". In the event of liquidation, dissolution or
winding up of the Company, the holders of Common Stock are entitled to share
ratably in all assets remaining after payment of liabilities, subject to prior
distribution rights of Preferred Stock, if any, then outstanding. The Common
Stock has no preemptive or conversion rights or other subscription rights. There
are no redemption or sinking fund provisions applicable to the Common Stock. All
outstanding shares of Common Stock are fully paid and nonassessable, and the
shares of Common Stock to be issued upon completion of this Offering will be
fully paid and nonassessable.
    
 
PREFERRED STOCK
 
     The Board of Directors has the authority to issue the Preferred Stock in
one or more series and to fix the rights, preferences, privileges and
restrictions thereof, including dividend rights, dividend rates, conversion
rights, voting rights, terms of redemption, redemption prices, liquidation
preferences and the number of shares constituting any series or the designation
of such series, without further vote or action by the stockholders. The issuance
of Preferred Stock may have the effect of delaying, deferring or preventing a
change in control of the Company without further action by the stockholders and
may adversely affect the voting and other rights of the holders of Common Stock.
The issuance of Preferred Stock with voting and conversion rights may adversely
affect the voting power of the holders of Common Stock, including the loss of
voting control to others. At present, the Company has no plans to issue any
shares of Preferred Stock.
 
CERTAIN ANTI-TAKEOVER, LIMITED LIABILITY AND INDEMNIFICATION PROVISIONS
 
     SECTION 203 OF THE DELAWARE GENERAL CORPORATION LAW
 
   
     The Company is subject to Section 203 of the Delaware General Corporation
Law, as amended ("Section 203"), which, subject to certain exceptions, prohibits
a Delaware corporation from engaging in any business combination with any
interested stockholder for a period of three years following the date that such
stockholder became an interested stockholder, unless (i) prior to such date, the
board of directors of the corporation approved either the business combination
or the transaction that resulted in the stockholder becoming an interested
stockholder, (ii) upon consummation of the transaction that resulted in the
stockholder becoming an interested stockholder, the interested stockholder owned
at least 85% of the voting stock of the corporation outstanding at the time the
transaction commenced, excluding for purposes of determining the number of
shares outstanding those shares owned (x) by
    
 
                                       55
<PAGE>   59
 
persons who are directors and also officers and (y) by employee stock plans in
which employee participants do not have the right to determine confidentially
whether shares held subject to the plan will be tendered in a tender or exchange
offer, or (iii) on or subsequent to such date, the business combination is
approved by the board of directors and authorized at an annual or special
meeting of stockholders, and not by written consent, by the affirmative vote of
at least 66 2/3% of the outstanding voting stock that is not owned by the
interested stockholder.
 
     Section 203 defines business combinations to include (i) any merger or
consolidation involving the corporation or any majority-owned subsidiary of the
corporation and any other person or entity, (ii) subject to certain exceptions,
any sale, transfer, pledge or other disposition of 10% or more of the assets of
the corporation or any majority-owned subsidiary of the corporation involving
the interested stockholder, (iii) subject to certain exceptions, any transaction
that results in the issuance or transfer by the corporation or any
majority-owned subsidiary of the corporation of any stock of the corporation to
the interested stockholder, (iv) any transaction involving the corporation or
any majority-owned subsidiary of the corporation that has the effect of
increasing the proportionate share of the stock of any class or series of the
corporation or any majority-owned subsidiary of the corporation beneficially
owned by the interested stockholder, or (v) the receipt by the interested
stockholder of the benefit of any loans, advances, guarantees, pledges or other
financial benefits provided by or through the corporation or any majority-owned
subsidiary of the corporation. In general, Section 203 defines an interested
stockholder as any entity or person beneficially owning 15% or more or the
outstanding voting stock of the corporation and any entity or person affiliated
with or controlling or controlled by such entity or person.
 
     CHARTER AND BYLAW PROVISIONS
 
     The Company's Charter and Bylaws include provisions that may have the
effect of discouraging, delaying or preventing a change in control of the
Company or an unsolicited acquisition proposal that a stockholder might consider
favorable, including a proposal that might result in the payment of a premium
over the market price for the shares held by stockholders. These provisions are
summarized in the following paragraphs.
 
     CLASSIFIED BOARD OF DIRECTORS
 
     The Charter and Bylaws provide, beginning with the first annual meeting of
stockholders following this Offering, for the Board to be divided into three
classes of directors serving staggered, three-year terms. The classification of
the Board has the effect of requiring at least two annual stockholder meetings,
instead of one, to replace a majority of members of the Board.
 
     SUPERMAJORITY VOTING
 
     The Charter requires the approval of the holders of at least 66 2/3% of the
Company's combined voting power to effect certain amendments to the Charter
unless such amendments are approved by a majority of the directors of the
Company not affiliated or associated with any person holding (or which has
announced an intention to acquire) 26% or more of the voting power of the
Company's outstanding capital stock. The Bylaws may be amended by either (a) a
majority of the Board or (b) the holders of a majority of the Company's voting
stock, provided that certain amendments approved by stockholders require the
approval of at least 66 2/3% of the Company's combined voting power unless such
amendments are approved by a majority of the directors of the Company not
affiliated or associated with any person holding (or which has announced an
intention to acquire) 26% or more of the voting power of the Company's
outstanding capital stock.
 
     AUTHORIZED BUT UNISSUED OR UNDESIGNATED CAPITAL STOCK
 
   
     The Company's authorized capital stock consists of 50,000,000 shares of
Common Stock and 20,000,000 shares of Preferred Stock. No Preferred Stock will
be designated upon consummation of this Offering. After this Offering, the
Company will have outstanding 16,368,928 shares of Common Stock (16,753,928
shares if the Underwriters' over-allotment option is exercised in full). The
authorized but unissued (and in the case of Preferred Stock, undesignated) stock
may be issued by the Board in one or
    
 
                                       56
<PAGE>   60
 
more transactions. In this regard, the Company's Charter grants the Board broad
power to establish the rights and preferences of authorized and unissued
Preferred Stock. The issuance of shares of Preferred Stock pursuant to the
Board's authority described above could decrease the amount of earnings and
assets available for distribution to holders of Common Stock and adversely
affect the rights and powers, including voting rights, of such holders and may
have the effect of delaying, deferring or preventing a change in control of the
Company. The Board does not currently intend to seek stockholder approval prior
to any issuance of Preferred Stock, unless otherwise required by law.
 
     SPECIAL MEETINGS OF STOCKHOLDERS
 
     The Bylaws provide that special meetings of stockholders of the Company may
be called only by the Board, or by the Company's Chairman of the Board or
President.
 
     NO STOCKHOLDER ACTION BY WRITTEN CONSENT
 
     The Charter and the Bylaws provide that an action required or permitted to
be taken at any annual or special meeting of the stockholders of the Company may
only be taken at a duly called annual or special meeting of stockholders. This
provision prevents stockholders from initiating or effecting any action by
written consent, and thereby taking actions opposed by the Board.
 
     NOTICE PROCEDURES
 
   
     The Bylaws establish advance notice procedures with regard to all
stockholder proposals to be brought before meetings of stockholders of the
Company, including proposals relating to the nomination of candidates for
election as directors, the removal of directors and amendments to the Charter or
Bylaws. These procedures provide that notice of such stockholder proposals must
be timely given in writing to the Secretary of the Company prior to the meeting.
Generally, to be timely, notice must be received by the Secretary of the Company
not less than 120 days prior to the meeting. The notice must contain certain
information specified in the Bylaws.
    
 
     OTHER ANTI-TAKEOVER PROVISIONS
 
     See "Management -- Restated 1995 Stock Incentive Plan" for a discussion of
certain provisions of the 1995 Plan which may have the effect of discouraging,
delaying or preventing a change in control of the Company or unsolicited
acquisition proposals.
 
     LIMITATION OF DIRECTOR LIABILITY
 
     The Charter limits the liability of directors of the Company (in their
capacity as directors but not in their capacity as officers) to the Company or
its stockholders to the fullest extent permitted by Delaware law. Specifically,
directors of the Company will not be personally liable for monetary damages for
breach of a director's fiduciary duty as a director, except for liability (i)
for any breach of the director's duty of loyalty to the Company or its
stockholders, (ii) for acts or omissions not in good faith or which involve
intentional misconduct or a knowing violation of law, (iii) under Section 174 of
the Delaware General Corporation Law, which relates to unlawful payments of
dividends or unlawful stock repurchases or redemptions, or (iv) for any
transaction from which the director derived an improper personal benefit.
 
     INDEMNIFICATION ARRANGEMENTS
 
   
     The Bylaws provide that the directors and officers of the Company shall be
indemnified and provide for the advancement to them of expenses in connection
with actual or threatened proceedings and claims arising out of their status as
such to the fullest extent permitted by the Delaware General Corporation Law.
Prior to consummation of this Offering, the Company will enter into
indemnification agreements with each of its directors and executive officers
that will provide them with rights to indemnification and expense advancement to
the fullest extent permitted under the Delaware General Corporation Law.
    
 
                                       57
<PAGE>   61
 
REGISTRATION RIGHTS
 
     Following the closing of the Offering, certain existing stockholders of the
Company holding an aggregate of 13,354,928 shares of Common Stock will be
entitled to certain rights with respect to the registration of such shares of
Common Stock held by them under the Securities Act. Under the terms of the
Rights Agreement between the Company and certain existing stockholders,
beginning six months after this Offering, the existing holders of Convertible
Preferred Stock have the right, subject to certain conditions and limitations,
to require the Company to file a registration statement, including, if
requested, a shelf registration statement, under the Securities Act in order to
register all or part of the existing stockholders' shares of Common Stock. The
Company may in certain circumstances defer such registrations and the
underwriters have the right, subject to certain limitations, to limit the number
of shares included in such registrations. In the event that the Company proposes
to register any of its securities under the Securities Act, either for its own
account or for the account of other security holders, certain of the existing
stockholders of Common Stock and Convertible Preferred Stock are entitled to
include their shares of Common Stock in such registration, subject to marketing
and other limitations. Generally, the Company is required to bear the expense of
all such registrations.
 
TRANSFER AGENT AND REGISTRAR
 
   
     The Transfer Agent and Registrar for the Common Stock is SunTrust Bank,
Atlanta, located in Atlanta, Georgia.
    
 
                                       58
<PAGE>   62
 
                        SHARES ELIGIBLE FOR FUTURE SALE
 
   
     Upon completion of this Offering, the Company will have 16,368,928 of
Common Stock outstanding (assuming no exercise of the Underwriters'
over-allotment option and no exercise of outstanding options under the Company's
1995 Plan or other options after December 31, 1997). Of such shares, the
3,000,000 shares sold in this Offering will be freely transferable without
restriction or further registration under the Securities Act, except for any
shares held by an existing "affiliate" of the Company, as that term is defined
by the Securities Act (an "Affiliate"), which shares will be subject to the
resale limitations of Rule 144 adopted under the Securities Act. As of the date
of this Prospectus, 13,368,928 "restricted shares" as defined in Rule 144 will
be outstanding. Of such shares, and without consideration of the contractual
restrictions described below, 241,090 shares would be available for immediate
sale in the public market without restriction pursuant to Rule 144(k). Beginning
90 days after the date of this Prospectus, and without consideration of the
contractual restrictions described below, 12,889,228 shares would be eligible
for sale in reliance upon Rule 144 promulgated under the Securities Act and
31,500 shares would be eligible for sale in reliance upon Rule 701 promulgated
under the Securities Act.
    
 
   
     In general, under Rule 144 as currently in effect, beginning 90 days after
the Offering, a person (or persons whose shares are aggregated) who owns shares
that were purchased from the Company (or any Affiliate) at least one year
previously, including a person who may be deemed an Affiliate of the Company, is
entitled to sell within any three-month period a number of shares that does not
exceed the greater of (i) 1% of the then outstanding shares of the Common Stock
(approximately 163,689 shares immediately after the Offering) or (ii) the
average weekly trading volume of the Common Stock on the Nasdaq National Market
during the four calendar weeks preceding the date on which notice of the sale is
filed with the Securities and Exchange Commission (the "Commission"). Sales
under Rule 144 are also subject to certain manner of sale provisions, notice
requirements and the availability of current public information about the
Company. Any person (or persons whose shares are aggregated) who is not deemed
to have been an Affiliate of the Company at any time during the 90 days
preceding a sale, and who owns shares within the definition of "restricted
securities" under Rule 144 under the Securities Act that were purchased from the
Company (or any Affiliate) at least two years previously, would be entitled to
sell such shares under Rule 144(k) without regard to the volume limitations,
manner of sale provisions, public information requirements or notice
requirements.
    
 
     Subject to certain limitations on the aggregate offering price of a
transaction and other conditions, Rule 701 may be relied upon with respect to
the resale of securities originally purchased from the Company by its employees,
directors, officers, consultants or advisers prior to the date the issuer
becomes subject to the reporting requirements of the Securities Exchange Act of
1934, as amended (the "Exchange Act"), pursuant to written compensatory benefit
plans or written contracts relating to the compensation of such persons. In
addition, the Commission has indicated that Rule 701 will apply to typical stock
options granted by an issuer before it becomes subject to the reporting
requirements of the Exchange Act, along with the shares acquired upon exercise
of such options (including exercises after the date of this Prospectus).
Securities issued in reliance on Rule 701 are restricted securities and, subject
to the contractual restrictions described above, beginning 90 days after the
date of this Prospectus, may be sold (i) by persons other than Affiliates,
subject only to the manner of sale provisions of Rule 144, and (ii) by
Affiliates under Rule 144 without compliance with its one-year holding period
requirement.
 
   
     All stockholders of the Company, including the officers, directors and
Selling Stockholders, have agreed not to sell any of their shares of Common
Stock for 180 days after the date of this Prospectus without the prior written
consent of the representatives of the Underwriters. As a result of these
contractual restrictions and subject to the provisions of Rules 144(k), 144 and
701, as applicable, 12,618,228 shares subject to restriction will be eligible
for sale upon expiration of the Lock-Up Agreements 180 days after the date of
this Prospectus. See "Underwriting".
    
 
     The Company has agreed not to offer, sell or otherwise dispose of any
shares of Common Stock or any securities convertible into or exercisable or
exchangeable for Common Stock or any rights to acquire
 
                                       59
<PAGE>   63
 
Common Stock for a period of 180 days after the date of this Prospectus, without
the prior written consent of the representatives of the Underwriters, subject to
certain limited exceptions. See "Underwriting".
 
     After the Offering, the holders of 13,354,928 shares of Common Stock or
their respective transferees, will be entitled to certain rights with respect to
the registration of such shares under the Securities Act. See "Description of
Capital Stock -- Registration Rights". Registration of such shares under the
Securities Act would result in such shares becoming freely tradeable without
restriction under the Securities Act (except for shares purchased by Affiliates)
immediately upon the effectiveness of such registration.
 
   
     The Company intends to file a registration statement under the Securities
Act covering approximately 3,000,000 shares of Common Stock reserved for
issuance under the 1995 Plan. See "Management -- Restated 1995 Stock Incentive
Plan". Such registration statement is expected to be filed within 90 days after
the date of this Prospectus and will automatically become effective upon filing.
Following such filing, shares registered under such registration statement will,
subject to the Lock-Up Agreements, Rule 144 volume limitations applicable to
Affiliates and the lapsing of the Company's repurchase rights, be available for
sale in the open market upon the exercise of vested options 90 days after the
effective date of this Prospectus. At December 31, 1997, options to purchase
1,808,350 shares were issued and outstanding under the 1995 Plan and options to
purchase 80,000 shares were issued and outstanding outside of the 1995 Plan.
    
 
                                       60
<PAGE>   64
 
                            VALIDITY OF COMMON STOCK
 
     The validity of the Common Stock offered hereby will be passed upon for the
Company by Brobeck, Phleger & Harrison LLP, Austin, Texas. Certain legal matters
in connection with the offering will be passed upon for the Underwriters by
Ropes & Gray, Boston, Massachusetts.
 
                                    EXPERTS
 
   
     The consolidated financial statements of ISS Group, Inc. at December 31,
1996 and 1997, and for each of the three years in the period ended December 31,
1997, appearing in this Prospectus and the Registration Statement have been
audited by Ernst & Young LLP, independent auditors, as set forth in their report
thereon appearing elsewhere herein and in the Registration Statement, and are
included in reliance upon such report given upon the authority of such firm as
experts in accounting and auditing.
    
 
                             ADDITIONAL INFORMATION
 
     The Company has filed with the Commission, Washington, D.C. 20549, a
Registration Statement on Form S-1 under the Securities Act with respect to the
Common Stock offered hereby. This Prospectus does not contain all of the
information set forth in the Registration Statement and the exhibits and
schedules to the Registration Statement. For further information with respect to
the Company and the Common Stock offered hereby, reference is made to the
Registration Statement and the exhibits and schedules filed as a part of the
Registration Statement. Statements contained in this Prospectus concerning the
contents of any contract or any other document are not necessarily complete;
reference is made in each instance to the copy of such contract or any other
document filed as an exhibit to the Registration Statement. Each such statement
is qualified in all respects by such reference to such exhibit. The Registration
Statement, including exhibits and schedules thereto, may be inspected without
charge at the Commission's principal office in Washington, D.C., and copies of
all or any part thereof may be obtained from the Public Reference Section of the
Commission, 450 Fifth Street, N.W., Washington, D.C. 20549, and at the
Commission's regional offices located at Citicorp Center, 500 West Madison
Street, Suite 1400, Chicago, Illinois 60661 and at 7 World Trade Center, 13th
Floor, New York, New York 10048 after payment of fees prescribed by the
Commission. The Commission also maintains a Web site which provides online
access to reports, proxy and information statements and other information
regarding registrants that file electronically with the Commission at the
address http://www.sec.gov.
 
                                       61
<PAGE>   65
 
                   INDEX TO CONSOLIDATED FINANCIAL STATEMENTS
 
<TABLE>
<CAPTION>
                                                              PAGE
                                                              ----
<S>                                                           <C>
Report of Independent Auditors..............................   F-2
Consolidated Balance Sheets as of December 31, 1996 and
  1997......................................................   F-3
Consolidated Statements of Operations for the Years Ended
  December 31, 1995, 1996 and 1997..........................   F-4
Consolidated Statements of Stockholders' Equity (Deficit)
  for the Years Ended
  December 31, 1995, 1996 and 1997..........................   F-5
Consolidated Statements of Cash Flows for the Years Ended
  December 31, 1995, 1996 and 1997..........................   F-6
Notes to Consolidated Financial Statements..................   F-7
</TABLE>
 
                                       F-1
<PAGE>   66
 
                         REPORT OF INDEPENDENT AUDITORS
 
Board of Directors
ISS Group, Inc.
 
     We have audited the accompanying consolidated balance sheets of ISS Group,
Inc. (formerly Internet Security Systems, Inc.) as of December 31, 1996 and
1997, and the related consolidated statements of operations, stockholders'
equity (deficit), and cash flows for each of the three years in the period ended
December 31, 1997. These financial statements are the responsibility of the
Company's management. Our responsibility is to express an opinion on these
financial statements based on our audits.
 
     We conducted our audits in accordance with generally accepted auditing
standards. Those standards require that we plan and perform the audit to obtain
reasonable assurance about whether the financial statements are free of material
misstatement. An audit includes examining, on a test basis, evidence supporting
the amounts and disclosures in the financial statements. An audit also includes
assessing the accounting principles used and significant estimates made by
management, as well as evaluating the overall financial statement presentation.
We believe that our audits provide a reasonable basis for our opinion.
 
     In our opinion, the financial statements referred to above present fairly,
in all material respects, the consolidated financial position of ISS Group, Inc.
at December 31, 1996 and 1997, and the consolidated results of its operations
and its cash flows for each of the three years in the period ended December 31,
1997, in conformity with generally accepted accounting principles.
 
                                                /s/ ERNST & YOUNG LLP
 
Atlanta, Georgia
January 13, 1998
 
                                       F-2
<PAGE>   67
 
                                ISS GROUP, INC.
 
                          CONSOLIDATED BALANCE SHEETS
 
<TABLE>
<CAPTION>
                                                                 DECEMBER 31,
                                                    ---------------------------------------
                                                                                 PRO FORMA
                                                       1996          1997          1997
                                                    -----------   -----------   -----------
                                                                                (UNAUDITED)
<S>                                                 <C>           <C>           <C>
                                          ASSETS
Current assets:
  Cash and cash equivalents.......................  $ 2,007,000   $ 3,929,000   $ 3,929,000
  Accounts receivable, less allowance for doubtful
     accounts of $79,000, $255,000 and $255,000,
     respectively.................................    1,949,000     4,038,000     4,038,000
  Prepaid expenses and other current assets.......      128,000       281,000       281,000
                                                    -----------   -----------   -----------
          Total current assets....................    4,084,000     8,248,000     8,248,000
Property and equipment:
  Computer equipment..............................      267,000     1,688,000     1,688,000
  Office furniture and equipment..................       59,000       268,000       268,000
  Leasehold improvements..........................       15,000        15,000        15,000
                                                    -----------   -----------   -----------
                                                        341,000     1,971,000     1,971,000
  Less accumulated depreciation...................       68,000       402,000       402,000
                                                    -----------   -----------   -----------
                                                        273,000     1,569,000     1,569,000
Other assets......................................       23,000        49,000        49,000
                                                    -----------   -----------   -----------
          Total assets............................  $ 4,380,000   $ 9,866,000   $ 9,866,000
                                                    ===========   ===========   ===========
                      LIABILITIES AND STOCKHOLDERS' EQUITY (DEFICIT)
Current liabilities:
  Accounts payable................................  $   341,000   $ 2,002,000   $ 2,002,000
  Accrued expenses................................      731,000     1,798,000     1,798,000
  Deferred revenues...............................      644,000     2,106,000     2,106,000
  Current portion of long term debt...............       70,000        70,000        70,000
                                                    -----------   -----------   -----------
          Total current liabilities...............    1,786,000     5,976,000     5,976,000
Long term debt....................................      140,000        70,000        70,000
Commitments and contingencies.....................           --            --            --
Redeemable, Convertible Preferred Stock (5,737,000
  shares authorized):
     Series A; $.001 par value; 3,650,000 issued
       and outstanding (historical), none issued
       or outstanding (pro forma) (liquidation
       preference $1 per share)...................    3,614,000     3,621,000            --
     Series B; $.001 par value; 2,087,000 issued
       and outstanding (historical), none issued
       or outstanding (pro forma) (liquidation
       preference $2.53 per share)................           --     5,257,000            --
Stockholders' equity (deficit):
  Preferred Stock; $.001 par value; 20,000,000
     shares authorized (including 5,737,000
     designated as Redeemable, Convertible
     Preferred Stock), none issued or
     outstanding..................................           --            --            --
  Common Stock, $.001 par value, 50,000,000 shares
     authorized, 7,902,000 and 7,921,000 shares
     issued and outstanding (historical),
     13,658,000 shares issued and outstanding (pro
     forma).......................................        8,000         8,000        14,000
  Additional paid-in capital......................      103,000       124,000     8,996,000
  Accumulated deficit.............................   (1,271,000)   (5,190,000)   (5,190,000)
                                                    -----------   -----------   -----------
          Total stockholders' equity (deficit)....   (1,160,000)   (5,058,000)    3,820,000
                                                    -----------   -----------   -----------
          Total liabilities and stockholders'
            equity (deficit)......................  $ 4,380,000   $ 9,866,000   $ 9,866,000
                                                    ===========   ===========   ===========
</TABLE>
 
                            See accompanying notes.
 
                                       F-3
<PAGE>   68
 
                                ISS GROUP, INC.
 
                     CONSOLIDATED STATEMENTS OF OPERATIONS
 
   
<TABLE>
<CAPTION>
                                                               YEAR ENDED DECEMBER 31,
                                                        -------------------------------------
                                                          1995         1996          1997
                                                        ---------   -----------   -----------
<S>                                                     <C>         <C>           <C>
Revenues:
  Licenses............................................  $ 246,000   $ 4,233,000   $10,936,000
  Support services....................................     11,000       229,000     2,531,000
                                                        ---------   -----------   -----------
                                                          257,000     4,462,000    13,467,000
Costs and expenses:
  Cost of revenues....................................      4,000        18,000       676,000
  Research and development............................     97,000     1,225,000     3,434,000
  Sales and marketing.................................    252,000     3,768,000    11,731,000
  General and administrative..........................     44,000       656,000     1,773,000
                                                        ---------   -----------   -----------
                                                          397,000     5,667,000    17,614,000
                                                        ---------   -----------   -----------
Operating loss........................................   (140,000)   (1,205,000)   (4,147,000)
Interest income.......................................         --        77,000       245,000
Interest expense......................................         --        (3,000)      (17,000)
                                                        ---------   -----------   -----------
Net loss..............................................  $(140,000)  $(1,131,000)  $(3,919,000)
                                                        =========   ===========   ===========
Basic and diluted net loss per share of Common
  Stock...............................................       (.03)         (.14)         (.50)
                                                        =========   ===========   ===========
Weighted average number of shares used in calculating
  basic and diluted net loss per share of Common
  Stock...............................................  5,001,000     7,916,000     7,907,000
                                                        =========   ===========   ===========
Unaudited pro forma net loss per share of Common
  Stock...............................................                            $      (.29)
                                                                                  ===========
Unaudited weighted average number of shares used in
  calculating pro forma net loss per share of Common
  Stock...............................................                             13,644,000
                                                                                  ===========
</TABLE>
    
 
                            See accompanying notes.
 
                                       F-4
<PAGE>   69
 
                                ISS GROUP, INC.
 
           CONSOLIDATED STATEMENTS OF STOCKHOLDERS' EQUITY (DEFICIT)
 
<TABLE>
<CAPTION>
                                                                          RETAINED         TOTAL
                                         COMMON STOCK      ADDITIONAL     EARNINGS     STOCKHOLDERS'
                                      ------------------    PAID-IN     (ACCUMULATED      EQUITY
                                       SHARES     AMOUNT    CAPITAL       DEFICIT)       (DEFICIT)
                                      ---------   ------   ----------   ------------   -------------
<S>                                   <C>         <C>      <C>          <C>            <C>
Balance at December 31, 1994........  4,586,000   $5,000    $ (5,000)   $    10,000     $    10,000
  Issuance of Common Stock to
     investor, September 8,1995.....  1,293,000    1,000      49,000             --          50,000
  Issuance of Common Stock to
     employees, December 29,1995....  2,123,000    2,000      81,000             --          83,000
  Cash dividends....................         --       --          --        (10,000)        (10,000)
  Net loss..........................         --       --          --       (140,000)       (140,000)
                                      ---------   ------    --------    -----------     -----------
Balance at December 31,1995.........  8,002,000    8,000     125,000       (140,000)         (7,000)
  Repurchase of Common Stock from
     founder........................   (100,000)      --     (15,000)            --         (15,000)
  Accretion related to Redeemable,
     Convertible Preferred Stock....         --       --      (7,000)            --          (7,000)
  Net loss..........................         --       --          --     (1,131,000)     (1,131,000)
                                      ---------   ------    --------    -----------     -----------
Balance at December 31,1996.........  7,902,000    8,000     103,000     (1,271,000)     (1,160,000)
  Accretion related to Redeemable,
     Convertible Preferred Stock....         --       --     (11,000)            --         (11,000)
  Issuance of Common Stock..........     19,000       --      32,000             --          32,000
  Net loss..........................         --       --          --     (3,919,000)     (3,919,000)
                                      ---------   ------    --------    -----------     -----------
Balance at December 31,1997.........  7,921,000   $8,000    $124,000    $(5,190,000)    $(5,058,000)
                                      =========   ======    ========    ===========     ===========
</TABLE>
 
                            See accompanying notes.
 
                                       F-5
<PAGE>   70
 
                                ISS GROUP, INC.
 
                     CONSOLIDATED STATEMENTS OF CASH FLOWS
 
<TABLE>
<CAPTION>
                                                               YEAR ENDED DECEMBER 31,
                                                        -------------------------------------
                                                          1995         1996          1997
                                                        ---------   -----------   -----------
<S>                                                     <C>         <C>           <C>
OPERATING ACTIVITIES
Net loss..............................................  $(140,000)  $(1,131,000)  $(3,919,000)
Adjustments to reconcile net loss to net cash used in
  operating activities:
  Depreciation........................................      4,000        66,000       334,000
  Non-cash expense....................................     83,000            --        31,000
  Changes in assets and liabilities:
     Accounts receivable..............................   (148,000)   (1,802,000)   (2,089,000)
     Prepaid expenses and other assets................     (3,000)     (146,000)     (179,000)
     Accounts payable and accrued expenses............    117,000       955,000     2,728,000
     Deferred revenues................................     37,000       607,000     1,462,000
                                                        ---------   -----------   -----------
Net cash used in operating activities.................    (50,000)   (1,451,000)   (1,632,000)
INVESTING ACTIVITIES
Purchases of property and equipment...................    (23,000)     (320,000)   (1,630,000)
                                                        ---------   -----------   -----------
Net cash used in investing activities.................    (23,000)     (320,000)   (1,630,000)
FINANCING ACTIVITIES
Proceeds from (payments on) long term debt............         --       210,000       (70,000)
Net proceeds from Redeemable, Convertible Preferred
  Stock issuances.....................................         --     3,607,000     5,253,000
Proceeds from (payments on) notes payable to
  shareholder.........................................     30,000       (30,000)           --
Common Stock activities...............................     50,000       (15,000)        1,000
Cash dividends........................................    (10,000)           --            --
                                                        ---------   -----------   -----------
Net cash provided by financing activities.............     70,000     3,772,000     5,184,000
                                                        ---------   -----------   -----------
Net (decrease) increase in cash and cash
  equivalents.........................................     (3,000)    2,001,000     1,922,000
Cash and cash equivalents at beginning of year........      9,000         6,000     2,007,000
                                                        ---------   -----------   -----------
Cash and cash equivalents at end of year..............  $   6,000   $ 2,007,000   $ 3,929,000
                                                        =========   ===========   ===========
SUPPLEMENTAL CASH FLOW DISCLOSURE
Interest paid.........................................  $      --   $     1,000   $    17,000
                                                        =========   ===========   ===========
</TABLE>
 
                            See accompanying notes.
 
                                       F-6
<PAGE>   71
 
                                ISS GROUP, INC.
 
                   NOTES TO CONSOLIDATED FINANCIAL STATEMENTS
                               DECEMBER 31, 1997
 
1.  SIGNIFICANT ACCOUNTING POLICIES
 
CONSOLIDATION AND DESCRIPTION OF BUSINESS
 
     The consolidated financial statements include the accounts of ISS Group,
Inc. and its subsidiaries ("the Company"). All significant intercompany
investment accounts and transactions have been eliminated in consolidation.
 
     ISS Group, Inc. was incorporated in the State of Delaware on December 8,
1997 to be a holding company for Internet Security Systems, Inc., a Georgia
company incorporated on April 19, 1994 to design, market, and sell computer
network security assessment software. In March 1996, the Company formed Internet
Security Systems Europe NV ("ISS Europe"), of which the Company owns 99.96% of
the outstanding stock. In February 1997, the Company formed ISS Japan, KK, a
wholly owned subsidiary. These subsidiaries have primary marketing and sales
responsibilities for the Company's products in Europe and the Asia/Pacific
regions.
 
     The financial statements of foreign subsidiaries have been translated into
United States dollars in accordance with Financial Accounting Standards Board
("FASB") Statement of Financial Accounting Standards ("SFAS") No. 52 Foreign
Currency Translation. Revenues with international customers, except in Japan,
were denominated in U.S. dollars. Revenues from Japanese customers and
international expenditures were denominated in the respective local currencies
and translated using the average exchange rates for the year. The effect on the
statements of operations related to transaction gains and losses is
insignificant for all years presented. All balance sheet accounts have been
translated using the exchange rates in effect at the balance sheet date and the
effect of changes in exchange rates from year to year is insignificant.
 
     The Company's business is focused on maintaining the latest security threat
and vulnerability checks within existing products and creating new products and
services that are consistent with the Company's goal of providing an adaptive
security management approach to network security. This approach entails
continuous security risk monitoring and response to develop an active and
informed network security policy.
 
REVENUE RECOGNITION
 
     The Company recognizes its license revenue upon (i) delivery of software
or, if the customer has evaluation software, delivery of the software key, and
(ii) issuance of the related license, assuming no significant vendor obligations
or customer acceptance rights exist. In October 1997, the AICPA issued Statement
of Position ("SOP") No. 97-2, Software Revenue Recognition, which the Company
adopted, effective January 1, 1997. Such adoption had no effect on the Company's
methods of recognizing revenue from its license and maintenance activities.
Prior to 1997, the Company's revenue recognition policy was in accordance with
the preceding authoritative guidance provided by SOP No. 91-1, Software Revenue
Recognition.
 
     Revenues from perpetual licenses are recorded as license revenues in the
statements of operations. Support service revenues include maintenance, term
license revenues, and professional services. Annual renewable maintenance is a
separate component of each contract, and is recognized ratably over the contract
term. Term licenses, which allow customer use of the product and maintenance for
a specified period, generally twelve months, are also recognized ratably over
the contract term. Professional services revenues are recognized as such
services are performed.
 
                                       F-7
<PAGE>   72
                                ISS GROUP, INC.
 
           NOTES TO CONSOLIDATED FINANCIAL STATEMENTS -- (CONTINUED)
 
1. SIGNIFICANT ACCOUNTING POLICIES (CONTINUED)
CASH AND CASH EQUIVALENTS
 
     The Company considers all highly liquid investments with a maturity of
three months or less when purchased to be cash equivalents. Such amounts are
stated at cost which approximates market value.
 
CONCENTRATIONS OF CREDIT RISK
 
     Financial instruments that potentially subject the Company to significant
concentrations of credit risk consist principally of cash and cash equivalents
and accounts receivable. The Company maintains cash and cash equivalents with
two financial institutions. The Company's sales are primarily to companies
located in the United States, Europe and the Asia/Pacific regions. The Company
performs periodic credit evaluations of its customers' financial condition and
does not require collateral. Accounts receivable are due principally from large
U.S. companies under stated contract terms. The Company provides for estimated
credit losses at the time of sale. Such losses have not been significant to
date.
 
PROPERTY AND EQUIPMENT
 
     Property and equipment are stated at cost less accumulated depreciation.
Depreciation is computed using the straight-line method for financial reporting
purposes over the estimated useful lives of the assets (primarily three years).
 
RESEARCH AND DEVELOPMENT COSTS
 
     Research and development costs are charged to expense as incurred. The
Company has not capitalized any such development costs under SFAS No. 86,
Accounting for the Costs of Computer Software to Be Sold, Leased, or Otherwise
Marketed, because the costs incurred by the Company between the attainment of
technological feasibility for the related software product through the date when
the product is available for general release to customers is insignificant.
 
ADVERTISING COSTS
 
     The cost of advertising is expensed as incurred. The Company incurred
$34,000, $485,000 and $572,000 of advertising costs for the years ended December
31, 1995, 1996 and 1997, respectively. Such amounts are included in sales and
marketing expense in the statements of operations.
 
USE OF ESTIMATES
 
     The preparation of financial statements in conformity with generally
accepted accounting principles requires management to make estimates and
assumptions that affect the amounts reported in the financial statements and
accompanying notes. Actual results may differ from those estimates, and such
differences may be material to the consolidated financial statements.
 
STOCK BASED COMPENSATION
 
     The Company grants stock options generally for a fixed number of shares to
certain employees with an exercise price equal to the fair value of the shares
at the date of grant. The Company accounts for stock option grants in accordance
with Accounting Principles Board ("APB") Opinion No. 25, Accounting for Stock
Issued to Employees, and, accordingly, recognizes no compensation expense for
stock option grants for which the terms are fixed. In October 1995, the FASB
issued SFAS No. 123, Accounting for Stock-Based Compensation, which provides an
alternative to APB Opinion No. 25 in accounting for stock-based compensation
issued to employees. As permitted by SFAS No. 123, the Company continues
 
                                       F-8
<PAGE>   73
                                ISS GROUP, INC.
 
           NOTES TO CONSOLIDATED FINANCIAL STATEMENTS -- (CONTINUED)
 
1. SIGNIFICANT ACCOUNTING POLICIES (CONTINUED)
STOCK BASED COMPENSATION (CONTINUED)
to account for stock-based compensation in accordance with APB Opinion No. 25
and has elected the pro forma disclosure alternative of SFAS No. 123 (see Note
6).
 
PRO FORMA BALANCE SHEET (UNAUDITED)
 
     In conjunction with an initial public offering of the Company's Common
Stock, all outstanding shares of Series A and Series B Redeemable, Convertible
Preferred Stock automatically convert into shares of Common Stock. As such, the
effect of the conversions has been reflected in the unaudited pro forma balance
sheet at December 31, 1997.
 
LOSS PER SHARE
 
   
     In 1997, the FASB issued SFAS No. 128, Earnings per Share and in February
1998, the Securities and Exchange Commission issued Staff Accounting Bulletin
No. 98 ("SAB 98") related to SFAS No. 128. SFAS No. 128 replaced the calculation
of primary and fully diluted earnings per share with basic and diluted earnings
per share. Unlike primary earnings per share, basic earnings per share excludes
any dilutive effects of options, warrants, and convertible securities. Diluted
earnings per share is very similar to the previously reported fully diluted
earnings per share. The Company has no Common Stock equivalents due to "cheap
stock" as defined in SAB 98.
    
 
   
     Basic and diluted historical net loss per share (see Note 10) was computed
by dividing net loss plus accretion of the Series A and Series B Redeemable,
Convertible Preferred Stock by the weighted average number of shares of Common
Stock. Common Stock equivalents were antidilutive and therefore were not
included in the computation of weighted average shares used in computing diluted
loss per share for the years ended December 31, 1995, 1996 and 1997.
    
 
   
     Unaudited pro forma net loss per share was computed by dividing net loss by
the unaudited weighted average number of shares of Common Stock outstanding plus
the conversion of the 3,650,000 shares of Series A and 2,087,000 shares of
Series B Redeemable, Convertible Preferred Stock into 5,737,000 shares of Common
Stock which will occur upon consummation of the Company's initial public
offering.
    
 
   
RECENTLY ISSUED ACCOUNTING STANDARDS
    
 
     In June 1997, the FASB issued SFAS No. 130, Reporting Comprehensive Income,
which establishes standards for reporting and displaying comprehensive income,
as defined, and its components in financial statements. The Company's adoption
of SFAS No. 130 had no impact on the consolidated financial statements.
 
     In June 1997, the FASB issued SFAS No. 131, Disclosures about Segments of
an Enterprise and Related Information. SFAS No. 131 establishes standards for
the way that public business enterprises report information about operating
segments in annual financial statements for periods beginning after December 15,
1997. The Statement requires that business segment financial information be
reported in the financial statements utilizing the management approach. The
management approach is defined as the manner in which management organizes the
segments within the enterprise for making operating decisions and assessing
performance. Management believes the adoption of SFAS No. 131 will not have a
material impact on the financial statements.
 
                                       F-9
<PAGE>   74
                                ISS GROUP, INC.
 
           NOTES TO CONSOLIDATED FINANCIAL STATEMENTS -- (CONTINUED)
 
1. SIGNIFICANT ACCOUNTING POLICIES (CONTINUED)
RECLASSIFICATIONS
 
     Certain reclassifications were made to the prior years' financial
statements to conform with the 1997 presentation.
 
2.  FAIR VALUE OF FINANCIAL INSTRUMENTS
 
     The carrying amounts reported in the balance sheets for cash and cash
equivalents, accounts receivable and accounts payable approximate their fair
values. The carrying amounts reported in the balance sheets for long-term debt
approximate their fair values as the interest rate related to such debt is
variable and commensurate with the Company's credit worthiness.
 
3.  DEBT
 
     At December 31, 1996 and 1997, the Company had outstanding balances of
$210,000 and $140,000, respectively, under an equipment line of credit. Interest
on such line accrues at 1.25% above the prime rate and is payable on a monthly
basis. Borrowings under the equipment line are secured by equipment and are due
in annual installments of $70,000 in 1998 and 1999.
 
     At December 31, 1996, the Company had an unused $500,000 revolving line of
credit which matured on October 31, 1997 and was not renewed by the Company.
 
4.  REDEEMABLE, CONVERTIBLE PREFERRED STOCK
 
     Redeemable, Convertible Preferred Stock consists of the following:
 
<TABLE>
<CAPTION>
                                                                             SHARES ISSUED
                                                     GROSS         NET            AND
SERIES               DATE OF ISSUANCE               PROCEEDS     PROCEEDS     OUTSTANDING
- ------               ----------------              ----------   ----------   -------------
<S>      <C>                                       <C>          <C>          <C>
  A                  February 2, 1996              $3,650,000   $3,607,000     3,650,000
  B                 February 14, 1997               5,280,000    5,253,000     2,087,000
                                                   ----------   ----------     ---------
                                                   $8,930,000   $8,860,000     5,737,000
                                                   ==========   ==========     =========
</TABLE>
 
     Accretion related to the Company's Series A and Series B Redeemable,
Convertible Preferred Stock was recorded over the respective redemption period
by charges against additional paid-in capital with corresponding increases to
the carrying value of the Series A and Series B Redeemable, Convertible
Preferred Stock. Such increases aggregated $7,000 and $11,000 for the years
ended December 31, 1996 and 1997, respectively.
 
     The rights, preferences, qualifications, limitations, and restrictions of
the holders of the Series A and Series B Redeemable, Convertible Preferred Stock
are as follows:
 
          a. Dividend Rights.  Dividends as specifically declared by the
     Company's Board of Directors are to be in preference to payment of any
     dividend (other than dividends payable solely in Common Stock) with respect
     to the Common Stock.
 
          b. Liquidation Rights.  In the event of any liquidation, dissolution
     or winding up of the Corporation, whether voluntary or not, Series A and
     Series B holders shall be paid an amount equal to $1.00 per share and $2.53
     per share, respectively, (adjusted for stock splits, combinations, or
     similar events) plus, in each case, all declared and unpaid dividends, if
     any, before any amount shall be paid to holders of Common Stock. Any
     remaining assets and surplus funds shall be distributed ratably among the
     holders of the Common Stock, the Series A Preferred Stock and the Series B
 
                                      F-10
<PAGE>   75
                                ISS GROUP, INC.
 
           NOTES TO CONSOLIDATED FINANCIAL STATEMENTS -- (CONTINUED)
 
4.  REDEEMABLE, CONVERTIBLE PREFERRED STOCK (CONTINUED)
     Preferred Stock on an as-converted basis. In no event shall the holders of
     the Series A Preferred Stock and Series B Preferred Stock be entitled to
     receive more than $2.00 and $5.06 per share, respectively, unless such
     holders have converted their shares of Series A Preferred Stock or Series B
     Preferred Stock into Common Stock prior to the occurrence of a liquidation,
     dissolution or winding up of the Corporation.
 
          c. Mandatory Redemption.  If the Series A or Series B Preferred Stock
     has not been redeemed or converted into Common Stock prior to September 30,
     2000 each share of Series A and Series B Preferred Stock is redeemable at
     the request of the holders of at least 51% of the outstanding shares. If
     the redemption provisions are exercised, redemption will occur in stages in
     the years 2001, 2002, and 2003. The redemption price is equal to the
     original price plus all declared and unpaid dividends.
 
          d. Voting Rights.  The Series A and Series B Preferred Stock generally
     vote equally with shares of Common Stock on an "as if converted" basis
     except that the holders of Series A Preferred Stock, voting as a separate
     series, shall elect two members of the Company's Board of Directors. The
     holders of Common Stock and Series A and Series B Preferred Stock, voting
     together as a class, shall elect all the remaining directors.
 
          e. Protective Provisions.  The Series A and Series B Preferred Stock
     holders have certain protective provisions which prohibit the Company from
     certain activities (e.g. sale of substantially all of the Company's assets,
     changes to Series A and Series B instruments, dividend declarations,
     creating new classes of Preferred Stock senior to the Series A or Series B
     Preferred Stock) without first obtaining the approval of holders of at
     least a majority of the then outstanding shares of the Series A and Series
     B Preferred Stock holders, as defined.
 
          f. Conversion.  Shares of Series A and Series B Preferred Stock are
     convertible, at the option of the holder, to Common Stock at any time at
     the rate of one share of Common Stock for each share of Preferred Stock.
     The Series A and Series B Preferred Stock automatically converts to Common
     Stock upon the closing of (i) an underwritten public offering of the
     Company's Common Stock in which the aggregate proceeds for such shares is
     at least $10,000,000 and the per share price is at least $6.00 per share
     (adjusted for any stock split, dividend, combination, recapitalization, or
     the like) or (ii) the written election of holders of not less than a
     majority of the then outstanding shares of such series.
 
     In connection with the issuance of the Series A Preferred Stock, the
Company effected an 89.92-for-1 share stock split of its Common Stock. The
Company has designated 3,650,000 shares of the authorized Preferred Stock as
Series A Preferred Stock and 2,087,000 shares as Series B Preferred Stock. All
par value and share amounts in the accompanying financial statements have been
retroactively adjusted to reflect the stock split and changes to the articles of
incorporation.
 
5.  STOCKHOLDERS' EQUITY
 
     On April 19, 1994, the Company issued 4,586,000 shares of Common Stock to
the founder in exchange for the assignment of technology previously developed
and distributed by the founder as shareware. In connection with the issuance of
Series A Preferred Stock (see Note 4), the founder entered into a Stock
Repurchase Agreement (the "Founder's Agreement") with the Company. Under the
Founder's Agreement the Company has the right to acquire, at fair market value,
up to 2,293,000 shares of the founder's Common Stock upon the founder's
separation from the Company, as defined. The Company's repurchase rights expire
ratably over a four year period beginning February 1, 1996 or upon the
consummation of an initial public offering of the Company's Common Stock.
 
                                      F-11
<PAGE>   76
                                ISS GROUP, INC.
 
           NOTES TO CONSOLIDATED FINANCIAL STATEMENTS -- (CONTINUED)
 
5.  STOCKHOLDERS' EQUITY (CONTINUED)
     On September 8, 1995, the Company issued 1,293,000 shares of Common Stock
to an investor for $50,000.
 
     On December 29, 1995, the Company issued 2,123,000 shares of Common Stock
to two employees and recorded $83,000 of compensation expense. In connection
with the issuance of Series A Preferred Stock (see Note 4), the employees
entered into a Stock Repurchase Agreement (the "Agreement") with the Company.
Under the Agreement, the Company has the right to acquire, at fair market value,
up to 1,633,000 shares of such employees' Common Stock upon the employees'
separation from the Company, as defined. The Company's repurchase rights expire
ratably over a four year period beginning February 1, 1996 or upon the
consummation of an initial public offering of the Company's Common Stock.
 
     On February 2, 1996 the Company acquired 100,000 shares of its Common Stock
from the founder for $15,000.
 
     The Company has reserved 8,810,000 shares of Common Stock for future
issuance upon conversion of outstanding Series A and Series B Preferred Stock
and exercise of options to purchase Common Stock.
 
   
     In December 1997, the Company commenced plans to offer up to 2,685,000 of
newly issued shares of Common Stock in an initial public offering plus 385,000
shares that the underwriters have the option to purchase to cover
over-allotments, if any.
    
 
6.  STOCK OPTION PLANS
 
     In 1995, the Company established the 1995 Incentive Stock Plan (the "Plan")
to provide for the granting of qualified or nonqualified options to purchase
shares of the Company's Common Stock. In 1997, the Company amended the Plan to
increase the number of shares reserved for future issuance under such plan to
3,000,000 shares.
 
     Effective with the 1997 Plan amendment, options granted under the Plan
became immediately exercisable, subject to a right of repurchase by the Company
at the original exercise price for all unvested shares. Vesting occurs in equal
annual installments over four years, generally measured from the date of the
grant. Once an optionee vests in the shares underlying the option and until
certain events occur, including an initial public offering of the Company's
common stock, the Company has a right of first refusal to repurchase such shares
after an individual has received a bona fide third party offer with respect to
such vested shares. All options are issued at fair market value on the date of
grant. Fair market value of the Company's Common Stock, in the absence of
trading on a national or regional stock exchange, is determined by the Company's
Board of Directors.
 
     The Plan also includes an Automatic Option Grant Program (the "Program").
Under the Program, each individual who first joins the Company's Board of
Directors as a non-employee Board member after the effective date of an initial
public offering will receive an option to purchase 20,000 shares of Common Stock
on the date he or she is first elected or appointed to the Board of Directors,
provided such individual has not otherwise been in the prior employ of the
Company. In addition, at each annual stockholders' meeting, beginning with the
1999 annual meeting, each individual who is to continue to serve as a
non-employee Board of Directors member after the meeting will receive an
additional option to purchase 5,000 shares of Common Stock. Options under the
Program will be isssued at fair market value at the date of the grant.
 
     On December 8, 1997, the Company's Board of Directors granted to each of
the Company's four non-employee directors a nonstatutory option to purchase up
to 20,000 shares of Common Stock outside
 
                                      F-12
<PAGE>   77
                                ISS GROUP, INC.
 
           NOTES TO CONSOLIDATED FINANCIAL STATEMENTS -- (CONTINUED)
 
6.  STOCK OPTION PLANS (CONTINUED)
the Plan, on the same terms as if those options had been granted under the
Program of the 1995 Plan. The Company reserved 80,000 shares of Common Stock for
issuance under these options.
 
     A summary of the Company's stock option activity is as follows:
 
   
<TABLE>
<CAPTION>
                                                       1996                   1997
                                               --------------------   --------------------
                                                           WEIGHTED               WEIGHTED
                                                           AVERAGE                AVERAGE
                                                NUMBER     EXERCISE    NUMBER     EXERCISE
                                               OF SHARES    PRICE     OF SHARES    PRICE
                                               ---------   --------   ---------   --------
<S>                                            <C>         <C>        <C>         <C>
Outstanding at beginning of year.............        --      $ --       810,000    $ .16
  Granted....................................   810,000       .16     1,103,000     4.54
  Exercised..................................        --        --        (7,000)     .15
  Canceled...................................        --        --       (18,000)     .50
                                                -------               ---------
Outstanding at end of year...................   810,000       .16     1,888,000     2.71
                                                =======               =========
Exercisable at end of year...................        --               1,888,000     2.71
                                                =======               =========
Weighted average fair value of options
  granted during the year....................   $   .04               $    2.34
                                                =======               =========
</TABLE>
    
 
     The following table summarizes information concerning currently outstanding
options, all of which are exercisable:
 
   
<TABLE>
<CAPTION>
                                                            OPTIONS OUTSTANDING
                                             --------------------------------------------------
                                               NUMBER OF
                                                OPTIONS           WEIGHTED
                                             OUTSTANDING AT       AVERAGE           WEIGHTED
                                              DECEMBER 31,       REMAINING          AVERAGE
         RANGE OF EXERCISE PRICES                 1997        CONTRACTUAL LIFE   EXERCISE PRICE
         ------------------------            --------------   ----------------   --------------
<S>                                          <C>              <C>                <C>
$.15-.60...................................    1,067,000      8.6 years...           $ .28
$1.00-7.00.................................      821,000      9.9 years...            5.89
                                               ---------
                                               1,888,000
                                               =========
</TABLE>
    
 
     Pro forma information regarding net income and net income per share is
required by SFAS No. 123, which also requires that the information be determined
as if the Company had accounted for its employee stock options granted
subsequent to December 31, 1994 under the fair value method prescribed by that
Statement. The fair value for options granted was estimated at the date of grant
using the Black-Scholes option pricing model. The following weighted average
assumptions were used for 1996 and 1997, respectively: risk-free interest rates
of 5.97% and 6.28%; no dividend yield; a .60 volatility factor; and an expected
life of the options of 4 years.
 
     The Black-Scholes option valuation model was developed for use in
estimating the fair value of traded options which have no vesting restrictions
and are fully transferable. In addition, option valuation models require the
input of highly subjective assumptions including the expected stock price
volatility. Because the Company's employee stock options have characteristics
different from those of traded options, and because the changes in the
subjective input assumptions can materially affect the fair value estimate, in
management's opinion, the existing models do not necessarily provide a reliable
single measure of the fair value of its employee stock options.
 
                                      F-13
<PAGE>   78
                                ISS GROUP, INC.
 
           NOTES TO CONSOLIDATED FINANCIAL STATEMENTS -- (CONTINUED)
 
6.  STOCK OPTION PLANS (CONTINUED)
     For purposes of pro forma disclosures, the estimated fair value of the
option is amortized to expense over the options' vesting period. The following
pro forma information adjusts the net loss and unaudited pro forma net loss per
share of Common Stock for the impact of SFAS No. 123:
 
   
<TABLE>
<CAPTION>
                                                               YEAR ENDED
                                                              DECEMBER 31,
                                                                  1997
                                                              ------------
<S>                                                           <C>
Unaudited pro forma net loss................................  $(3,975,000)
                                                              ===========
Unaudited pro forma net loss per share as adjusted..........  $      (.29)
                                                              ===========
</TABLE>
    
 
7.  COMMITMENTS
 
     In 1996, the Company entered into noncancellable operating leases for new
facilities that expire in July 2001. The Company has the option to extend the
terms of the leases for one additional five year term upon expiration of the
initial terms.
 
     Future minimum payments under noncancellable operating leases with initial
terms of one year or more consisted of the following at December 31:
 
<TABLE>
<CAPTION>
                                                              OPERATING
                                                                LEASES
                                                              ----------
<S>                                                           <C>
1998........................................................  $  400,000
1999........................................................     277,000
2000........................................................     276,000
2001........................................................     105,000
                                                              ----------
          Total minimum lease payments......................  $1,058,000
                                                              ==========
</TABLE>
 
     Rent expense was approximately $4,000, $105,000 and $401,000 for the years
ended December 31, 1995, 1996 and 1997, respectively.
 
8.  INCOME TAXES
 
     On January 1, 1996 the Company adopted the liability method of accounting
for income taxes. Under this method, deferred income tax assets and liabilities
are determined based on the differences between the financial reporting and the
tax bases of assets and liabilities and are measured using the enacted tax rates
and laws that will be in effect when the differences are expected to reverse.
Prior to 1996, the Company qualified as an S-Corporation and any income taxes
were the responsibilities of the shareholders.
 
     A reconciliation of the provision for income taxes to the statutory federal
income tax rate is as follows:
 
<TABLE>
<CAPTION>
                                                           YEAR ENDED DECEMBER 31,
                                                           ------------------------
                                                             1996          1997
                                                           ---------    -----------
<S>                                                        <C>          <C>
Statutory rate at 34%, applied to pre-tax loss...........  $(384,000)   $(1,332,000)
State income taxes, net of federal tax benefit...........    (45,000)      (157,000)
Research and development tax credit......................    (28,000)      (159,000)
Foreign operations.......................................    100,000             --
Other....................................................     46,000        (26,000)
Change in valuation allowance............................    311,000      1,674,000
                                                           ---------    -----------
                                                           $      --    $        --
                                                           =========    ===========
</TABLE>
 
                                      F-14
<PAGE>   79
                                ISS GROUP, INC.
 
           NOTES TO CONSOLIDATED FINANCIAL STATEMENTS -- (CONTINUED)
 
8.  INCOME TAXES (CONTINUED)
     Deferred income taxes reflect the net tax effects of temporary differences
between the carrying amounts of assets and liabilities for financial reporting
purposes and the amounts used for income tax purposes. Significant components of
the Company's net deferred income tax assets are as follows:
 
<TABLE>
<CAPTION>
                                                                  DECEMBER 31,
                                                             ----------------------
                                                               1996         1997
                                                             --------    ----------
<S>                                                          <C>         <C>
Depreciation...............................................  $     --    $   69,000
Accrued liabilities........................................    20,000       148,000
Allowance for doubtful accounts............................    30,000        97,000
Net operating loss carryforwards...........................   233,000     1,484,000
Research and development tax credit carryforwards..........    28,000       187,000
                                                             --------    ----------
                                                              311,000     1,985,000
Less valuation allowance...................................  (311,000)   (1,985,000)
                                                             --------    ----------
Net deferred income tax assets.............................  $     --    $       --
                                                             ========    ==========
</TABLE>
 
     For financial reporting purposes, a valuation allowance has been recognized
to reduce the net deferred income tax assets to zero. The Company has not
recognized any benefit from the future use of such loss carryforwards because
management's evaluation of all the available evidence in assessing the
realizability of the tax benefits of such loss carryforwards indicates that the
underlying assumptions of future profitable operations contain risks that do not
provide sufficient assurance to recognize such tax benefits currently.
 
     The Company has approximately $3,906,000 of net operating loss
carryforwards for federal income tax purposes that expire in varying amounts
between 2011 and 2012. A small portion of the net operating loss carryforwards
may be subject to certain limitations in the event of a change in ownership. The
Company also has approximately $295,000 of net operating loss carryforwards
related to its foreign operations which have no expiration date. Additionally,
the Company has approximately $187,000 of research and development tax credit
carryforwards which expire between 2011 and 2012.
 
9.  EMPLOYEE BENEFIT PLANS
 
     In January 1996, the Company established a 401(k) plan that covers
substantially all employees over 21 years of age. The Company may make
contributions to the plan at its discretion. The Company made no contributions
to the plan for the years ended December 31, 1996 or 1997.
 
                                      F-15
<PAGE>   80
                                ISS GROUP, INC.
 
           NOTES TO CONSOLIDATED FINANCIAL STATEMENTS -- (CONTINUED)
 
10.  LOSS PER SHARE
 
     The following table sets forth the computation of basic, diluted and
unaudited pro forma net loss per share:
 
   
<TABLE>
<CAPTION>
                                              HISTORICAL                   PRO FORMA
                               ----------------------------------------   ------------
                                  1995          1996           1997           1997
                               -----------   -----------   ------------   ------------
                                                                          (UNAUDITED)
<S>                            <C>           <C>           <C>            <C>
Numerator:
  Net loss...................  $  (140,000)  $(1,131,000)  $ (3,919,000)  $ (3,919,000)
  Accretion of Series A and
     Series B Redeemable,
     Convertible Preferred
     Stock...................           --        (7,000)       (11,000)       (11,000)
                               -----------   -----------   ------------   ------------
                               $  (140,000)  $(1,138,000)  $ (3,930,000)  $ (3,930,000)
                               ===========   ===========   ============   ============
Denominator:
  Denominator for basic and
     diluted net loss per
     share -- weighted
     average shares..........    5,001,000     7,916,000      7,907,000      7,907,000
  Redeemable, Convertible
     Preferred Stock.........           --            --             --      5,737,000
                               -----------   -----------   ------------   ------------
                                 5,001,000     7,916,000      7,907,000     13,644,000
                               ===========   ===========   ============   ============
Basic net loss per share.....  $      (.03)  $      (.14)  $       (.50)
                               ===========   ===========   ============
Diluted net loss per share...  $      (.03)  $      (.14)  $       (.50)
                               ===========   ===========   ============
Pro forma net loss per
  share......................                                             $       (.29)
                                                                          ============
</TABLE>
    
 
   
11.  EXPORT SALES
    
 
     Export sales from the United States to the Europe and Asia/Pacific regions
represented approximately 10% and 3%, respectively, of total revenues for the
year ended December 31, 1997. Export sales were not significant for the years
ended December 31, 1995 and 1996. Revenues generated from the Company's foreign
operations located in the Asia/Pacific region totalled approximately 8% of total
revenues for the year ended December 31, 1997. The Company had no revenue
generating foreign operations prior to 1997.
 
                                      F-16
<PAGE>   81
 
                                  UNDERWRITING
 
     Subject to the terms and conditions of the Underwriting Agreement, the
Company and the Selling Stockholders have agreed to sell to each of the
Underwriters named below, and each of such Underwriters, for whom Goldman, Sachs
& Co., BancAmerica Robertson Stephens, UBS Securities LLC and Wessels, Arnold &
Henderson, L.L.C. are acting as representatives, has severally agreed to
purchase from the Company and the Selling Stockholders, the respective number of
shares of Common Stock set forth opposite its name below:
 
   
<TABLE>
<CAPTION>
                                                              NUMBER OF
                                                              SHARES OF
                                                               COMMON
                        UNDERWRITER                             STOCK
                        -----------                           ---------
<S>                                                           <C>
Goldman, Sachs & Co. .......................................
BancAmerica Robertson Stephens .............................
UBS Securities LLC..........................................
Wessels, Arnold & Henderson, L.L.C. ........................
 
                                                              ---------
          Total.............................................  3,000,000
                                                              =========
</TABLE>
    
 
     Under the terms and conditions of the Underwriting Agreement, the
Underwriters are committed to take and pay for all of the shares offered hereby,
if any are taken.
 
     The Underwriters propose to offer the shares of Common Stock in part
directly to the public at the initial public offering price set forth on the
cover page of this Prospectus, and in part to certain securities dealers at such
price less a concession of $          per share. The Underwriters may allow, and
such dealers may reallow, a concession not in excess of $          per share to
certain brokers and dealers. After the shares of Common Stock are released for
sale to the public, the offering price and other selling terms may from time to
time be varied by the representatives.
 
   
     The Company and Selling Stockholders have granted the Underwriters an
option exercisable for 30 days after the date of the Prospectus to purchase up
to an aggregate of 450,000 additional shares of Common Stock solely to cover
over-allotments, if any. If the Underwriters exercise their over-allotment
option, the Underwriters have severally agreed, subject to certain conditions,
to purchase approximately the same percentage thereof that the number of shares
to be purchased by each of them, as shown in the foregoing table, bears to the
3,000,000 shares of Common Stock offered.
    
 
     The Company and the Selling Stockholders have agreed that, during the
period beginning from the date of this Prospectus and continuing to and
including the date 180 days after the date of this Prospectus, they will not
offer, sell, contract to sell or otherwise dispose of any securities of the
Company (other than pursuant to employee stock option plans existing on the date
of this Prospectus) which are substantially similar to the shares of Common
Stock or which are convertible or exchangeable into shares of Common Stock or
any securities which are substantially similar to the shares of Common Stock,
without the prior written consent of the representatives of the Underwriters.
 
   
     In connection with the Offering, the Underwriters may purchase and sell the
Common Stock in the open market. These transactions may include over-allotment
and stabilizing transactions and purchases to cover syndicate short positions
created in connection with the Offering. Stabilizing transactions consist of
certain bids or purchases for the purpose of preventing or retarding a decline
in the market price of the Common Stock; and syndicate short positions involve
the sale by the Underwriters of a greater number of shares of Common Stock than
they are required to purchase from the Company in the Offering. The Underwriters
also may impose a penalty bid, whereby selling concessions allowed to syndicate
members or other broker-dealers in respect of the securities sold in the
Offering for their account may be reclaimed by the syndicate if such shares of
Common Stock are repurchased by the syndicate in stabilizing or covering
transactions. These activities may stabilize, maintain or otherwise affect the
market price of the
    
 
                                       U-1
<PAGE>   82
 
Common Stock which may be higher than the price that might otherwise prevail in
the open market; and these activities, if commenced, may be discontinued at any
time. These transactions may be effected on the Nasdaq National Market, in the
over-the-counter market or otherwise.
 
     The representatives of the Underwriters have informed the Company that they
do not expect sales to accounts over which the Underwriters exercise
discretionary authority to exceed five percent of the total number of shares of
Common Stock offered by them.
 
     Prior to this Offering, there has been no public market for the shares of
Common Stock. The initial public offering price will be negotiated among the
Company and the representatives of the Underwriters. Among the factors to be
considered in determining the initial public offering price of the Common Stock,
in addition to prevailing market conditions, will be the Company's historical
performance, estimates of the business potential and earnings prospects of the
Company, an assessment of the Company's management and the consideration of the
above factors in relation to market valuation of companies in related
businesses.
 
   
     The Underwriters have reserved for sale, at the initial public offering
price up to five percent of the shares of Common Stock offered hereby for
employees of the Company and certain other individuals who have expressed an
interest in purchasing such shares of Common Stock in this Offering. The number
of shares available for sale to the general public will be reduced to the extent
such persons purchase such reserved shares. Any reserved shares not so purchased
will be offered by the Underwriters to the general public on the same basis as
other shares offered hereby.
    
 
   
     The Common Stock has been approved for quotation on the Nasdaq National
Market under the symbol "ISSX", subject to official notice of issuance. The
Company has agreed to indemnify the several Underwriters against certain
liabilities, including liabilities under the Securities Act.
    
 
                                       U-2
<PAGE>   83


   
               [Graphic Depicting SAFEsuite Family & Products]
    



Security risks are a function of vulnerabilities and threats.  The risk
originates from the whole network - including every adjoining system  in its
architecture.  SAFEsuite monitors, detects and responds to vulnerabilities and
threats throughout the entire enterprise.


The ISS SAFEsuite is drive by the X-Force knowledge base, a comprehensive
security risk database.  With this insight, SAFEsuite is able to effectively
manage security risks by monitoring, detecting and responding to vulnerabilities
and threats across whole networks and systems.
<PAGE>   84
 
============================================================
 
  NO PERSON HAS BEEN AUTHORIZED TO GIVE ANY INFORMATION OR TO MAKE ANY
REPRESENTATIONS OTHER THAN THOSE CONTAINED IN THIS PROSPECTUS, AND, IF GIVEN OR
MADE, SUCH INFORMATION OR REPRESENTATIONS MUST NOT BE RELIED UPON AS HAVING BEEN
AUTHORIZED. THIS PROSPECTUS DOES NOT CONSTITUTE AN OFFER TO SELL OR THE
SOLICITATION OF AN OFFER TO BUY ANY SECURITIES OTHER THAN THE SECURITIES TO
WHICH IT RELATES OR AN OFFER TO SELL OR THE SOLICITATION OF AN OFFER TO BUY ANY
SECURITIES OTHER THAN THE SECURITIES TO WHICH IT RELATES OR AN OFFER TO SELL OR
THE SOLICITATION OF AN OFFER TO BUY SUCH SECURITIES IN ANY CIRCUMSTANCES IN
WHICH SUCH OFFER OR SOLICITATION IS UNLAWFUL. NEITHER THE DELIVERY OF THIS
PROSPECTUS NOR ANY SALE MADE HEREUNDER SHALL, UNDER ANY CIRCUMSTANCES, CREATE
ANY IMPLICATION THAT THERE HAS BEEN NO CHANGE IN THE AFFAIRS OF THE COMPANY
SINCE THE DATE HEREOF OR THAT THE INFORMATION CONTAINED HEREIN IS CORRECT AS OF
ANY TIME SUBSEQUENT TO ITS DATE.
                               ------------------
                               TABLE OF CONTENTS
 
   
<TABLE>
<CAPTION>
                                             PAGE
                                             ----
<S>                                          <C>
Prospectus Summary.........................    3
Risk Factors...............................    6
Use of Proceeds............................   16
Dividend Policy............................   16
Dilution...................................   17
Capitalization.............................   18
Selected Consolidated Financial Data.......   19
Management's Discussion and Analysis of
  Financial Condition and Results of
  Operations...............................   20
Business...................................   26
Management.................................   42
Certain Transactions.......................   51
Principal and Selling Stockholders.........   53
Description of Capital Stock...............   55
Shares Eligible for Future Sale............   59
Validity of Common Stock...................   61
Experts....................................   61
Additional Information.....................   61
Index to Consolidated Financial
  Statements...............................  F-1
Underwriting...............................  U-1
</TABLE>
    
 
                               ------------------
  THROUGH                , 1998 (THE 25TH DAY AFTER THE DATE OF THIS
PROSPECTUS), ALL DEALERS EFFECTING TRANSACTIONS IN THE COMMON STOCK, WHETHER OR
NOT PARTICIPATING IN THIS DISTRIBUTION, MAY BE REQUIRED TO DELIVER A PROSPECTUS.
THIS IS IN ADDITION TO THE OBLIGATION OF DEALERS TO DELIVER A PROSPECTUS WHEN
ACTING AS UNDERWRITERS AND WITH RESPECT TO THEIR UNSOLD ALLOTMENTS OR
SUBSCRIPTIONS.
============================================================
 
============================================================
 
   
                                3,000,000 SHARES
    
 
                                ISS GROUP, INC.
                                  COMMON STOCK
                          (PAR VALUE $0.001 PER SHARE)
 
                             ----------------------
 
                        [LOGO INTERNET SECURITY SYSTEMS]
                             ----------------------
 
                              GOLDMAN, SACHS & CO.
 
                         BANCAMERICA ROBERTSON STEPHENS
 
                                 UBS SECURITIES
 
                          WESSELS, ARNOLD & HENDERSON
 
                      REPRESENTATIVES OF THE UNDERWRITERS
 
============================================================
<PAGE>   85
 
                                    PART II
 
                     INFORMATION NOT REQUIRED IN PROSPECTUS
 
     All capitalized terms used and not defined in Part II of this Registration
Statement shall have the meaning assigned to them in the Prospectus which forms
a part of this Registration Statement.
 
ITEM 13.  OTHER EXPENSES OF ISSUANCE AND DISTRIBUTION
 
     The following table sets forth the costs and expenses, other than
underwriting discounts and commissions, payable by the registrant connection
with the sale of Common Stock being registered. All amounts are estimates,
except the SEC registration fee and the NASD filing fee.
 
   
<TABLE>
<S>                                                           <C>
SEC Registration fee........................................  $ 16,284
NASD fee....................................................     6,020
Nasdaq National Market listing fee..........................    95,000
Printing and engraving expenses.............................   200,000
Legal fees and expenses.....................................   300,000
Accounting fees and expenses................................   200,000
Blue sky fees and expenses..................................     5,000
Transfer agent fees.........................................     5,000
Miscellaneous...............................................    22,696
                                                              --------
          Total.............................................  $850,000
                                                              ========
</TABLE>
    
 
ITEM 14.  INDEMNIFICATION OF DIRECTORS AND OFFICERS
 
     Subsection (a) of Section 145 of the General Corporation Law of the State
of Delaware empowers a corporation to indemnify any person who was or is a party
or is threatened to be made a party to any threatened, pending or completed
action, suit or proceeding whether civil, criminal, administrative or
investigative (other than an action by or in the right of the corporation) by
reason of the fact that he is or was a director, officer, employee or agent of
the corporation, or is or was serving at the request of the corporation as a
director, officer, employee or agent of another corporation, partnership, joint
venture, trust or other enterprise, against expenses (including attorneys'
fees), judgments, fines and amounts paid in settlement actually and reasonably
incurred by him in connection with such action, suit or proceeding if he acted
in good faith and in a manner he reasonably believed to be in or not opposed to
the best interests of the corporation, and, with respect to any criminal action
or proceeding, had no reasonable cause to believe his conduct was unlawful.
 
     Subsection (b) of Section 145 empowers a corporation to indemnify any
person who was or is a party or is threatened to be made a party to any
threatened, pending or completed action or suit by right of the corporation to
procure a judgment in its favor by reason of the fact that such person acted in
any of the capacities set forth above, against expenses (including attorneys'
fees) actually and reasonably incurred by him in connection with the defense or
settlement of such action or suit if he acted in good faith and in a manner he
reasonably believed to be in or not opposed to the best interests of the
corporation, except that no indemnification may be made in respect to any claim
issue or matter as to which such person shall have been adjudged to be liable to
the corporation unless and only to the extent that the Court of Chancery or the
court in which such action or suit was brought shall determine upon application
that, despite the adjudication of liability but in view of all the circumstances
of the case, such person is fairly and reasonably entitled to indemnity for such
expenses which the Court of Chancery or such other court shall deem proper.
 
     Section 145 further provides that to the extent a director or officer of a
corporation has been successful on the merits or otherwise in the defense of any
such action, suit or proceeding referred to in subsections (a) and (b) of
Section 145 or in the defense of any claim, issue or matter therein, he shall be
indemnified against expenses (including attorneys' fees) actually and reasonably
incurred by him in
 
                                      II-1
<PAGE>   86
 
connection therewith; that the indemnification provided for by Section 145 shall
not be deemed exclusive of any other rights which the indemnified party may be
entitled; that indemnification provided by Section 145 shall, unless otherwise
provided when authorized or ratified, continue as to a person who has ceased to
be a director, officer, employee or agent and shall inure to the benefit of such
person's heirs, executors and administrators; and empowers the corporation to
purchase and maintain insurance on behalf of a director or officer of the
corporation against any liability asserted against him and incurred by him in
any such capacity, or arising out of his status as such, whether or not the
corporation would have the power to indemnify him against such liabilities under
Section 145.
 
     Section 102(b)(7) of the General Corporation Law or the State of Delaware
provides that a certificate of incorporation may contain a provision eliminating
or limiting the personal liability of a director to the corporation or its
stockholders for monetary damages for breach of fiduciary duty as a director,
provided that such provision shall not eliminate or limit the liability of the
director (i) for any breach of the director's duty of loyalty to the corporation
or its stockholders, (ii) for acts or omissions not in good faith or which
involve intentional misconduct or a knowing violation of law, (iii) under
Section 174 of the Delaware General Corporation Law, or (iv) for any transaction
from which the director derived an improper personal benefit.
 
     Article Eleventh of the Registrant's Charter provides that, to the fullest
extent permitted by the Delaware General Corporation Law as the same exists or
as it may hereafter be amended, no director of the Registrant shall be
personally liable to the Registrant or its stockholders for monetary damages for
breach of fiduciary duty as a director.
 
     Section 6.1 of the Registrant's Bylaws further provides that the Registrant
shall, to the maximum extent and in the manner permitted by the General
Corporation Law of Delaware, indemnify each of its directors and officers
against expenses (including attorneys' fees), judgments, fines, settlements, and
other amounts actually and reasonably incurred in connection with any
proceeding, arising by reason of the fact that such person is or was an agent of
the registrant.
 
     Prior to the consummation of this offering, the Company will enter into
indemnification agreements with each of its directors and executive officers
that provide for indemnification and expense advancement to the fullest extent
permitted under the Delaware General Corporation Law.
 
   
     The Registrant intends to purchase officers' and directors' liability
insurance.
    
 
   
     The Company has agreed to indemnify certain directors and officers against
certain liabilities, including liabilities under the Securities Act, pursuant to
Section 7 of the Amended and Restated Rights Agreement.
    
 
ITEM 15.  RECENT SALES OF UNREGISTERED SECURITIES
 
   
     Within the last three years, the Registrant has sold the following
securities or engaged in the following transactions in private placements exempt
from registration under the Securities Act pursuant to Section 4(2) thereof:
    
 
          (1) On September 6, 1995, Internet Security Systems, Inc. ("Oldco")
     sold 1,293,475 shares of its Common Stock, par value $1.00 per share
     ("Oldco Common Stock") to Kevin J. O'Connor for $50,000.
 
          (2) On December 29, 1995, Oldco issued 1,959,770 shares of Oldco
     Common Stock to Thomas E. Noonan and 162,890 shares of Oldco Common Stock
     to Glenn McGonnigle in consideration for their employment with Oldco.
 
   
          (3) On February 2 and 21, 1996, Oldco sold an aggregate of 3,650,000
     shares of its Series A Preferred Stock, par value $1.00 per share, for an
     aggregate of $3,650,000 to Greylock Equity Limited Partnership, Sigma
     Associates III, L.P., Sigma Investors III, L.P., Sigma Partners III, L.P.
     and John P. Imlay, Jr., which shares are automatically convertible into an
     aggregate of 3,650,000 shares of Common Stock upon closing of the Offering.
     Also in connection with the sale of Oldco's Series A
    
                                      II-2
<PAGE>   87
 
   
     Preferred Stock, Oldco repurchased 100,000 shares of Oldco Common Stock
     from Christopher W. Klaus for $15,000.
    
 
   
          (4) On February 14, 1997, Oldco sold an aggregate of 2,086,957 shares
     of its Series B Preferred Stock, par value $1.00 per share, for an
     aggregate of $5,280,001 to Greylock Equity Limited Partnership, Sigma
     Associates III, L.P., Sigma Investors III, L.P., Sigma Partners III, L.P.,
     John P. Imlay, Jr., Kleiner Perkins Caufield & Byers VIII, KPCB Information
     Sciences Zaibatsu Fund II, KPCB Java Fund, AT&T Venture Fund II, L.P. and
     Venture Fund I, L.P., which shares are automatically convertible into
     2,086,457 Shares of Common Stock upon closing of this Offering.
    
 
   
          (5) On July 26, 1997, Oldco issued an aggregate of 12,500 shares of
     Common Stock to an executive recruiter in partial consideration for
     services rendered.
    
 
   
          (6) In December 1997, the Registrant, Oldco and the shareholders of
     Oldco entered into an exchange agreement whereby (i) each share of Oldco
     Common Stock was exchanged for one share of the Company's Common Stock,
     (ii) each share of Oldco's Series A Preferred Stock was exchanged for one
     share of the Company's Series A Preferred Stock and (iii) each share of
     Oldco's Series B Preferred Stock was exchanged for one share of the
     Company's Series B Preferred Stock.
    
 
   
          (7) On February 24, 1998, the Company issued an aggregate of 1,000
     shares of Common Stock to an executive recruiter in partial consideration
     for services rendered.
    
 
   
          (8) In this period, holders of options issued under the 1995 Plan
     exercised options to purchase 31,500 shares of Common Stock for $4,725.
    
 
   
          (9) The Company has from time to time granted stock options to
     employees. The following table sets forth certain information regarding
     such grants:
    
 
   
<TABLE>
<CAPTION>
                                                     NUMBER        RANGE OF
                                                    OF SHARES   EXERCISE PRICES
                                                    ---------   ---------------
<S>                                                 <C>         <C>
April 19, 1994 (inception) through December 31,
  1995............................................         --     $        --
January 1, 1996 through December 31, 1996.........    810,350       0.15-0.60
January 1, 1997 through December 31, 1997.........  1,023,000       0.60-7.00
</TABLE>
    
 
     The above securities were offered and sold by the Registrant in reliance
upon exemptions for registration pursuant to either (i) Section 4(2) of the
Securities Act, as transactions not involving any public offering, or (ii) Rule
701 under the Securities Act. No underwriters were involved in connections with
the sales of securities referred to in this Item 15.
 
ITEM 16.  EXHIBITS AND FINANCIAL STATEMENT SCHEDULES
 
     (a) Exhibits:
 
   
<TABLE>
<C>    <C>  <S>
 1.1    --  Form of Underwriting Agreement.
 3.1*   --  Certificate of Incorporation.
 3.2*   --  Bylaws.
 4.1    --  Specimen Common Stock certificate.
 4.2    --  See Exhibits 3.1 and 3.2 for provisions of the Certificate
            of Incorporation and Bylaws of the Registrant defining the
            rights of holders of Common Stock of the Registrant.
 5.1    --  Opinion of Brobeck, Phleger & Harrison LLP.
10.1*   --  Restated 1995 Stock Incentive Plan.
10.2*   --  Directed Shares Agreements.
10.3*   --  Internet Security Systems, Inc. Amended and Restated Rights
            Agreement.
10.4    --  Stock Exchange Agreement dated December 9, 1997.
10.5    --  Amended and Restated Agreement Regarding Acceleration of
            Vesting of Future Optionees.
</TABLE>
    
 
                                      II-3
<PAGE>   88
   
<TABLE>
<C>    <C>  <S>
10.6    --  Forms of Non-Employee Director Compensation Agreement,
            Notice of Stock Option Grant and Stock Option Agreement.
10.7    --  Sublease for Atlanta facilities.
10.8    --  Form of Indemnification Agreement for directors and certain
            officers.
10.9    --  Series B Preferred Stock Purchase Agreement.
10.10   --  Amended and Restated Right of First Refusal and Co-Sale
            Agreement.
21.1    --  Subsidiaries of Registrant.
23.1    --  Consent of Ernst & Young LLP.
23.2    --  Consent of Brobeck, Phleger & Harrison LLP (included in the
            opinion filed as Exhibit 5.1).
24.1*   --  Power of attorney pursuant to which amendments to this
            registration statement may be filed (included on the
            signature page in Part II hereof).
27.1*   --  Financial Data Schedule (for SEC use only).
</TABLE>
    
 
- ---------------
 
   
* Filed with the Company's Registration Statement on January 20, 1998
    
 
     (b) Financial Statement Schedules
 
     The following financial statement schedule of the Company is included in
Part II of the Registration Statement:
 
          Report of Ernst & Young LLP, Independent Auditors
 
          Schedule II -- Valuation and Qualifying Accounts
 
     Except for the financial statement schedule listed above, the financial
statement schedules for which provision is made in the applicable accounting
regulations of the Commission are either not required under the related
instructions or are inapplicable and have therefore been omitted.
 
ITEM 17.  UNDERTAKINGS
 
     The registrant hereby undertakes to provide to the Underwriters at the
closing specified in the Underwriting Agreement certificates in such
denominations and registered in such names as required by the Underwriters to
permit prompt delivery to each purchaser.
 
     Insofar as indemnification for liabilities arising under the Securities Act
may be permitted to directors, officers and controlling persons of the
Registrant pursuant to the Delaware General Corporation Law, the Charter or the
Bylaws of the registrant, the Underwriting Agreement, or otherwise, the
registrant has been advised that in the opinion of the Securities and Exchange
Commission such indemnification is against public policy as expressed in the
Securities Act, and is, therefore, unenforceable. In the event that a claim for
indemnification against such liabilities (other than the payment by the
registrant of expenses incurred or paid by a director, officer, or controlling
person of the registrant in the successful defense of any action, suit or
proceeding) is asserted by such director, officer or controlling person in
connection with the securities being registered hereunder, the registrant will,
unless in the opinion of its counsel the matter has been settled by controlling
precedent, submit to a court of appropriate jurisdiction the question of whether
such indemnification by it is against public policy as expressed in the
Securities Act and will be governed by the final adjudication of such issue.
 
     The undersigned registrant hereby undertakes that:
 
          (1) For purposes of determining any liability under the Securities
     Act, the information omitted from the form of Prospectus filed as part of
     this Registration Statement in reliance upon Rule 430A and contained in a
     form of Prospectus filed by the registrant pursuant to Rule 424(b)(1) or
     (4) or 497(h) under the Securities Act shall be deemed to be part of this
     Registration Statement as of the time it was declared effective.
 
          (2) For the purpose of determining any liability under the Securities
     Act, each post-effective amendment that contains a form of Prospectus shall
     be deemed to be a new Registration Statement relating to the securities
     offered therein, and the offering of such securities at that time shall be
     deemed to be the initial bona fide offering thereof.
 
                                      II-4
<PAGE>   89
 
                                   SIGNATURES
 
   
     PURSUANT TO THE REQUIREMENTS OF THE SECURITIES ACT OF 1933, AS AMENDED, THE
REGISTRANT HAS DULY CAUSED THIS REGISTRATION STATEMENT TO BE SIGNED ON ITS
BEHALF BY THE UNDERSIGNED, THEREUNTO DULY AUTHORIZED, IN THE CITY OF ATLANTA,
STATE OF GEORGIA, ON THIS 2ND DAY OF MARCH, 1998.
    
 
                                          ISS GROUP, INC.
 
   
                                          By:     /s/ RICHARD MACCHIA
    
                                            ------------------------------------
   
                                                      Richard Macchia
    
   
                                             Vice President and Chief Financial
                                                           Officer
    
 
   
     PURSUANT TO THE REQUIREMENTS OF THE SECURITIES ACT OF 1933, AS AMENDED,
THIS REGISTRATION STATEMENT HAS BEEN SIGNED BY THE FOLLOWING PERSONS IN THE
CAPACITIES AND ON THE DATE INDICATED:
    
 
   
<TABLE>
<CAPTION>
                        NAME                                       TITLE                     DATE
                        ----                                       -----                     ----
<C>                                                    <S>                               <C>
                          *                            Chairman, President and Chief     March 2, 1998
- -----------------------------------------------------    Executive (Principal
                  Thomas E. Noonan                       Executive Officer)
 
                          *                            Chief Technical Officer,          March 2, 1998
- -----------------------------------------------------    Secretary and Director
                Christopher W. Klaus
 
                 /s/ RICHARD MACCHIA                   Vice President and Chief          March 2, 1998
- -----------------------------------------------------    Financial Officer (Principal
                   Richard Macchia                       Financial and Accounting
                                                         Officer)
 
                          *                            Director                          March 2, 1998
- -----------------------------------------------------
                  Richard S. Bodman
 
                          *                            Director                          March 2, 1998
- -----------------------------------------------------
                  Robert E. Davoli
 
                          *                            Director                          March 2, 1998
- -----------------------------------------------------
                  Kevin J. O'Connor
 
                          *                            Director                          March 2, 1998
- -----------------------------------------------------
                   David N. Strohm
 
                * /s/ RICHARD MACCHIA
 ---------------------------------------------------
                   Richard Macchia
                  Attorney-in-Fact
</TABLE>
    
 
                                      II-5
<PAGE>   90
 
                         REPORT OF INDEPENDENT AUDITORS
 
     We have audited the consolidated financial statements of ISS Group, Inc. as
of December 31, 1996 and 1997, and for each of the three years in the period
ended December 31, 1997, and have issued our report thereon dated January 13,
1998 (included elsewhere in this Registration Statement). Our audits also
included the financial statement schedule listed in Item 16(b) of this
Registration Statement. This schedule is the responsibility of the Company's
management. Our responsibility is to express an opinion based on our audits.
 
     In our opinion, the financial statement schedule referred to above, when
considered in relation to the basic financial statements taken as a whole,
presents fairly in all material respects the information set forth therein.
 
                                          /s/ ERNST & YOUNG LLP
 
Atlanta, Georgia
January 13, 1998
 
                                       S-1
<PAGE>   91
 
SCHEDULE II -- VALUATION AND QUALIFYING ACCOUNTS
 
<TABLE>
<CAPTION>
                                            BALANCE AT                                  BALANCE AT
                                         BEGINNING OF YEAR    PROVISION    WRITEOFFS    END OF YEAR
                                         -----------------    ---------    ---------    -----------
<S>                                      <C>                  <C>          <C>          <C>
1995
Allowance for Doubtful Accounts........       $    --         $     --     $     --      $     --
                                              =======         ========     ========      ========
1996
Allowance for Doubtful Accounts........       $    --         $ 86,000     $ (7,000)     $ 79,000
                                              =======         ========     ========      ========
1997
Allowance for Doubtful Accounts........       $79,000         $195,000     $(19,000)     $255,000
                                              =======         ========     ========      ========
</TABLE>
 
                                       S-2

<PAGE>   1
                                                                     EXHIBIT 1.1




                                 ISS GROUP, INC.
                                  Common Stock
                          (par value $0.001 per share)

                             Underwriting Agreement

                                                                          , 1998

Goldman, Sachs & Co.,
BancAmerica Robertson Stephens
UBS Securities, LLC
Wessels, Arnold & Henderson, L.L.C.
         As representatives of the several Underwriters
         named in Schedule I hereto,
c/o Goldman, Sachs & Co.
85 Broad Street
New York, New York 10004

Ladies and Gentlemen:

         ISS Group, Inc., a Delaware corporation (the "Company"), proposes,
subject to the terms and conditions stated herein, to issue and sell to the
Underwriters named in Schedule I hereto (the "Underwriters") an aggregate of
 ........ shares and, at the election of the Underwriters, up to ........
additional shares of Common Stock (par value $0.001 per share) ("Stock") of the
Company and the stockholders of the Company named in Schedule II hereto (the
"Selling Stockholders") propose, subject to the terms and conditions stated
herein, to sell to the Underwriters an aggregate of ........ shares and, at the
election of the Underwriters, up to....... additional shares of Stock . The
aggregate of ......... shares to be sold by the Company and the Selling
Stockholders is herein called the "Firm Shares" and the aggregate of .........
additional shares to be sold by the Company and the Selling Stockholders is
herein called the "Optional Shares." The Firm Shares and the Optional Shares
that the Underwriters elect to purchase pursuant to Section 2 hereof are herein
collectively called the "Shares."

    1.   (a) The Company and Internet Security Systems, Inc., a Georgia 
corporation and the Company's wholly-owned subsidiary ("ISS"), jointly and
severally represent and warrant to, and agree with, each of the Underwriters
that:

           (i)    A registration statement on Form S-1 (File No. 333-44529) (the
         "Initial Registration Statement") in respect of the Shares has been
         filed with the Securities and Exchange Commission (the "Commission");
         the Initial Registration Statement and any post effective amendment
         thereto, each in the form heretofore delivered to you, and, excluding
         exhibits thereto, to you for each of the other Underwriters, have been
         declared effective by the Commission in such form; other than a
         registration statement, if any, increasing the size of the offering (a
         "Rule 462(b) Registration Statement"), filed pursuant
<PAGE>   2
         to Rule 462(b) under the Securities Act of 1933, as amended (the
         "Act"), which became effective upon filing, no other document with
         respect to the Initial Registration Statement has heretofore been filed
         with the Commission; no stop order suspending the effectiveness of the
         Initial Registration Statement, any post-effective amendment thereto or
         the Rule 462(b) Registration Statement, if any, has been issued and no
         proceeding for that purpose has been initiated or threatened by the
         Commission (any preliminary prospectus included in the Initial
         Registration Statement or filed with the Commission pursuant to Rule
         424(a) of the rules and regulations of the Commission under the Act, is
         hereinafter called a "Preliminary Prospectus"; the various parts of the
         Initial Registration Statement, including all exhibits thereto and
         including the information contained in the form of final prospectus
         filed with the Commission pursuant to Rule 424(b) under the Act in
         accordance with Section 5(a) hereof and deemed by virtue of Rule 430A
         under the Act to be part of the Initial Registration Statement at the
         time it was declared effective or such parts of the Rule 462(b)
         Registration Statement, if any, became or hereafter becomes effective,
         each as amended at the time such part of the registration statement
         became effective, is hereinafter collectively called the "Registration
         Statement"; and such final prospectus, in the form first filed pursuant
         to Rule 424(b) under the Act, is hereinafter called the "Prospectus";

           (ii)   No order preventing or suspending the use of any Preliminary
         Prospectus has been issued by the Commission, and each Preliminary
         Prospectus, at the time of filing thereof, conformed in all material
         respects to the requirements of the Act and the rules and regulations
         of the Commission thereunder, and did not contain an untrue statement
         of a material fact or omit to state a material fact required to be
         stated therein or necessary to make the statements therein, in the
         light of the circumstances under which they were made, not misleading;
         provided, however, that this representation and warranty shall not
         apply to any statements or omissions made in reliance upon and in
         conformity with information furnished in writing to the Company by an
         Underwriter through Goldman, Sachs & Co. expressly for use therein or
         by a Selling Stockholder expressly for use in the preparation of the
         answers therein to Items 7 and 11(1) of Form S-1;

           (iii)  The Registration Statement conforms, and the Prospectus and 
         any further amendments or supplements to the Registration Statement or
         the Prospectus will conform, in all material respects to the
         requirements of the Act and the rules and regulations of the Commission
         thereunder and do not and will not, as of the applicable effective date
         as to the Registration Statement and any amendment thereto, and as of
         the applicable filing date as to the Prospectus and any amendment or
         supplement thereto, contain an untrue statement of a material fact or
         omit to state a material fact required to be stated therein or
         necessary to make the statements therein not misleading; provided,
         however, that this representation and warranty shall not apply to any
         statements or omissions made in reliance upon and in conformity with
         information furnished in writing to the Company by an Underwriter
         through Goldman, Sachs & Co. expressly for use therein or by a Selling
         Stockholder expressly for use in the preparation of the answers therein
         to Items 7 and 11(l) of Form S-1;

           (iv)   Neither the Company nor any of its subsidiaries has sustained
         since the date of the latest audited financial statements included in
         the Prospectus any material loss or 


                                      -2-
<PAGE>   3
         interference with its business from fire, explosion, flood or other
         calamity, whether or not covered by insurance, or from any labor
         dispute or court or governmental action, order or decree, otherwise
         than as set forth or contemplated in the Prospectus; and, since the
         respective dates as of which information is given in the Registration
         Statement and the Prospectus, there has not been any change in the
         capital stock (other than pursuant to the grant or exercise of options
         described in the Prospectus) or long-term debt of the Company or any of
         its subsidiaries or any material adverse change, or any development
         that is reasonably likely to result in a material adverse change, in or
         affecting the general affairs, management, financial position,
         stockholders' equity or results of operations of the Company and its
         subsidiaries, otherwise than as set forth or contemplated in the
         Prospectus;

           (v)    The Company and its subsidiaries have good and marketable 
         title in fee simple to all real property and good and marketable title
         to all personal property owned by them, in each case free and clear of
         all liens, encumbrances and defects except such as are described in the
         Prospectus or such as are not material to the Company and its
         subsidiaries; and any real property and buildings held under lease by
         the Company and its subsidiaries are held by them under valid,
         subsisting and enforceable leases with such exceptions as are not
         material to the Company and its subsidiaries;

           (vi)   The Company has been duly incorporated and is validly existing
         as a corporation in good standing under the laws of the State of
         Delaware, with power and authority (corporate and other) to own its
         properties and conduct its business as described in the Prospectus, and
         has been duly qualified as a foreign corporation for the transaction of
         business and is in good standing under the laws of each other
         jurisdiction in which it owns or leases properties or conducts any
         business so as to require such qualification, or is subject to no
         material liability or disability by reason of the failure to be so
         qualified in any such jurisdiction; and each subsidiary of the Company
         has been duly incorporated and is validly existing as a corporation in
         good standing under the laws of its jurisdiction of incorporation;

           (vii)  The Company has an authorized capitalization as set forth in
         the Prospectus, and all of the issued shares of capital stock of the
         Company have been duly and validly authorized and issued, are fully
         paid and non-assessable and conform to the description of the Stock
         contained in the Prospectus; and all of the issued shares of capital
         stock of each subsidiary of the Company have been duly and validly
         authorized and issued, are fully paid and non-assessable and (except
         for directors' qualifying shares) are owned directly or indirectly by
         the Company, free and clear of all liens, encumbrances, equities or
         claims;

           (viii) The unissued Shares to be issued and sold by the Company to
         the Underwriters hereunder have been duly and validly authorized and,
         when issued and delivered against payment therefor as provided herein,
         will be duly and validly issued and fully paid and non-assessable and
         will conform to the description of the Stock contained in the
         Prospectus;

           (ix)   The issue and sale of the Shares to be sold by the Company and
         the compliance by the Company with all of the provisions of this
         Agreement and the consummation of the transactions herein contemplated
         will not conflict with or result in 


                                      -3-
<PAGE>   4
         a breach or violation of any of the terms or provisions of, or
         constitute a default under, any indenture, mortgage, deed of trust,
         loan agreement or other agreement or instrument to which the Company or
         any of its subsidiaries is a party or by which the Company or any of
         its subsidiaries is bound or to which any of the property or assets of
         the Company or any of its subsidiaries is subject, other than breaches
         or defaults that are not, individually or in the aggregate, reasonably
         likely to have a material adverse effect on the Company and its
         subsidiaries considered as one enterprise, nor will such action result
         in any violation of the provisions of the Certificate of Incorporation
         or By-laws of the Company or any statute or any order, rule or
         regulation of any court or governmental agency or body having
         jurisdiction over the Company or any of its subsidiaries or any of
         their properties; and no consent, approval, authorization, order,
         registration or qualification of or with any such court or governmental
         agency or body is required for the issue and sale of the Shares or the
         consummation by the Company of the transactions contemplated by this
         Agreement, except the registration under the Act of the Shares and such
         consents, approvals, authorizations, registrations or qualifications as
         may be required under state securities or Blue Sky laws in connection
         with the purchase and distribution of the Shares by the Underwriters;

           (x)    Neither the Company nor any of its subsidiaries is in 
         violation of its Certificate of Incorporation or By-laws or in default
         in the performance or observance of any material obligation, agreement,
         covenant or condition contained in any indenture, mortgage, deed of
         trust, loan agreement, lease or other agreement or instrument to which
         it is a party or by which it or any of its properties may be bound;

           (xi)   The statements set forth in the Prospectus under the caption
         "Description of Capital Stock", insofar as they purport to constitute a
         summary of the terms of the Stock and under the caption "Underwriting",
         insofar as they purport to describe the provisions of the laws and
         documents referred to therein, are accurate, complete and fair;

           (xii)  Other than as set forth in the Prospectus, there are no legal
         or governmental proceedings pending to which the Company or any of its
         subsidiaries is a party or of which any property of the Company or any
         of its subsidiaries is the subject which, if determined adversely to
         the Company or any of its subsidiaries, would individually or in the
         aggregate have a material adverse effect on the current or future
         consolidated financial position, stockholders' equity or results of
         operations of the Company and its subsidiaries; and, to the Company's
         knowledge, no such proceedings are threatened or contemplated by
         governmental authorities or threatened by others;

           (xiii) Other than as set forth in the Prospectus, the Company and its
         subsidiaries own or have the right to use pursuant to license,
         sublicense, agreement, or permission all patents, patent applications,
         trademarks, service marks, trade names, copyrights, trade secrets,
         confidential information, proprietary rights and processes
         ("Intellectual Property") necessary for the operation of the business
         of the Company and its subsidiaries as presently conducted and as
         presently proposed to be conducted as described in the Prospectus and
         have taken all steps reasonably necessary to secure interests in such
         Intellectual Property from its employees and contractors; none of the
         technology employed by the Company or its subsidiaries has been
         obtained or is being used by the Company or its subsidiaries in
         violation of any contractual or fiduciary obligation binding 


                                      -4-
<PAGE>   5
         on the Company, its subsidiaries or any of their respective directors
         or executive officers or, to the Company's knowledge, any of their
         respective employees or consultants; and the Company and its
         subsidiaries have taken and will maintain reasonable measures to
         prevent the unauthorized dissemination or publication of its
         confidential information. 

         To the Company's knowledge, neither the Company nor any of its
         subsidiaries have interfered with, infringed upon, misappropriated, or
         otherwise come into conflict with any Intellectual Property rights of
         third parties, and there has never been any charge, complaint, claim,
         demand, or notice alleging any such interference, infringement,
         misappropriation, or violation (including any claim that the Company or
         any of its subsidiaries must license or refrain from using any
         intellectual property rights of any third party) which, if the subject
         of any unfavorable decision, ruling or finding would, individually or
         in the aggregate, have a material adverse effect on the current or
         future consolidated financial position, stockholders' equity or results
         of operations of the Company and its subsidiaries;

           (xiv)  The Company is not and, after giving effect to the offering 
         and sale of the Shares, will not be an "investment company" or an
         entity "controlled" by an "investment company", as such terms are
         defined in the Investment Company Act of 1940, as amended (the
         "Investment Company Act");

           (xv)   Neither the Company nor any of its affiliates does business 
         with the government of Cuba or with any person or affiliate located in
         Cuba within the meaning of Section 517.075, Florida Statutes; and

           (xvi)  To the Company's knowledge, Ernst & Young LLP, who have
         certified certain financial statements of the Company and its
         subsidiaries, are independent public accountants as required by the Act
         and the rules and regulations of the Commission thereunder.

           (b) Each of the Selling Stockholders severally represents and
warrants to, and agrees with, each of the Underwriters and the Company that:

           (i)    All consents, approvals, authorizations and orders necessary 
         for the execution and delivery by such Selling Stockholder of this
         Agreement and the Power of Attorney and the Custody Agreement
         hereinafter referred to, and for the sale and delivery of the Shares to
         be sold by such Selling Stockholder hereunder, have been obtained; and
         such Selling Stockholder has full right, power and authority to enter
         into this Agreement, the Power of Attorney and the Custody Agreement
         and to sell, assign, transfer and deliver the Shares to be sold by such
         Selling Stockholder hereunder;

           (ii)   The sale of the Shares to be sold by such Selling Stockholder
         hereunder and the compliance by such Selling Stockholder with all of
         the provisions of this Agreement, the Power of Attorney and the Custody
         Agreement and the consummation of the transactions herein and therein
         contemplated will not conflict with or result in a breach or violation
         of any of the terms or provisions of, or constitute a default under,
         any statute, indenture, mortgage, deed of trust, loan agreement or
         other agreement or instrument to which such Selling Stockholder is a
         party or by which such Selling Stockholder is bound or to which any of
         the property or assets of such Selling Stockholder is subject, nor will
         such action result in any violation of the provisions of any statute or
         any order, rule or 


                                      -5-
<PAGE>   6
         regulation of any court or governmental agency or body having
         jurisdiction over such Selling Stockholder or the property of such
         Selling Stockholder;

           (iii)  Such Selling Stockholder has, and immediately prior to each
         Time of Delivery (as defined in Section 4 hereof) such Selling
         Stockholder will have, good and valid title to the Shares to be sold by
         such Selling Stockholder hereunder, free and clear of all liens,
         encumbrances, equities or claims; and, upon delivery of such Shares and
         payment therefor pursuant hereto, good and valid title to such Shares,
         free and clear of all liens, encumbrances, equities or claims, will
         pass to the several Underwriters;

           (iv)   During the period beginning from the date hereof and 
         continuing to and including the date 180 days after the date of the
         Prospectus, such Selling Stockholder will not, without your prior
         written consent (A) offer, sell contract to sell or otherwise dispose
         of, except as provided hereunder, any securities of the Company that
         are substantially similar to the Shares, including but not limited to
         any securities that are convertible into or exchangeable for, or that
         represent the right to receive, Stock or any such substantially similar
         securities (other than pursuant to employee stock option plans existing
         on, or upon the conversion or exchange of convertible or exchangeable
         securities outstanding as of, the date of this Agreement) or (B) engage
         directly or indirectly in any transaction the likely result of which
         would involve a transaction prohibited by subclause (A) of this clause
         (iv); provided, that notwithstanding the foregoing, (x) if such Selling
         Stockholder is an individual, he or she may transfer shares of Stock
         either during his or her lifetime or on death by gift, will or
         intestacy to his or her immediate family or to a trust the
         beneficiaries of which are exclusively such Selling Stockholder and/or
         members of his or her immediate family; and (y) if such Selling
         Stockholder is a trust, the trust may transfer shares of Stock to any
         beneficiary of such trust as of the date of this Agreement or to the
         estate of any such beneficiary, and any beneficiary who is an
         individual may transfer any such shares of Stock by gift, will or
         intestacy to his or her members of his or her immediate family,
         provided, however, that in any such described in clauses (x) and/or
         (y), it shall be a condition to the transfer that the transferee
         execute an agreement stating that the transferee is receiving and
         holding the shares of Stock so transferred subject to the provisions of
         this Section (1)(b)(iv), and there shall be no further transfer of such
         shares of Stock except in accordance with the provisions of this
         Section 1(b)(b)(iv), and that for the purposes of the foregoing,
         "immediate family" shall mean spouse, lineal descendant, father,
         mother, brother or sister of the transferor;

           (v)    Such Selling Stockholder has not taken and will not take,
         directly or indirectly, any action which is designed to or which has
         constituted or which might reasonably be expected to cause or result in
         stabilization or manipulation of the price of any security of the
         Company to facilitate the sale or resale of the Shares;

           (vi)   To the extent that any statements or omissions made in the
         Registration Statement, any Preliminary Prospectus, the Prospectus or
         any amendment or supplement thereto are made in reliance upon and in
         conformity with written information furnished to the Company by such
         Selling Stockholder expressly for use therein, such Preliminary
         Prospectus and the Registration Statement did, and the Prospectus and
         any further amendments or supplements to the Registration Statement and
         the Prospectus, 


                                      -6-
<PAGE>   7
         when they become effective or are filed with the Commission, as the
         case may be, will conform in all material respects to the requirements
         of the Act and the rules and regulations of the Commission thereunder
         and will not contain any untrue statement of a material fact or omit to
         state any material fact required to be stated therein or necessary to
         make the statements therein not misleading

           (vii)  In order to document the Underwriters' compliance with the
         reporting and withholding provisions of the Tax Equity and Fiscal
         Responsibility Act of 1982 with respect to the transactions herein
         contemplated, such Selling Stockholder will deliver to you prior to or
         at the First Time of Delivery (as hereinafter defined) a properly
         completed and executed United States Treasury Department Form W-9 (or
         other applicable form or statement specified by Treasury Department
         regulations in lieu thereof);

           (viii) Certificates in negotiable form representing all of the Shares
         to be sold by such Selling Stockholder hereunder have been placed in
         custody under a Custody Agreement, in the form heretofore furnished to
         you (the "Custody Agreement"), duly executed and delivered by such
         Selling Stockholder to [Name of Custodian], as custodian (the
         "Custodian"), and such Selling Stockholder has duly executed and
         delivered a Power of Attorney, in the form heretofore furnished to you
         (the "Power of Attorney"), appointing the persons indicated in Schedule
         II hereto, and each of them, as such Selling Stockholder's
         attorneys-in-fact (the "Attorneys-in-Fact") with authority to execute
         and deliver this Agreement on behalf of such Selling Stockholder, to
         determine the purchase price to be paid by the Underwriters to the
         Selling Stockholders as provided in Section 2 hereof, to authorize the
         delivery of the Shares to be sold by such Selling Stockholder hereunder
         and otherwise to act on behalf of such Selling Stockholder in
         connection with the transactions contemplated by this Agreement and the
         Custody Agreement; and

           (ix)   The Shares represented by the certificates held in custody for
         such Selling Stockholder under the Custody Agreement, as a result of
         the obligations of such Selling Stockholder under this Agreement, are
         subject to the interests of the Underwriters hereunder; the
         arrangements made by such Selling Stockholder for such custody, and the
         appointment by such Selling Stockholder of the Attorneys-in-Fact by the
         Power of Attorney, are to that extent irrevocable; the obligations of
         the Selling Stockholders hereunder shall not be terminated by operation
         of law, whether by the death or incapacity of any individual Selling
         Stockholder or, in the case of an estate or trust, by the death or
         incapacity of any executor or trustee or the termination of such estate
         or trust, or in the case of a partnership or corporation, by the
         dissolution of such partnership or corporation, or by the occurrence of
         any other event; if any individual Selling Stockholder or any such
         executor or trustee should die or become incapacitated, or if any such
         estate or trust should be terminated, or if any such partnership or
         corporation should be dissolved, or if any other such event should
         occur, before the delivery of the Shares hereunder, certificates
         representing the Shares shall be delivered by or on behalf of the
         Selling Stockholders in accordance with the terms and conditions of
         this Agreement and of the Custody Agreements; and actions taken by the
         Attorneys-in-Fact pursuant to the Powers of Attorney shall be as valid
         as if such death, incapacity, termination, dissolution or other event
         had not occurred, regardless of whether or not the Custodian, the
         Attorneys-in-Fact, or any of them, shall have received notice of such
         death, incapacity, termination, dissolution or other event.


                                      -7-
<PAGE>   8
    2.   Subject to the terms and conditions herein set forth, (a) the Company 
and each of the Selling Stockholders agree, severally and not jointly, to sell
to each of the Underwriters, and each of the Underwriters agrees, severally and
not jointly, to purchase from the Company and each of the Selling Stockholders,
at a purchase price per share of $................, the number of Firm Shares
(to be adjusted by you so as to eliminate fractional shares) determined by
multiplying the aggregate number of Firm Shares to be sold by the Company and
each of the Selling Stockholders as set forth opposite their respective names in
Schedule II hereto by a fraction, the numerator of which is the aggregate number
of Firm Shares to be purchased by such Underwriter as set forth opposite the
name of such Underwriter in Schedule I hereto and the denominator of which is
the aggregate number of Firm Shares to be purchased by all of the Underwriters
from the Company and all of the Selling Stockholders hereunder and (b) in the
event and to the extent that the Underwriters shall exercise the election to
purchase Optional Shares as provided below, the Company agrees to issue and sell
and each of the Selling Stockholders agrees to sell to each of the Underwriters,
and each of the Underwriters agrees, severally and not jointly, to purchase from
the Company and each of the Selling Stockholders, at the purchase price per
share set forth in clause (a) of this Section 2, that portion of the number of
Optional Shares as to which such election shall have been exercised (to be
adjusted by you so as to eliminate fractional shares) determined by multiplying
such number of Optional Shares by a fraction, the numerator of which is the
maximum number of Optional Shares which such Underwriter is entitled to purchase
as set forth opposite the name of such Underwriter in Schedule I hereto and the
denominator of which is the maximum number of Optional Shares that all of the
Underwriters are entitled to purchase hereunder.

         The Company and the Selling Stockholders, as and to the extent
indicated in Schedule II hereto, hereby grant, severally and not jointly, to the
Underwriters the right to purchase at their election up to ...................
Optional Shares, at the purchase price per share set forth in the paragraph
above, for the sole purpose of covering overallotments in the sale of the Firm
Shares. Any such election to purchase Optional Shares shall be made in
proportion to the maximum number of Optional Shares to be sold by the Company
and each Selling Stockholder as set forth in Schedule II hereto initially with
respect to the Optional Shares to be sold by the Company and then among the
Selling Stockholders in proportion to the maximum number of Optional Shares to
be sold by each Selling Stockholder as set forth in Schedule II hereto. Any such
election to purchase Optional Shares may be exercised only by written notice
from you to the Company and the Attorneys-in-Fact, given within a period of 30
calendar days after the date of this Agreement and setting forth the aggregate
number of Optional Shares to be purchased and the date on which such Optional
Shares are to be delivered, as determined by you but in no event earlier than
the First Time of Delivery (as defined in Section 4 hereof) or, unless you and
the Company and the Attorneys-in-Fact otherwise agree in writing, earlier than
two or later than ten business days after the date of such notice.

    3.   Upon the authorization by you of the release of the Firm Shares, the 
several Underwriters propose to offer the Firm Shares for sale upon the terms
and conditions set forth in the Prospectus.

    4.   (a) The Shares to be purchased by each Underwriter hereunder, in
definitive form, and in such authorized denominations and registered in such
names as Goldman, Sachs & Co. may request upon at least forty-eight hours' prior
notice to the Company and the Selling Stockholders shall be delivered by or on
behalf of the Company and the Selling Stockholders to Goldman, Sachs & Co.,
through the facilities of the Depository Trust Company ("DTC"), for the account
of such Underwriter, against payment by or on behalf of such Underwriter of the
purchase price therefor by wire transfer to an account designated by the Company
and each Selling Stockholder in Federal (same day) funds. 


                                      -8-
<PAGE>   9
The Company and each Selling Stockholder will cause the certificates
representing the Shares to be made available for checking and packaging at least
twenty-four hours prior to the Time of Delivery (as defined below) with respect
thereto at the office of DTC or its designated custodian (the "Designated
Office"). The time and date of such delivery and payment shall be, with respect
to the Firm Shares, 9:30 a.m., New York City time, on _______ __, 1998 or such
other time and date as Goldman, Sachs & Co., the Company may agree upon in
writing, and, with respect to the Optional Shares, 9:30 a.m., New York time, on
the date specified by Goldman, Sachs & Co. in the written notice given by
Goldman, Sachs & Co. of the Underwriters' election to purchase such Optional
Shares, or such other time and date as Goldman, Sachs & Co., the Company and the
Selling Stockholders may agree upon in writing. Such time and date for delivery
of the Firm Shares is herein called the "First Time of Delivery", such time and
date for delivery of the Optional Shares, if not the First Time of Delivery, is
herein called the "Second Time of Delivery", and each such time and date for
delivery is herein called a "Time of Delivery".

         (b) The documents to be delivered at each Time of Delivery by or on
behalf of the parties hereto pursuant to Section 7 hereof, including the cross
receipt for the Shares and any additional documents requested by the
Underwriters pursuant to Section 7(i) hereof, will be delivered at the offices
of Ropes & Gray at 885 Third Avenue, New York, New York 10022 (the "Closing
Location"), and the Shares will be delivered at the Designated Office, all at
such Time of Delivery. A meeting will be held at the Closing Location at
 .......p.m., New York City time, on the New York Business Day next preceding
such Time of Delivery, at which meeting the final drafts of the documents to be
delivered pursuant to the preceding sentence will be available for review by the
parties hereto. For the purposes of this Section 4, "New York Business Day"
shall mean each Monday, Tuesday, Wednesday, Thursday and Friday which is not a
day on which banking institutions in New York are generally authorized or
obligated by law or executive order to close.

    5.   The Company and ISS jointly and severally agree with each of the
Underwriters:

         (a) To prepare the Prospectus in a form approved by you and to file
such Prospectus pursuant to Rule 424(b) under the Act not later than the
Commission's close of business on the second business day following the
execution and delivery of this Agreement, or, if applicable, such earlier time
as may be required by Rule 430A(a)(3) under the Act; to make no further
amendment or any supplement to the Registration Statement or Prospectus which
shall be disapproved by you promptly after reasonable notice thereof; to advise
you, promptly after it receives notice thereof, of the time when any amendment
to the Registration Statement has been filed or becomes effective or any
supplement to the Prospectus or any amended Prospectus has been filed and to
furnish you with copies thereof; to advise you, promptly after it receives
notice thereof, of the issuance by the Commission of any stop order or of any
order preventing or suspending the use of any Preliminary Prospectus or
prospectus, of the suspension of the qualification of the Shares for offering or
sale in any jurisdiction, of the initiation or threatening of any proceeding for
any such purpose, or of any request by the Commission for the amending or
supplementing of the Registration Statement or Prospectus or for additional
information; and, in the event of the issuance of any stop order or of any order
preventing or suspending the use of any Preliminary Prospectus or prospectus or
suspending any such qualification, promptly to use its best efforts to obtain
the withdrawal of such order;

         (b) Promptly from time to time to take such action as you may
reasonably request to qualify the Shares for offering and sale under the
securities laws of such jurisdictions as you may request and to comply with such
laws so as to permit the continuance of sales and dealings therein 


                                      -9-
<PAGE>   10
in such jurisdictions for as long as may be necessary to complete the
distribution of the Shares, provided that in connection therewith the Company
shall not be required to qualify as a foreign corporation or to file a general
consent to service of process in any jurisdiction;

         (c) Prior to 10:00 a.m., New York City time on the New York Business
Day next succeeding the date of this Agreement and from time to time, to furnish
the Underwriters with copies of the Prospectus in New York City in such
quantities as you may reasonably request, and, if the delivery of a prospectus
is required at any time prior to the expiration of nine months after the time of
issue of the Prospectus in connection with the offering or sale of the Shares
and if at such time any event shall have occurred as a result of which the
Prospectus as then amended or supplemented would include an untrue statement of
a material fact or omit to state any material fact necessary in order to make
the statements therein, in the light of the circumstances under which they were
made when such Prospectus is delivered, not misleading, or, if for any other
reason it shall be necessary during such period to amend or supplement the
Prospectus in order to comply with the Act, to notify you and upon your request
to prepare and furnish without charge to each Underwriter and to any dealer in
securities as many copies as you may from time to time reasonably request of an
amended Prospectus or a supplement to the Prospectus which will correct such
statement or omission or effect such compliance, and in case any Underwriter is
required to deliver a prospectus in connection with sales of any of the Shares
at any time nine months or more after the time of issue of the Prospectus, upon
your request but at the expense of such Underwriter, to prepare and deliver to
such Underwriter as many copies as you may request of an amended or supplemented
Prospectus complying with Section 10(a)(3) of the Act;

         (d) To make generally available to the Company's securityholders as
soon as practicable, but in any event not later than eighteen months after the
effective date of the Registration Statement (as defined in Rule 158(c) under
the Act), an earnings statement of the Company and its subsidiaries (which need
not be audited) complying with Section 11(a) of the Act and the rules and
regulations thereunder (including, at the option of the Company, Rule 158);

         (e) During the period beginning from the date hereof and continuing to
and including the date 180 days after the date of the Prospectus, not to (i)
offer, sell, contract to sell or otherwise dispose of, except as provided
hereunder any securities of the Company that are substantially similar to the
Shares, including but not limited to any securities that are convertible into or
exchangeable for, or that represent the right to receive, Stock or any such
substantially similar securities (other than pursuant to employee stock option
plans existing on, or upon the conversion or exchange of convertible or
exchangeable securities outstanding as of, the date of this Agreement) or (ii)
engage directly or indirectly in any transaction the likely result of which
would involve a transaction prohibited by clause (i) of this section 5(e),
without your prior written consent;

         (f) To furnish to the Company's stockholders as soon as practicable
after the end of each fiscal year an annual report (including a balance sheet
and statements of income, stockholders' equity and cash flows of the Company and
its consolidated subsidiaries certified by independent public accountants);

         (g) During a period of five years from the effective date of the
Registration Statement, to furnish to you copies of all reports or other
communications (financial or other) furnished to the Company's stockholders, and
to deliver to you (i) as soon as they are available, copies of any reports and
financial statements furnished to or filed with the Commission or any national
securities exchange on which any class of securities of the Company is listed;
and (ii) such additional information 


                                      -10-
<PAGE>   11
concerning the business and financial condition of the Company as you may from
time to time reasonably request (such financial statements to be on a
consolidated basis to the extent the accounts of the Company and its
subsidiaries are consolidated in reports furnished to its stockholders generally
or to the Commission);

         (h) To use the net proceeds received by the Company from the sale of
the Shares pursuant to this Agreement in the manner specified in the Prospectus
under the caption "Use of Proceeds";

         (i) To use its best efforts to list for quotation the Shares on the
National Association of Securities Dealers Automated Quotations National Market
System ("NASDAQ");

         (j) To file with the Commission such information on Form 10-Q as may be
required by Rule 463 under the Act; and

         (k) If the Company elects to rely upon Rule 462(b), the Company shall
file a Rule 462(b) Registration Statement with the Commission in compliance with
Rule 462(b) by 10:00 P.M., Washington, D.C. time, on the date of this Agreement,
and the Company shall at the time of filing either pay to the Commission the
filing fee for the Rule 462(b) Registration Statement or give irrevocable
instructions for the payments of such fee pursuant to Rule 111(b) under the Act.

    6.   The Company and each of the Selling Stockholders covenant and agree 
with one another and with the several Underwriters that (a) the Company will pay
or cause to be paid the following: (i) the fees, disbursements and expenses of
the Company's counsel and accountants in connection with the registration of the
Shares under the Act and all other expenses in connection with the preparation,
printing and filing of the Registration Statement, any Preliminary Prospectus
and the Prospectus and amendments and supplements thereto and the mailing and
delivering of copies thereof to the Underwriters and dealers; (ii) the cost of
printing or producing any Agreement among Underwriters, this Agreement, the Blue
Sky Memorandum, closing documents (including any compilations thereof) and any
other documents in connection with the offering, purchase, sale and delivery of
the Shares; (iii) all expenses in connection with the qualification of the
Shares for offering and sale under state securities laws as provided in Section
5(b) hereof, including the fees and disbursements of counsel for the
Underwriters in connection with such qualification and in connection with the
Blue Sky survey (iv) all fees and expenses in connection with listing the Shares
on the NASDAQ; (iv) the filing fees incident to, and up to $5,000 of the fees
and disbursements of counsel for the Underwriters in connection with, securing
any required review by the National Association of Securities Dealers, Inc. of
the terms of the sale of the Shares; (v) the cost of preparing stock
certificates; (vi) the costs and charges of any transfer agent or registrar; and
(vii) all other costs and expenses incident to the performance of its
obligations hereunder which are not otherwise specifically provided for in this
Section; and (b) such Selling Stockholder will pay or cause to be paid all costs
and expenses incident to the performance of such Selling Stockholder's
obligations hereunder which are not otherwise specifically provided for in this
Section, including (i) any fees and expenses of counsel for such Selling
Stockholder, (ii) the Selling Stockholder's pro rata share of fees and expenses
of the Attorneys-in-Fact and the Custodian, and (iii) all expenses and taxes
incident to the sale and delivery of the Shares to be sold by such Selling
Stockholders to the Underwriters hereunder. In connection with clause (b) (iii)
of the preceding sentence, Goldman, Sachs & Co. agrees to pay New York State
stock transfer tax, and the Selling Stockholders agree to reimburse Goldman,
Sachs & Co. for associated carrying costs if such tax payment is not rebated on
the day of payment and for any portion of such tax payment not rebated. It is
understood, however, that the Company shall bear, and the Selling Stockholders
shall 


                                      -11-
<PAGE>   12
not be required to pay or to reimburse the Company for, the cost of any other
matters not directly relating to the sale and purchase of the Shares pursuant to
this Agreement, and that, except as provided in this Section, and Sections 8 and
11 hereof, the Underwriters will pay all of their own costs and expenses,
including the fees of their counsel, stock transfer taxes on resale of any of
the Shares by them, and any advertising expenses connected with any offers they
may make.

    7.   The obligations of the Underwriters hereunder, as to the Shares to be
delivered at each Time of Delivery, shall be subject, in their discretion, to
the condition that all representations and warranties and other statements of
the Company and of the Selling Stockholders herein are, at and as of such Time
of Delivery, true and correct, the condition that the Company and the Selling
Stockholders shall have performed all of its and their obligations hereunder
theretofore to be performed, and the following additional conditions:

         (a) The Prospectus shall have been filed with the Commission pursuant
to Rule 424(b) within the applicable time period prescribed for such filing by
the rules and regulations under the Act and in accordance with Section 5(a)
hereof; if the Company has elected to rely upon Rule 462(b), the Rule 462(b)
Registration Statement shall have become effective by 10:00 p.m., Washington,
D.C. time, on the date of this Agreement; no stop order suspending the
effectiveness of the Registration Statement or any part thereof shall have been
issued and no proceeding for that purpose shall have been initiated or
threatened by the Commission; and all requests for additional information on the
part of the Commission shall have been complied with to your reasonable
satisfaction;

         (b) Ropes & Gray, counsel for the Underwriters, shall have furnished to
you such opinion or opinions (a draft of such opinion is attached as Annex II(a)
hereto), dated such Time of Delivery, with respect to the matters covered in
paragraphs (i), (ii), (vi), (x) and (xiii) of subsection (c) below as well as
such other related matters as you may reasonably request, and such counsel shall
have received such papers and information as they may reasonably request to
enable them to pass upon such matters;

         (c) Brobeck, Phleger & Harrison LLP, counsel for the Company, shall
have furnished to you their written opinion (a draft of such opinion is attached
as Annex II(B) hereto), dated such Time of Delivery, in form and substance
satisfactory to you, to the effect that:

           (i)    The Company has been duly incorporated and is validly existing
         as a corporation in good standing under the laws of the State of
         Delaware, with power and authority (corporate and other) to own its
         properties and conduct its business as described in the Registration
         Statement and Prospectus;

           (ii)   The Company has an authorized capitalization as set forth in 
         the Prospectus, and all of the issued shares of capital stock of the
         Company (including the Shares being delivered at such Time of Delivery)
         have been duly and validly authorized and issued and are fully paid and
         non-assessable; and the Shares conform in all material respects to the
         description of the Stock contained in the Registration Statement and
         Prospectus;

           (iii)  The Company has been duly qualified as a foreign corporation
         for the transaction of business and is in good standing under the laws
         of the State of Georgia and each other jurisdiction in which it owns or
         leases properties or to our knowledge conducts any business so as to
         require such qualification, except where 


                                      -12-
<PAGE>   13
         the failure to be so qualified or in good standing would not have a
         material adverse effect on the Company and its subsidiaries considered
         as one enterprise, or is subject to no material liability or disability
         by reason of failure to be so qualified in any such jurisdiction (such
         counsel being entitled to rely in respect of the opinion in this clause
         upon opinions of local counsel and in respect of matters of fact upon
         certificates of officers of the Company, provided that such counsel
         shall state that they believe that both you and they are justified in
         relying upon such opinions and certificates);

           (iv)   Each subsidiary of the Company has been duly incorporated and
         is validly existing as a corporation in good standing under the laws of
         its jurisdiction of incorporation; and all of the issued shares of
         capital stock of each such subsidiary have been duly and validly
         authorized and issued, are fully paid and non-assessable, and (except
         for directors' qualifying shares and except as otherwise set forth in
         the Prospectus) are owned directly or indirectly by the Company, free
         and clear of all liens, encumbrances, equities or claims (such counsel
         being entitled to rely in respect of the opinion in this clause upon
         opinions of local counsel and in respect to matters of fact upon
         certificates of officers of the Company or its subsidiaries, provided
         that such counsel shall state that they believe that both you and they
         are justified in relying upon such opinions and certificates);

           (v)    To such counsel's knowledge and other than as set forth in the
         Prospectus, there are no legal or governmental proceedings pending to
         which the Company or any of its subsidiaries is a party or of which any
         property of the Company or any of its subsidiaries is the subject that
         is required to be described in the Registration Statement or Prospectus
         and is not so described and, to such counsel's knowledge, no such
         proceedings are threatened or contemplated by governmental authorities
         or threatened by others;

           (vi)   This Agreement has been duly authorized, executed and 
         delivered by the Company;

           (vii)  The issue and sale of the Shares being delivered at such Time
         of Delivery to be sold by the Company and the compliance by the Company
         with all of the provisions of this Agreement and the consummation of
         the transactions herein contemplated will not conflict with or result
         in a breach or violation of any of the terms or provisions of, or
         constitute a default under, any indenture, mortgage, deed of trust,
         loan agreement or other agreement or instrument which is filed as an
         exhibit to, or referred to, in the Registration Statement (in giving
         the opinion in this clause counsel may attach to such opinion a list of
         the foregoing agreements and instruments), nor will such action result
         in any violation of the provisions of the Certificate of Incorporation
         or By-laws of the Company or any statute or any order, rule or
         regulation known to such counsel of any court or governmental agency or
         body having jurisdiction over the Company or any of its subsidiaries or
         any of their properties (other than the clearance of the underwriting
         arrangements with the NASD, Blue Sky or state securities laws matters
         in connection with the purchase and distribution of the Shares by the
         Underwriters);

           (viii) No consent, approval, authorization, order, registration or
         qualification of or 


                                      -13-
<PAGE>   14
         with any such court or governmental agency or body is required for the
         issue and sale of the Shares or the consummation by the Company of the
         transactions contemplated by this Agreement, except the registration
         under the Act of the Shares, and such consents, approvals,
         authorizations, registrations or qualifications as may be required
         under state securities or Blue Sky laws in connection with the purchase
         and distribution of the Shares by the Underwriters (as to which counsel
         need express no opinion);

           (ix)   Neither the Company nor any of its subsidiaries is in 
         violation of its Certificate of Incorporation or By-laws or in default
         in the performance or observance of any material obligation, agreement,
         covenant or condition contained in any indenture, mortgage, deed of
         trust, loan agreement, lease or other agreement or instrument which is
         filed as an exhibit to, or referred to, in the Registration Statement
         (in giving the opinion in this clause counsel may attach to such
         opinion a list of the foregoing agreements and instruments);

           (x)    The statements set forth in the Prospectus under the caption
         "Description of Capital Stock", insofar as they purport to constitute a
         summary of the terms of the Stock, and under the caption
         "Underwriting", insofar as they purport to describe the provisions of
         the laws and documents referred to therein, are accurate, complete and
         fair;

           (xi)   The Company is not an "investment company" or required to be
         registered as an investment company under the Investment Company Act; ;

           (xii)  No holders of outstanding options under the 1995 Restated 
         Stock Incentive Plan (the "Plan") have the right to acquire any shares
         of capital stock of Internet Security Systems, Inc., a wholly-owned
         subsidiary of the Company, as a result of the assumption by the Company
         of the outstanding options issued pursuant to the Plan and all other
         obligations under the Plan in connection with the transactions
         contemplated by the [Stock Exchange Agreement]. In addition, the
         Company has consummated the assumption of such options and obligations
         in accordance with all of the terms and conditions of the Plan, and the
         Company has obtained all required consents, approvals and
         authorizations for such assumption;and

           (xiii) The Registration Statement and the Prospectus and any further
         amendments and supplements thereto made by the Company prior to such
         Time of Delivery (other than the financial statements and related
         schedules therein, as to which such counsel need express no opinion),
         when filed and at the time the Registration Statement was declared
         effective, complied as to form in all material respects with the
         requirements of the Act and the rules and regulations thereunder;
         although they do not assume any responsibility for the accuracy,
         completeness or fairness of the statements contained in the
         Registration Statement or the Prospectus, except for those referred to
         in the opinion in subsection (x) of this section 7(c), they have no
         reason to believe that, as of its effective date, the Registration
         Statement or any further amendment thereto made by the Company prior to
         such Time of Delivery (other than the financial statements and related
         schedules therein, as to which such counsel need express no opinion)
         contained an untrue statement of a material fact or omitted to state a
         material fact required to be stated therein or necessary to make 


                                      -14-
<PAGE>   15
         the statements therein not misleading or that, as of its date, the
         Prospectus or any further amendment or supplement thereto made by the
         Company prior such Time of Delivery (other than the financial
         statements and related schedules therein, as to which such counsel need
         express no opinion) contained an untrue statement of a material fact or
         omitted to state a material fact necessary to make the statements
         therein, in the light of the circumstances under which they were made,
         not misleading or that, as of such Time of Delivery, either the
         Registration Statement or the Prospectus or any further amendment or
         supplement thereto made by the Company prior to such Time of Delivery
         (other than the financial statements and related schedules therein, as
         to which such counsel need express no opinion) contains an untrue
         statement of a material fact or omits to state a material fact
         necessary to make the statements therein, in the light of the
         circumstances under which they were made, not misleading; and they do
         not know of any amendment to the Registration Statement required to be
         filed or of any contracts or other documents of a character required to
         be filed as an exhibit to the Registration Statement or required to be
         described in the Registration Statement or the Prospectus which are not
         filed or described as required;

    (d)           Each of King & Spaulding and Nagashimi & Nohno, counsel to the
    Company, shall have furnished to you their written opinion, dated such time
    of delivery, in form and substance satisfactory to you, with respect to the
    matters set forth in clauses (iv), (v), and (ix) of the foregoing paragraph
    (c), relating to Internet Security Systems, Inc., a Georgia corporation and
    ISS Japan, KK; 

    (e)           The respective counsel for each of the Selling Stockholders,
    as indicated in Schedule II hereto, each shall have furnished to you their
    written opinion with respect to each of the Selling Stockholders for whom
    they are acting as counsel, dated such Time of Delivery, in form and
    substance satisfactory to you, to the effect that:

      (i)         A Power-of-Attorney and a Custody Agreement have been duly 
    executed and delivered by such Selling Stockholder and constitute valid and
    binding agreements of such Selling Stockholder in accordance with their
    terms;

      (ii)        This Agreement has been duly executed and delivered by or on 
    behalf of such Selling Stockholder; and the sale of the Shares to be sold by
    such Selling Stockholder hereunder and the compliance by such Selling
    Stockholder with all of the provisions of this Agreement, the
    Power-of-Attorney and the Custody Agreement and the consummation of the
    transactions herein and therein contemplated will not conflict with or
    result in a breach or violation of any terms or provisions of, or constitute
    a default under, any statute, indenture, mortgage, deed of trust, loan
    agreement or other agreement or instrument known to such counsel to which
    such Selling Stockholder is a party or by which such Selling Stockholder is
    bound or to which any of the property or assets of such Selling Stockholder
    is subject, nor will such action result in any violation of the provisions
    of any order, rule or regulation known to such counsel of any court or
    governmental agency or body having jurisdiction over such Selling
    Stockholder or the property of such Selling Stockholder;

      (iii)       No consent, approval, authorization or order of any court or
    governmental agency or body is required for the consummation of the
    transactions contemplated by this 


                                      -15-
<PAGE>   16
    Agreement in connection with the Shares to be sold by such Selling
    Stockholder hereunder, except such as have been obtained under the Act and
    such as may be required under state securities or Blue Sky laws in
    connection with the purchase and distribution of such Shares by the
    Underwriters;

      (iv)        Immediately prior to Time of Delivery, such Selling 
    Stockholder had good and valid title to the Shares to be sold at Time of
    Delivery by such Selling Stockholder under this Agreement, free and clear of
    all liens, encumbrances, equities or claims, and full right, power and
    authority to sell, assign, transfer and deliver the Shares to be sold by
    such Selling Stockholder hereunder; and

      (v)         Assuming that the Underwriters purchase the Shares to be sold
    by each Selling Stockholder for value, in good faith and without notice of
    any adverse claim within the meaning of the Uniform Commercial Code, upon
    delivery and payment for the Shares to be sold by each Selling Stockholder,
    the Underwriters will receive valid title to such Shares, free and clear of
    all liens, encumbrances, equities or claims.

    In rendering the opinion in paragraph (iv), such counsel may rely upon a
certificate of such Selling Stockholder in respect of matters of fact as to
ownership of, and liens, encumbrances, equities or claims on, the Shares sold by
such Selling Stockholder, provided that such counsel shall state that they
believe that both you and they are justified in relying upon such certificate
and that an original of such certificate is delivered to you;

         (f) On the date of the Prospectus at a time prior to the execution of
this Agreement, at 9:30 a.m., New York City time, on the effective date of any
post-effective amendment to the Registration Statement filed subsequent to the
date of this Agreement and also at each Time of Delivery, Ernst & Young LLP
shall have furnished to you a letter or letters, dated the respective dates of
delivery thereof, in form and substance satisfactory to you, to the effect set
forth in Annex I hereto;

         (g)(i) Neither the Company nor any of its subsidiaries shall have
sustained since the date of the latest audited financial statements included in
the Prospectus any loss or interference with its business from fire, explosion,
flood or other calamity, whether or not covered by insurance, or from any labor
dispute or court or governmental action, order or decree, otherwise than as set
forth or contemplated in the Prospectus, and (ii) since the respective dates as
of which information is given in the Prospectus there shall not have been any
change in the capital stock or long-term debt of the Company or any of its
subsidiaries or any change, or any development involving a prospective change,
in or affecting the general affairs, management, financial position,
stockholders' equity or results of operations of the Company and its
subsidiaries, otherwise than as set forth or contemplated in the Prospectus, the
effect of which, in any such case described in Clause (i) or (ii), is in the
judgment of the Representatives so material and adverse as to make it
impracticable or inadvisable to proceed with the public offering or the delivery
of the Shares being delivered at such Time of Delivery on the terms and in the
manner contemplated in the Prospectus;

            (h) On or after the date hereof (i) no downgrading shall have 
occurred in the rating, if any, accorded the Company's debt securities by any
"nationally recognized statistical rating organization", as that term is defined
by the Commission for purposes of Rule 436(g)(2) under the Act, and (ii) no such
organization shall have publicly announced that it has under surveillance or
review, with possible negative implications, its rating of any of the Company's
debt securities;

         (i) On or after the date hereof there shall not have occurred any of
the following: (i) a 


                                      -16-
<PAGE>   17
suspension or material limitation in trading in securities generally on the New
York Stock Exchange or on NASDAQ; (ii) a suspension or material limitation in
trading in the Company's securities on NASDAQ; (iii) a general moratorium on
commercial banking activities declared by either Federal or New York State
authorities; or (iv) the outbreak or escalation of hostilities involving the
United States or the declaration by the United States of a national emergency or
war, if the effect of any such event specified in this Clause (iv) in the
judgment of the Representatives makes it impracticable or inadvisable to proceed
with the public offering or the delivery of the Shares being delivered at such
Time of Delivery on the terms and in the manner contemplated in the Prospectus;

         (j) The Shares to be sold at such Time of Delivery shall have been duly
listed for quotation on NASDAQ;

         (k) The Company has obtained and delivered to the Underwriters executed
copies of an agreement from [list appropriate stockholders of the Company],
substantially to the effect set forth in Subsection 1(b) (iv) hereof in form and
substance satisfactory to you; and

            (l) The Company and the Selling Stockholders shall have furnished or
caused to be furnished to you at such Time of Delivery certificates of officers
of the Company and of the Selling Stockholders, respectively, satisfactory to
you as to the accuracy of the representations and warranties of the Company and
of the Selling Stockholders, respectively, herein at and as of such Time of
Delivery, as to the performance by the Company and the Selling Stockholders of
all of their respective obligations hereunder to be performed at or prior to
such Time of Delivery, and as to such other matters as you may reasonably
request, and the Company shall have furnished or caused to be furnished
certificates as to the matters set forth in subsections (a) and (f) of this
Section.

    8.  (a) The Company and ISS, jointly and severally, will indemnify and hold
harmless each Underwriter against any losses, claims, damages or liabilities,
joint or several, to which such Underwriter may become subject, under the Act or
otherwise, insofar as such losses, claims, damages or liabilities (or actions in
respect thereof) arise out of or are based upon an untrue statement or alleged
untrue statement of a material fact contained in any Preliminary Prospectus, the
Registration Statement or the Prospectus, or any amendment or supplement
thereto, or arise out of or are based upon the omission or alleged omission to
state therein a material fact required to be stated therein or necessary to make
the statements therein not misleading, and will reimburse each Underwriter for
any legal or other expenses reasonably incurred by such Underwriter in
connection with investigating or defending any such action or claim as such
expenses are incurred; provided, however, that the Company and ISS shall not be
liable in any such case to the extent that any such loss, claim, damage or
liability arises out of or is based upon an untrue statement or alleged untrue
statement or omission or alleged omission made in any Preliminary Prospectus,
the Registration Statement or the Prospectus or any such amendment or supplement
in reliance upon and in conformity with written information furnished to the
Company by any Underwriter through Goldman, Sachs & Co. expressly for use
therein.

        (b) Each of the Selling Stockholders will indemnify and hold harmless
each Underwriter against any losses, claims, damages or liabilities, joint or
several, to which such Underwriter may become subject, under the Act or
otherwise, insofar as such losses, claims, damages or liabilities (or actions in
respect thereof) arise out of or are based upon an untrue statement or alleged
untrue statement of a material fact contained in any Preliminary Prospectus, the
Registration Statement or the Prospectus, or any amendment or supplement
thereto, or arise out of or are based upon the omission or alleged omission to
state therein a material fact required to be stated therein or 


                                      -17-
<PAGE>   18
necessary to make the statements therein not misleading, and will reimburse each
Underwriter for any legal or other expenses reasonably incurred by such
Underwriter in connection with investigating or defending any such action or
claim as such expenses are incurred; provided, however, that such Selling
Stockholder shall not be liable in any such case to the extent that any such
loss, claim, damage or liability arises out of or is based upon an untrue
statement or alleged untrue statement or omission or alleged omission made in
any preliminary Prospectus, the Registration Statement or the Prospectus or any
such amendment or supplement in reliance upon and in conformity with written
information furnished by any Underwriter through Goldman, Sachs & Co. expressly
for use therein; provided, further, that the liability of a Selling Stockholder
pursuant to this subsection (b) shall not exceed the product of the number of
Shares sold by such Selling Stockholder and the initial public offering price of
the Shares as set forth in the Prospectus.

         (c) Each Underwriter will indemnify and hold harmless the Company and
each Selling Stockholder against any losses, claims, damages or liabilities to
which the Company or such Selling Stockholder may become subject, under the Act
or otherwise, insofar as such losses, claims, damages or liabilities (or actions
in respect thereof) arise out of or are based upon an untrue statement or
alleged untrue statement of a material fact contained in any Preliminary
Prospectus, the Registration Statement or the Prospectus, or any amendment or
supplement thereto, or arise out of or are based upon the omission or alleged
omission to state therein a material fact required to be stated therein or
necessary to make the statements therein not misleading, in each case to the
extent, but only to the extent, that such untrue statement or alleged untrue
statement or omission or alleged omission was made in any Preliminary
Prospectus, the Registration Statement or the Prospectus or any such amendment
or supplement in reliance upon and in conformity with written information
furnished to the Company by such Underwriter through Goldman, Sachs & Co.
expressly for use therein; and will reimburse the Company and each Selling
Stockholder for any legal or other expenses reasonably incurred by the Company
or such Selling Stockholder in connection with investigating or defending any
such action or claim as such expenses are incurred.

         (d) Promptly after receipt by an indemnified party under subsection
(a), (b) or (c) above of notice of the commencement of any action, such
indemnified party shall, if a claim in respect thereof is to be made against the
indemnifying party under such subsection, notify the indemnifying party in
writing of the commencement thereof; but the omission so to notify the
indemnifying party shall not relieve it from any liability which it may have to
any indemnified party otherwise than under such subsection. In case any such
action shall be brought against any indemnified party and it shall notify the
indemnifying party of the commencement thereof, the indemnifying party shall be
entitled to participate therein and, to the extent that it shall wish, jointly
with any other indemnifying party similarly notified, to assume the defense
thereof, with counsel satisfactory to such indemnified party (who shall not,
except with the consent of the indemnified party, be counsel to the indemnifying
party), and, after notice from the indemnifying party to such indemnified party
of its election so to assume the defense thereof, the indemnifying party shall
not be liable to such indemnified party under such subsection for any legal
expenses of other counsel or any other expenses, in each case subsequently
incurred by such indemnified party, in connection with the defense thereof other
than reasonable costs of investigation. No indemnifying party shall, without the
written consent of the indemnified party, effect the settlement or compromise
of, or consent to the entry of any judgment with respect to, any pending or
threatened action or claim in respect of which indemnification or contribution
may be sought hereunder (whether or not the indemnified party is an actual or
potential party to such action or claim) unless such settlement, compromise or
judgment (i) includes an unconditional release of the 


                                      -18-
<PAGE>   19
indemnified party from all liability arising out of such action or claim and
(ii) does not include a statement as to or an admission of fault, culpability or
a failure to act, by or on behalf of any indemnified party.

         (e) If the indemnification provided for in this Section 8 is
unavailable to or insufficient to hold harmless an indemnified party under
subsection (a), (b) or (c) above in respect of any losses, claims, damages or
liabilities (or actions in respect thereof) referred to therein, then each
indemnifying party shall contribute to the amount paid or payable by such
indemnified party as a result of such losses, claims, damages or liabilities (or
actions in respect thereof) in such proportion as is appropriate to reflect the
relative benefits received by the Company and the Selling Stockholders on the
one hand and the Underwriters on the other from the offering of the Shares. If,
however, the allocation provided by the immediately preceding sentence is not
permitted by applicable law or if the indemnified party failed to give the
notice required under subsection (d) above, then each indemnifying party shall
contribute to such amount paid or payable by such indemnified party in such
proportion as is appropriate to reflect not only such relative benefits but also
the relative fault of the Company and the Selling Stockholders on the one hand
and the Underwriters on the other in connection with the statements or omissions
which resulted in such losses, claims, damages or liabilities (or actions in
respect thereof), as well as any other relevant equitable considerations. The
relative benefits received by the Company and the Selling Stockholders on the
one hand and the Underwriters on the other shall be deemed to be in the same
proportion as the total net proceeds from the offering (before deducting
expenses) received by the Company and the Selling Stockholders bear to the total
underwriting discounts and commissions received by the Underwriters, in each
case as set forth in the table on the cover page of the Prospectus. The relative
fault shall be determined by reference to, among other things, whether the
untrue or alleged untrue statement of a material fact or the omission or alleged
omission to state a material fact relates to information supplied by the Company
or the Selling Stockholders on the one hand or the Underwriters on the other and
the parties' relative intent, knowledge, access to information and opportunity
to correct or prevent such statement or omission. The Company, each of the
Selling Stockholders and the Underwriters agree that it would not be just and
equitable if contributions pursuant to this subsection (e) were determined by
pro rata allocation (even if the Underwriters were treated as one entity for
such purpose) or by any other method of allocation which does not take account
of the equitable considerations referred to above in this subsection (e). The
amount paid or payable by an indemnified party as a result of the losses,
claims, damages or liabilities (or actions in respect thereof) referred to above
in this subsection (e) shall be deemed to include any legal or other expenses
reasonably incurred by such indemnified party in connection with investigating
or defending any such action or claim. Notwithstanding the provisions of this
subsection (e), no Underwriter shall be required to contribute any amount in
excess of the amount by which the total price at which the Shares underwritten
by it and distributed to the public were offered to the public exceeds the
amount of any damages which such Underwriter has otherwise been required to pay
by reason of such untrue or alleged untrue statement or omission or alleged
omission. No person guilty of fraudulent misrepresentation (within the meaning
of Section 11(f) of the Act) shall be entitled to contribution from any person
who was not guilty of such fraudulent misrepresentation. The Underwriters'
obligations in this subsection (e) to contribute are several in proportion to
their respective underwriting obligations and not joint.

         (f) The obligations of the Company, ISS and the Selling Stockholders
under this Section 8 shall be in addition to any liability which the Company and
the respective Selling Stockholders may otherwise have and shall extend, upon
the same terms and conditions, to each person, if any, who 


                                      -19-
<PAGE>   20
controls any Underwriter within the meaning of the Act; and the obligations of
the Underwriters under this Section 8 shall be in addition to any liability
which the respective Underwriters may otherwise have and shall extend, upon the
same terms and conditions, to each officer and director of the Company
(including any person who, with his or her consent, is named in the Registration
Statement as about to become a director of the Company) and to each person, if
any, who controls the Company within the meaning of the Act.

    9.   (a) If any Underwriter shall default in its obligation to purchase the 
Shares which it has agreed to purchase hereunder at a Time of Delivery, you may
in your discretion arrange for you or another party or other parties to purchase
such Shares on the terms contained herein. If within thirty-six hours after such
default by any Underwriter you do not arrange for the purchase of such Shares,
then the Company and the Selling Stockholders shall be entitled to a further
period of thirty-six hours within which to procure another party or other
parties satisfactory to you to purchase such Shares on such terms. In the event
that, within the respective prescribed periods, you notify the Company and the
Selling Stockholders that you have so arranged for the purchase of such Shares,
or the Company and the Selling Stockholders notify you that they have so
arranged for the purchase of such Shares, you or the Company shall have the
right to postpone such Time of Delivery for a period of not more than seven
days, in order to effect whatever changes may thereby be made necessary in the
Registration Statement or the Prospectus, or in any other documents or
arrangements, and the Company agrees to file promptly any amendments to the
Registration Statement or the Prospectus which in your reasonable opinion may
thereby be made necessary. The term "Underwriter" as used in this Agreement
shall include any person substituted under this Section with like effect as if
such person had originally been a party to this Agreement with respect to such
Shares.

         (b) If, after giving effect to any arrangements for the purchase of the
Shares of a defaulting Underwriter or Underwriters by you and the Company and
the Selling Stockholders as provided in subsection (a) above, the aggregate
number of such Shares which remains unpurchased does not exceed one-eleventh of
the aggregate number of all the Shares to be purchased at such Time of Delivery,
then the Company and the Selling Stockholders shall have the right to require
each non-defaulting Underwriter to purchase the number of Shares which such
Underwriter agreed to purchase hereunder at such Time of Delivery and, in
addition, to require each non-defaulting Underwriter to purchase its pro rata
share (based on the number of Shares which such Underwriter agreed to purchase
hereunder) of the Shares of such defaulting Underwriter or Underwriters for
which such arrangements have not been made; but nothing herein shall relieve a
defaulting Underwriter from liability for its default.

         (c) If, after giving effect to any arrangements for the purchase of the
Shares of a defaulting Underwriter or Underwriters by you and the Company and
the Selling Stockholders as provided in subsection (a) above, the aggregate
number of such Shares which remains unpurchased exceeds one-eleventh of the
aggregate number of all the Shares to be purchased at such Time of Delivery, or
if the Company and the Selling Stockholders shall not exercise the right
described in subsection (b) above to require non-defaulting Underwriters to
purchase Shares of a defaulting Underwriter or Underwriters, then this Agreement
or, with respect to the Second Time of Delivery, the obligations of the
Underwriters to purchase and of the Company and the Selling Stockholders to sell
the Optional Shares, shall thereupon terminate, without liability on the part of
any non-defaulting Underwriter or the Company or the Selling Stockholders,
except for the expenses to be borne by the Company and the Selling Stockholders
and the Underwriters as provided in Section 6 hereof and the 


                                      -20-
<PAGE>   21
indemnity and contribution agreements in Section 8 hereof; but nothing herein
shall relieve a defaulting Underwriter from liability for its default.

    10.  The respective indemnities, agreements, representations, warranties and
other statements of the Company and the Selling Stockholders and the several
Underwriters, as set forth in this Agreement or made by or on behalf of them,
respectively, pursuant to this Agreement, shall remain in full force and effect,
regardless of any investigation (or any statement as to the results thereof)
made by or on behalf of any Underwriter or any controlling person of any
Underwriter, or the Company or the Selling Stockholders, or any officer or
director or controlling person of the Company or any controlling person of any
Selling Stockholder, and shall survive delivery of and payment for the Shares.

    11.  If this Agreement shall be terminated pursuant to Section 9 hereof, 
neither the Company, nor ISS nor the Selling Stockholders shall then be under
any liability to any Underwriter except as provided in Sections 6 and 8 hereof;
but, if for any other reason any Shares are not delivered by or on behalf of the
Company and the Selling Stockholders as provided herein, the Company and each of
the Selling Stockholders pro rata (based on the number of Shares to be sold by
the Company and such Selling Stockholder hereunder) will reimburse the
Underwriters through you for all out-of-pocket expenses approved in writing by
you, including fees and disbursements of counsel, reasonably incurred by the
Underwriters in making preparations for the purchase, sale and delivery of the
Shares not so delivered, but the Company, ISS and the Selling Stockholders shall
then be under no further liability to any Underwriter in respect of the Shares
not so delivered except as provided in Sections 6 and 8 hereof.

    12.  In all dealings hereunder, you shall act on behalf of each of the
Underwriters, and the parties hereto shall be entitled to act and rely upon any
statement, request, notice or agreement on behalf of any Underwriter made or
given by you jointly or by Goldman, Sachs & Co. on behalf of you as the
representatives; and in all dealings with any Selling Stockholder hereunder, you
and the Company shall be entitled to act and rely upon any statement, request,
notice or agreement on behalf of such Selling Stockholder made or given by any
or all of the Attorneys-in-Fact for such Selling Stockholder.

     All statements, requests, notices and agreements hereunder shall be in
writing, and if to the Underwriters shall be delivered or sent by mail, telex or
facsimile transmission to you as the representatives in care of Goldman, Sachs &
Co., 85 Broad Street, New York, New York 10004, Attention: Registration
Department; and if to any Selling Stockholders shall be delivered or sent by
mail, telex or facsimile transmission to counsel for such Selling Stockholder at
its address set forth in Schedule II hereto; and if to the Company shall be
delivered or sent by mail, telex or facsimile transmission to the address of the
Company set forth in the Registration Statement, Attention: Secretary; provided,
however, that any notice to an Underwriter pursuant to Section 8(c) hereof shall
be delivered or sent by mail, telex or facsimile transmission to such
Underwriter at its address set forth in its Underwriters' Questionnaire, or
telex constituting such Questionnaire, which address will be supplied to the
Company by you upon request. Any such statements, requests, notices or
agreements shall take effect upon receipt thereof.

    13.  This Agreement shall be binding upon, and inure solely to the benefit 
of, the Underwriters, the Company and the Selling Stockholders and, to the
extent provided in Sections 8 and 10 hereof, the officers and directors of the
Company and each person who controls the Company, any Selling Stockholder or any
Underwriter, and their respective heirs, executors, administrators, successors
and 


                                      -21-
<PAGE>   22
assigns, and no other person shall acquire or have any right under or by virtue
of this Agreement. No purchaser of any of the Shares from any Underwriter shall
be deemed a successor or assign by reason merely of such purchase.

    14.  Time shall be of the essence of this Agreement. As used herein, the 
term "business day" shall mean any day when the Commission's office in
Washington, D.C. is open for business.

    15.  THIS AGREEMENT SHALL BE GOVERNED BY AND CONSTRUED IN ACCORDANCE WITH 
THE LAWS OF THE STATE OF NEW YORK.

    16.  This Agreement may be executed by any one or more of the parties hereto
in any number of counterparts, each of which shall be deemed to be an original,
but all such counterparts shall together constitute one and the same instrument.

     If the foregoing is in accordance with your understanding, please sign and
return to us eight counterparts hereof, and upon the acceptance hereof by you,
on behalf of each of the Underwriters,








                                      -22-
<PAGE>   23
this letter and such acceptance hereof shall constitute a binding agreement
among each of the Underwriters, the Company and each of the Selling
Stockholders. It is understood that your acceptance of this letter on behalf of
each of the Underwriters is pursuant to the authority set forth in a form of
Agreement among Underwriters, the form of which shall be submitted to the
Company and the Selling Stockholders for examination upon request, but without
warranty on your part as to the authority of the signers thereof.


                                        Very truly yours,

                                        ISS Group, Inc.

                                        By:
                                           -------------------------------------
                                           Name:
                                           Title:

                                        Internet Security Systems, Inc.

                                        By:
                                           -------------------------------------
                                           Name:
                                           Title:

                                        Christopher W. Klaus
                                        Thomas E. Noonan
                                        Kevin J. O'Connor
                                        H. Keith Cooley
                                        Glenn M. McGonnigle


                                        By:
                                           -------------------------------------
                                           Name:
                                           Title:
                                           As Attorney-in-Fact acting on behalf 
                                           of each of the Selling Stockholders 
                                           named in Schedule II to this 
                                           Agreement.

Accepted as of the date hereof:

Goldman, Sachs & Co.
BancAmerica, Robertson, Stephens
UBS Securities, LLC 
Wessels, Arnold & Henderson, L.L.C.


By:
   ------------------------------------
   (Goldman, Sachs & Co.)
   On behalf of each of the Underwriters




                                      -23-
<PAGE>   24




                                   SCHEDULE I

<TABLE>
<CAPTION>
                                                                                NUMBER OF OPTIONAL
                                                                                   SHARES TO BE
                                                           TOTAL NUMBER OF         PURCHASED IF
                                                             FIRM SHARES          MAXIMUM OPTION
                                                           TO BE PURCHASED           EXERCISED
                                                           ---------------        BY UNDERWRITER
                                                                                  --------------
<S>                                                        <C>                    <C>

Goldman, Sachs & Co.

BancAmerica, Robertson, Stephens

UBS Securities, LLC

Wessels, Arnold & Henderson, L.L.C.

[NAMES OF OTHER UNDERWRITERS]


                  Total
</TABLE>








                                      -24-
<PAGE>   25
                                   SCHEDULE II

<TABLE>
<CAPTION>
                                                                                  NUMBER OF OPTIONAL
                                                                                     SHARES TO BE
                                                           TOTAL NUMBER OF              SOLD IF
                                                             FIRM SHARES            MAXIMUM OPTION
                                                              TO BE SOLD               EXERCISED
<S>                                                        <C>                    <C>
The Company..........................................
      The Selling Stockholder(s):
              CHRISTOPHER W. KLAUS(a)
              THOMAS E. NOONAN(b)
              KEVIN J. O'CONNOR(c)
              H. KEITH COOLEY(d)
              GLENN M. MCGONNIGLE(e)

         Total.......................................
</TABLE>

- --------------------

(a) This Selling Stockholder is represented by [NAME AND ADDRESS OF COUNSEL] and
has appointed [NAMES OF ATTORNEYS-IN-FACT (NOT LESS THAN TWO)], and each of
them, as the Attorneys-in-Fact for such Selling Stockholder.

(b) This Selling Stockholder is represented by [NAME AND ADDRESS OF COUNSEL] and
has appointed [NAMES OF ATTORNEYS-IN-FACT (NOT LESS THAN TWO)], and each of
them, as the Attorneys-in-Fact for such Selling Stockholder.

(c) This Selling Stockholder is represented by [NAME AND ADDRESS OF COUNSEL] and
has appointed [NAMES OF ATTORNEYS-IN-FACT (NOT LESS THAN TWO)], and each of
them, as the Attorneys-in-Fact for such Selling Stockholder.

(d) This Selling Stockholder is represented by [NAME AND ADDRESS OF COUNSEL] and
has appointed [NAMES OF ATTORNEYS-IN-FACT (NOT LESS THAN TWO)], and each of
them, as the Attorneys-in-Fact for such Selling Stockholder.

(e) This Selling Stockholder is represented by [NAME AND ADDRESS OF COUNSEL] and
has appointed [NAMES OF ATTORNEYS-IN-FACT (NOT LESS THAN TWO)], and each of
them, as the Attorneys-in-Fact for such Selling Stockholder.








                                      -25-
<PAGE>   26
                                                                         ANNEX I


    Pursuant to Section 7(d) of the Underwriting Agreement, the accountants 
shall furnish letters to the Underwriters to the effect that:

           (i)    They are independent certified public accountants with respect
         to the Company and its subsidiaries within the meaning of the Act and
         the applicable published rules and regulations thereunder;

           (ii)   In their opinion, the financial statements and any 
         supplementary financial information and schedules (and, if applicable,
         financial forecasts and/or pro forma financial information) examined by
         them and included in the Prospectus or the Registration Statement
         comply as to form in all material respects with the applicable
         accounting requirements of the Act and the related published rules and
         regulations thereunder; and, if applicable, they have made a review in
         accordance with standards established by the American Institute of
         Certified Public Accountants of the unaudited consolidated interim
         financial statements, selected financial data, pro forma financial
         information, financial forecasts and/or condensed financial statements
         derived from audited financial statements of the Company for the
         periods specified in such letter, as indicated in their reports
         thereon, copies of which have been furnished to the representatives of
         the Underwriters (the "Representatives" and are attached hereto;

           (iii)  They have made a review in accordance with standards
         established by the American Institute of Certified Public Accountants
         of the unaudited condensed consolidated statements of income,
         consolidated balance sheets and consolidated statements of cash flows
         included in the Prospectus as indicated in their reports thereon copies
         of which are attached hereto and on the basis of specified procedures
         including inquiries of officials of the Company who have responsibility
         for financial and accounting matters regarding whether the unaudited
         condensed consolidated financial statements referred to in paragraph
         (vi)(A)(i) below comply as to form in all material respects with the
         applicable accounting requirements of the Act and the related published
         rules and regulations, nothing came to their attention that caused them
         to believe that the unaudited condensed consolidated financial
         statements do not comply as to form in all material respects with the
         applicable accounting requirements of the Act and the related published
         rules and regulations;

           (iv)   They have compared the information in the Prospectus under
         selected captions with the disclosure requirements of Regulation S-K
         and on the basis of limited procedures specified in such letter nothing
         came to their attention as a result of the foregoing procedures that
         caused them to believe that this information does not conform in all
         material respects with the disclosure requirements of Items 301, 302,
         402 and 503(d), respectively, of Regulation S-K;

           (vi)   On the basis of limited procedures, not constituting an
         examination in accordance with generally accepted auditing standards,
         consisting of a reading of the unaudited financial statements and other
         information referred to below, a reading of the latest available
         interim financial statements of the Company and its subsidiaries,
         inspection of the minute books of the Company and its subsidiaries
         since the date of the latest audited financial statements 

<PAGE>   27
         included in the Prospectus, inquiries of officials of the Company and
         its subsidiaries responsible for financial and accounting matters and
         such other inquiries and procedures as may be specified in such letter,
         nothing came to their attention that caused them to believe that:

                (A) (i) the unaudited consolidated statements of income,
             consolidated balance sheets and consolidated statements of cash
             flows included in the Prospectus do not comply as to form in all
             material respects with the applicable accounting requirements of
             the Act and the related published rules and regulations, or (ii)
             any material modifications should be made to the unaudited
             condensed consolidated statements of income, consolidated balance
             sheets and consolidated statements of cash flows included in the
             Prospectus for them to be in conformity with generally accepted
             accounting principles;

                (B) any other unaudited income statement data and balance sheet
             items included in the Prospectus do not agree with the
             corresponding items in the unaudited consolidated financial
             statements from which such data and items were derived, and any
             such unaudited data and items were not determined on a basis
             substantially consistent with the basis for the corresponding
             amounts in the audited consolidated financial statements included
             in the Prospectus;

                (C) the unaudited financial statements which were not included
             in the Prospectus but from which were derived any unaudited
             condensed financial statements referred to in Clause (A) and any
             unaudited income statement data and balance sheet items included in
             the Prospectus and referred to in Clause (B) were not determined on
             a basis substantially consistent with the basis for the audited
             consolidated financial statements included in the Prospectus;

                (D) any unaudited pro forma consolidated condensed financial
             statements included in the Prospectus do not comply as to form in
             all material respects with the applicable accounting requirements
             of the Act and the published rules and regulations thereunder or
             the pro forma adjustments have not been properly applied to the
             historical amounts in the compilation of those statements;

                (E) as of a specified date not more than five days prior to the
             date of such letter, there have been any changes in the
             consolidated capital stock (other than issuances of capital stock
             upon exercise of options and stock appreciation rights, upon
             earn-outs of performance shares and upon conversions of convertible
             securities, in each case which were outstanding on the date of the
             latest financial statements included in the Prospectus) or any
             increase in the consolidated long-term debt of the Company and its
             subsidiaries, or any decreases in consolidated net current assets
             or stockholders' equity or other items specified by the
             Representatives, or any increases in any items specified by the
             Representatives, in each case as compared with amounts shown in the
             latest balance sheet included in the Prospectus, except in each
             case for changes, increases or decreases which the Prospectus
             discloses have occurred or may occur or which are described in such
             letter; and

                (F) for the period from the date of the latest financial
             statements included in the 
<PAGE>   28
             Prospectus to the specified date referred to in Clause (E) there
             were any decreases in consolidated net revenues or operating profit
             or the total or per share amounts of consolidated net income or
             other items specified by the Representatives, or any increases in
             any items specified by the Representatives, in each case as
             compared with the comparable period of the preceding year and with
             any other period of corresponding length specified by the
             Representatives, except in each case for decreases or increases
             which the Prospectus discloses have occurred or may occur or which
             are described in such letter; and

           (vii)  In addition to the examination referred to in their report(s)
         included in the Prospectus and the limited procedures, inspection of
         minute books, inquiries and other procedures referred to in paragraphs
         (iii) and (vi) above, they have carried out certain specified
         procedures, not constituting an examination in accordance with
         generally accepted auditing standards, with respect to certain amounts,
         percentages and financial information specified by the Representatives,
         which are derived from the general accounting records of the Company
         and its subsidiaries, which appear in the Prospectus, or in Part II of,
         or in exhibits and schedules to, the Registration Statement specified
         by the Representatives, and have compared certain of such amounts,
         percentages and financial information with the accounting records of
         the Company and its subsidiaries and have found them to be in
         agreement.

<PAGE>   1
                                                                     EXHIBIT 4.1


                                  www.ISS.net
                                ISS GROUP, INC.
INCORPORATED UNDER THE LAWS OF THE STATE OF DELAWARE


NUMBER
C -----



      SHARES

   SEE REVERSE FOR
 CERTAIN DEFINITIONS

CUSIP



THIS CERTIFIES THAT


is the owner of


FULLY PAID AND NON-ASSESSABLE SHARES OF THE PAR VALUE OF
       $0.001 EACH OF THE COMMON STOCK OF

- ---------------------------- ISS GROUP, INC. --------------------------------

transferable on the books of the Corporation by the holder hereof in person 
or by duly authorized attorney upon surrender of this certificate properly
endorsed.

      This certificate is not valid unless countersigned and registered by
the Transfer Agent and Registrar.

      WITNESS the facsimile seal of the Corporation and the facsimile
signatures of its duly authorized officers.


Dated:                        [SEAL]


/s/ Thomas E. Noonan                    /s/ Christopher W. Klaus
- --------------------------------        ------------------------
Chairman, Chief Executive Officer       Secretary and 
 and President                          Chief Technical Officer


COUNTERSIGNED AND REGISTERED:

      SUNTRUST BANK, ATLANTA
        (ATLANTA, GEORGIA)  


BY                            TRANSFER AGENT
                               AND REGISTRAR


                          AUTHORIZED OFFICER

      The following abbreviations, when used in the inscription on this
certificate, shall be construed as though they were written out in their
entirety according to applicable laws or regulations:

      TEN COM--as tenants in common             Unif Gift--Uniform
      TEN ENT--as tenants by the entireties       Gifts to Minors 
      JT TEN --as joint tenants with right of          Act
               survivorship and not as tenants
               in common

      Additional abbreviations may also be used though not in the above


For value received, ____________________hereby sell, assign and transfers


PLEASE INSERT SOCIAL SECURITY OR OTHER
   IDENTIFYING NUMBER OF ASSIGNEE

- --------------------------------------

- --------------------------------------


- -------------------------------------------------------------------------
  (PLEASE PRINT OR TYPEWRITE NAME AND ADDRESS, INCLUDING ZIP CODE, OF A

- -------------------------------------------------------------------------

- -------------------------------------------------------------------------

- -------------------------------------------------------------------------
of the capital stock represented by the within Certificate, and do hereby
irrevocably constitute and appoint

- -------------------------------------------------------------------------
to transfer the said stock on the books of the within named Corporation
with full power of substitution in the premises.

Dated _________________

                        
                    ---------------------------------------------------
                    THE SIGNATURE(S) TO THIS ASSIGNMENT MUST CORRESPOND
NOTICE:             WITH THE SIGNATURES AS WRITTEN UPON THE FACE OF THE
                    CERTIFICATE IN EVERY PARTICULAR WITHOUT ALTERATION 
                    OR ENLARGEMENT OR ANY CHANGE WHATEVER.

Signature(s) Guaranteed:



- --------------------------------------------------------------------------
THE SIGNATURE(S) SHOULD BE GUARANTEED BY AN ELIGIBLE GUARANTOR INSTITUTION
(BANKS, STOCKBROKERS, SAVINGS AND LOAN ASSOCIATIONS AND CREDIT UNIONS
MEMBERSHIP IN AN APPROVED SIGNATURE GUARANTEE MEDALLION PROGRAM), PURSUANT
S.E.C. RULE 17Ad-15.

<PAGE>   1
                                                                     Exhibit 5.1




                                  March 2, 1998


ISS Group, Inc.
41 Perimeter Center East
Suite 660
Atlanta, Georgia 30346

         Re:      ISS Group, Inc.
                  Registration Statement on Form S-1 for 3,450,000 Shares
                  of Common Stock (SEC Registration No. 333-44529)

Ladies and Gentlemen:

         We have acted as counsel to ISS Group, Inc., a Delaware corporation
(the "Company"), in connection with the proposed issuance and sale by the
Company of up to 3,070,000 shares of the Company's Common Stock (the "Company
Shares"), which shares include up to 385,000 shares of the Company's Common
Stock that are subject to certain over-allotment options granted by the Company
to the underwriters of the proposed offering, and the sale by certain
stockholders of the Company of 380,000 shares of the Company's Common Stock (the
"Selling Stockholder Shares"), which shares include 65,000 shares of the
Company's Common Stock that are subject to certain over-allotment options
granted by certain of the selling stockholders to the underwriters of the
proposed offering, pursuant to the Company's Registration Statement on Form S-1
(SEC Registration Number 333-44529) filed with the Securities and Exchange
Commission under the Securities Act of 1933, as amended (the "Act").

         This opinion is being furnished in accordance with the requirements of
Item 16(a) for Form S-1 and Item 601(b)(5)(i) of Regulation S-K.

         We have reviewed the Company's charter documents and the corporate
proceedings taken by the Company in connection with (i) the issuance and sale of
the Company Shares and (ii) the sale of the Selling Stockholder Shares. Based
upon such review, we are of the opinion that the Company Shares and the Selling
Stockholder Shares have been duly authorized, the Selling Stockholder Shares are
validly issued, nonassessable and, to our knowledge, fully paid, and the Company
Shares if, as and when issued in accordance with the Registration Statement and
the related prospectus (as amended and supplemented through the date of
issuance) will be validly issued, fully paid and nonassessable.
<PAGE>   2
ISS Group, Inc.                                                    March 2, 1998
                                                                          Page 2




         We consent to the filing of this opinion letter as Exhibit 5.1 to the
Registration Statement and the to reference to this firm under the caption
"Validity of Common Stock" in the prospectus which is a part of the Registration
Statement. In giving this consent, we do not thereby admit that we are within
the category of persons whose consent is required under Section 7 of the Act,
the rules and regulations of the Securities and Exchange Commission promulgated
thereunder, or Item 509 of Regulation S-K.

         This opinion letter is rendered as of the date first written above and
we disclaim any obligation to advise you of facts, circumstances, events or
developments which hereafter may be brought to our attention and which may
alter, affect or modify the opinion expressed herein. Our opinion is expressly
limited to the matters set forth above and we render no opinion, whether by
implication or otherwise, as to any other matters relating to the Company or the
Company Shares or the Selling Stockholder Shares.

                                    Very truly yours,

                                    BROBECK, PHLEGER & HARRISON LLP

<PAGE>   1
                                                                    EXHIBIT 10.4

                            STOCK EXCHANGE AGREEMENT


     THIS STOCK EXCHANGE AGREEMENT (this "Agreement") is made as of this 9th day
of December, 1997 by and among ISS Group, Inc., a Delaware corporation (the
"Company") and Christopher Klaus, Thomas E. Noonan, Kevin O'Connor, Glenn
McGonnigle, Dennis Crow, the Noonan 1997 Family Trust and the Noonan 1997
Annunity Trust (collectively, the "Common Stockholders"), Greylock Equity
Limited Partnership, John P. Imlay, Jr., Sigma Partners III, L.P., Sigma
Associates III, L.P. and Sigma Investors III, L.P., (collectively, the "Series A
Stockholders"), and AT&T Venture Fund II, L.P., Greylock Equity Limited
Partnership, John P. Imlay, Jr., Kleiner Perkins Caufield & Byers VIII, KPCB
Information Sciences Zaibatsu Fund II, KPCB Java Fund, Sigma Associates III,
L.P., Sigma Investors III, L.P., Sigma Partners III, L.P. and Venture Fund I,
L.P., (collectively, the "Series B Stockholders" and together with the Common
Stockholders and the Series A Stockholders, the "Stockholders") and Internet
Security Systems, Inc., a Georgia corporation ("ISS").

     WHEREAS, the Stockholders are owners of an aggregate of 7,914,471 shares of
Common Stock (the "ISS Common Stock"), 3,650,000 shares of Series A Preferred
Stock (the "ISS Series A Preferred Stock") and 2,086,957 shares of Series B
Preferred Stock (the "ISS Series B Preferred Stock") of ISS, which shares
constitute all of the issued and outstanding capital stock of ISS;

     WHEREAS, the Board of Directors of the Company has authorized the Company
to offer the Stockholders the right to exchange their shares of ISS Common
Stock, ISS Series A Preferred Stock and ISS Series B Preferred Stock for the
number of shares of the Common Stock, the Series A Preferred Stock and the
Series B Preferred Stock, respectively, of the Company set forth beside their
respective names on Schedule A attached hereto (the "Exchange Offer"); and

     WHEREAS, the Stockholders desire to accept the Exchange Offer of the
Company.

     NOW, THEREFORE, in consideration of the premises, and for other good and
valuable consideration, the receipt and sufficiency of which is hereby
acknowledged, the parties hereto agree as follows:

SECTION 1. EXCHANGE OF STOCK

     1.1 Common Stock. Subject to the terms and conditions of this Agreement,
the Common Stockholders hereby agree to deliver to the Company an aggregate of
7,914,471 shares of ISS Common Stock, in the amounts shown on Schedule A hereto.
In exchange for such shares of ISS Common Stock, the Company agrees to deliver
to the Common Stockholders one share of the Company's Common Stock for each
share of ISS Common Stock surrendered to the



<PAGE>   2

Company, for an aggregate of 7,914,471 shares of the Common Stock of the
Company, in the respective amounts shown on Schedule A hereto.

     1.2 Series A Preferred Stock. Subject to the terms and conditions of this
Agreement, the Series A Stockholders hereby agree to deliver to the Company an
aggregate of 3,650,000 shares of ISS Series A Preferred Stock, in the amounts
shown on Schedule A hereto. In exchange for such shares of ISS Series A
Preferred Stock, the Company agrees to deliver to the Series A Stockholders one
share of the Company's Series A Preferred Stock for each share of ISS Series A
Preferred Stock surrendered to the Company, for an aggregate of 3,650,000 shares
of the Series A Preferred Stock of the Company, in the respective amounts shown
on Schedule A hereto.

     1.3 Series B Preferred Stock. Subject to the terms and conditions of this
Agreement, the Series B Stockholders hereby agree to deliver to the Company an
aggregate of 2,086,957 shares of ISS Series B Preferred Stock, in the amounts
shown on Schedule A hereto. In exchange for such shares of ISS Series B
Preferred Stock, the Company agrees to deliver to the Series B Stockholders one
share of the Company's Series B Preferred Stock for each share of ISS Series B
Preferred Stock surrendered to the Company, for an aggregate of 2,086,957 shares
of the Series B Preferred Stock of the Company, in the respective amounts shown
on Schedule A hereto.

SECTION 2. CLOSING

     2.1 Closing Date. The closing (the "Closing") of the exchange of the ISS
Common Stock of the Common Stockholders for the Common Stock of the Company, the
ISS Series A Preferred Stock of the Series A Stockholders for the Series A
Preferred Stock of the Company and the ISS Series B Preferred Stock of the
Series B Stockholders for the Series B Preferred Stock of the Company shall be
held on December 10, 1997, at the offices of Brobeck, Phleger and Harrison LLP,
301 Congress, Suite 1200, Austin, Texas 78701, or on such other date or at such
other place as the parties shall mutually agree (the date of the Closing is
hereinafter referred to as the "Closing Date").


     2.2 Deliveries. At the Closing, the Common Stockholders shall deliver share
certificates evidencing their shares of ISS Common Stock against delivery by the
Company of share certificates evidencing the Common Stock; the Series A
Stockholders shall deliver certificates evidencing their shares of ISS Series A
Preferred Stock against delivery by the Company of share certificates evidencing
the Series A Preferred Stock; and the Series B Stockholders shall deliver
certificates evidencing their shares of ISS Series B Preferred Stock against
delivery by the Company of share certificates evidencing the Series B Preferred
Stock.


                                       2

<PAGE>   3



SECTION 3. REPRESENTATIONS AND WARRANTIES OF THE COMPANY

     The Company represents and warrants to the Stockholders as follows:

     3.1 Organization. The Company is a corporation duly organized and existing
in good standing under the laws of the State of Delaware.

     3.2 Authorization. The execution and delivery of this Agreement has been
duly authorized by the Company's Board of Directors and no further corporate
action is necessary on the part of the Company to enter into this Agreement or
to consummate the transactions contemplated hereby, and this Agreement, when
executed and delivered by the Company, will constitute a valid and legally
binding obligation of the Company, enforceable in accordance with its terms,
except as limited by applicable bankruptcy, insolvency, reorganization,
moratorium or other laws of general application relating to or affecting the
enforcement of creditor's rights.

SECTION 4. REPRESENTATIONS AND WARRANTIES OF THE STOCKHOLDERS

     4.1 Authorization. Each Stockholder severally represents and warrants to
the Company that this Agreement, when executed and delivered by such
Stockholder, will constitute a valid and legally binding obligation of such
Stockholder, enforceable in accordance with its terms, except as limited by
applicable bankruptcy, insolvency, reorganization, moratorium or other laws of
general application relating to or affecting the enforcement of creditor rights.

     4.2 No Encumbrances. Each Common Stockholder, Series A Stockholder and
Series B Stockholder severally represents and warrants to the Company that such
holder is the beneficial owner of the shares of ISS Common Stock, ISS Series A
Preferred Stock and ISS Series B Preferred Stock, respectively, being exchanged
for Common Stock, Series A Preferred Stock and Series B Preferred Stock,
respectively, hereunder, free and clear of all liens, encumbrances, charges and
assessments, and are subject to no restrictions with respect to transferability
except in compliance with applicable securities laws, the terms of that certain
Amended and Restated Rights Agreement dated February 14, 1997 by and among ISS,
the persons listed on Exhibit A thereto and the persons listed on the signature
pages thereto (the "Rights Agreement") and that certain Amended and Restated
Right of First Refusal and Co-Sale Agreement dated February 14, 1997, by and
among ISS and the persons listed on the signature pages thereto (the "Co-Sale
Agreement").

SECTION 5. LEGENDS

     All certificates representing the Common Stock, the Series A Preferred
Stock and Series B Preferred Stock issued to the Stockholders shall have
endorsed thereon the following the legend:


                                       3

<PAGE>   4

               THESE SECURITIES HAVE NOT BEEN REGISTERED UNDER THE
               SECURITIES ACT OF 1933. THEY MAY NOT BE SOLD, OFFERED
               FOR SALE, PLEDGED OR HYPOTHECATED IN THE ABSENCE OF A
               REGISTRATION STATEMENT IN EFFECT WITH RESPECT TO THE
               SECURITIES UNDER SUCH ACT OR AN OPINION OF COUNSEL
               SATISFACTORY TO THE COMPANY THAT SUCH REGISTRATION IS
               NOT REQUIRED OR UNLESS SOLD PURSUANT TO RULE 144 OF
               SUCH ACT.

SECTION 6. MISCELLANEOUS

     6.1 Entire Agreement; Amendment. This Agreement constitutes the full and
entire understanding and agreement among the parties with respect to the subject
hereof. Neither this Agreement nor any term hereof may be amended, waived,
discharged or terminated verbally, but only by a written instrument signed by
the party against whom enforcement of any such amendment, waiver, discharge or
termination is sought.

     6.2 Counterparts. This Agreement may be executed in counterparts, each of
which shall be an original and all of which together shall constitute one
instrument.

     6.3 Governing Law. This Agreement shall be governed by and interpreted in
accordance with the laws of the State of Delaware.

     6.4 Assignment of Obligations. ISS hereby assigns all of its rights and
obligations pursuant to the Rights Agreement, the Co-Sale Agreement, that
certain Series A Preferred Stock Purchase Agreement dated February 2, 1996 by
and among ISS and the persons listed on the signature pages thereto, that
certain Letter Agreement Relating to Directed Shares dated February 2, 1996, by
and among ISS, Greylock Equity Limited Partnership ("Greylock") and Sigma
Partners, that certain Stock Repurchase Agreement dated February 2, 1996,
between ISS and Christopher Klaus, that certain Stock Repurchase Agreement dated
February 2, 1996, between ISS and Thomas Noonan, that certain Agreement
Regarding Acceleration of Vesting of Future Optionees dated February 2, 1996 by
and among ISS, Greylock, Sigma Partners III, L.P., Sigma Associates III, L.P.
and Sigma Investors III, L.P. (collectively "Sigma"), that certain Amended and
Restated Voting Agreement dated as of February 17, 1997 by and among ISS, the
persons listed on Exhibit A thereto, Sigma, Greylock, Kleiner Perkins Caufield &
Byers VIII, KPCB Information Sciences Zaibatsu Fund II, KPCB Java Fund
(collectively, "Kleiner"), AT&T Venture Fund II, L.P., and Venture Fund I, L.P.,
that certain Agreement Regarding Acceleration of Vesting of Future Optionees
dated February 14, 1997, by and among ISS, AT&T and Kleiner, that certain Letter
Agreement regarding Directed Shares dated February 14, 1997, by and among ISS,
AT&T Venture Fund II, L.P. and Kleiner Perkins Caufield & Byers and that certain
Letter Agreement dated February 14, 1997, between ISS and Kleiner Perkins
Caufield & Byers VIII regarding Management Rights and the Company hereby accepts
such rights and obligations.


                                       4

<PAGE>   5


     IN WITNESS WHEREOF, the parties have hereunto set their hands as of the
date first hereinabove set forth.


                                    THE COMPANY:

                                    ISS GROUP, INC.


                                    By:
                                        ----------------------------------
                                        Thomas E. Noonan, President


                                    ISS:

                                    INTERNET SECURITY SYSTEMS, INC.


                                    By:
                                        ----------------------------------
                                        Thomas E. Noonan, President



                                    STOCKHOLDERS:

                                    COMMON STOCK



                                    --------------------------------------
                                    Christopher Klaus



                                    --------------------------------------
                                    Thomas E. Noonan



                                    --------------------------------------
                                    Kevin O'Connor



                                    --------------------------------------
                                    Glenn McGonnigle


                                       5


<PAGE>   6


                                    NOONAN 1997 FAMILY TRUST



                                    By:
                                        ----------------------------------
                                        Kimbrough P. Noonan
                                        Trustee


                                    NOONAN 1997 ANNUNITY TRUST



                                    By:
                                        ----------------------------------
                                        Thomas E. Noonan
                                        Trustee




                                    --------------------------------------
                                    Dennis Crow



<PAGE>   7


                                    SERIES A PREFERRED STOCK

                                    GREYLOCK EQUITY LIMITED PARTNERSHIP

                                    By: Greylock Equity Limited Partnership,
                                        Its Partner


                                    By:
                                        ----------------------------------
                                        Name:
                                        Title:




                                        ----------------------------------
                                        John P. Imlay, Jr., Individually


                                       7


<PAGE>   8


                                    SIGMA PARTNERS III, L.P.

                                    By: Sigma Management III, L.P.,
                                        its General Partner


                                    By:
                                       -----------------------------------
                                       Robert Davoli,
                                       General Partner


                                    SIGMA ASSOCIATES III, L.P.

                                    By: Sigma Management III, L.P.,
                                        its General Partner


                                    By:
                                        ----------------------------------
                                        Robert Davoli,
                                        General Partner




                                    SIGMA INVESTORS III, L.P.

                                    By: Sigma Management III, L.P.,
                                        its General Partner


                                    By:
                                       -----------------------------------
                                       Robert Davoli,
                                       General Partner



                                       8


<PAGE>   9


                                    SERIES B PREFERRED STOCK

                                    AT & T VENTURE FUND I, L.P.


                                    By:
                                        ----------------------------------
                                        Richard S. Bodman,
                                        General Partner


                                    GREYLOCK EQUITY LIMITED PARTNERSHIP

                                    By: Greylock Equity Limited Partnership,
                                        its Partner


                                    By:
                                        ----------------------------------
                                        Name:
                                        Title:



                                    --------------------------------------
                                    John P. Imlay, Jr., Individually


                                       9


<PAGE>   10




                                    KLEINER PERKINS CAUFIELD & BYERS VIII

                                    By: KPCB VIII Associates


                                    By:
                                        ----------------------------------
                                        Name:
                                        Title:


                                    KPCB INFORMATION SCIENCES
                                    ZAIBATSU FUND II

                                    By: KPCB VII Associates


                                    By:
                                        ----------------------------------
                                        Name:
                                        Title:


                                    KPCB JAVA FUND

                                    By: KPCB VIII Associates


                                    By:
                                        ----------------------------------
                                        Name:
                                        Title:


                                       10

<PAGE>   11


                                    SIGMA ASSOCIATES, III, L.P.

                                    By: Sigma Management III, L.P.,
                                        its General Partner


                                    By:
                                        ----------------------------------
                                        Robert Davoli,
                                        General Partner


                                    SIGMA INVESTORS III, L.P.

                                    By: Sigma Management III, L.P.,
                                        its General Partner


                                    By:
                                        ----------------------------------
                                        Robert Davoli,
                                        General Partner


                                    SIGMA PARTNERS III, L.P.

                                    By: Sigma Management III, L.P.,
                                        its General Partner


                                    By:
                                        ----------------------------------
                                        Robert Davoli,
                                        General Partner


<PAGE>   12






                                    VENTURE FUND I, L.P.


                                    By:
                                        ----------------------------------
                                        Richard S. Bodman,
                                        General Partner


<PAGE>   13


                                   SCHEDULE A

<TABLE>
<CAPTION>
<S>                               <C>                                    <C>
================================= ====================================== ========================================
Common Stockholders               Number of Shares of ISS Common Stock   Number of Shares of Common Stock to be
                                  to be Exchanged                        Received
- --------------------------------- -------------------------------------- ----------------------------------------
Dennis Crow                                                      12,500                                   12,500
- --------------------------------- -------------------------------------- ----------------------------------------
Christopher Klaus                                             4,485,836                                4,485,836
- --------------------------------- -------------------------------------- ----------------------------------------
Thomas E. Noonan                                              1,784,770                                1,784,770
- --------------------------------- -------------------------------------- ----------------------------------------
Noonan 1997 Family Trust                                        110,000                                  110,000
- --------------------------------- -------------------------------------- ----------------------------------------
Noonan 1997 Annuity Trust                                        65,000                                   65,000
- --------------------------------- -------------------------------------- ----------------------------------------
Kevin O'Connor                                                1,293,475                                1,293,475
- --------------------------------- -------------------------------------- ----------------------------------------
Glenn McGonnigle                                                162,890                                  162,890
- --------------------------------- -------------------------------------- ----------------------------------------
Series A Stockholders             Number of Shares of ISS Series A       Number of Shares of Series A Preferred
                                  Preferred Stock to be Exchanged        Stock to be Received
- --------------------------------- -------------------------------------- ----------------------------------------
Greylock Equity Limited
Partnership                                                   2,050,000                                2,050,000
- --------------------------------- -------------------------------------- ----------------------------------------
John P. Imlay, Jr.                                              100,000                                  100,000
- --------------------------------- -------------------------------------- ----------------------------------------
Sigma Associates III, L.P.                                      228,000                                  228,000
- --------------------------------- -------------------------------------- ----------------------------------------
Sigma Investors III, L.P.                                        19,500                                   19,500
- --------------------------------- -------------------------------------- ----------------------------------------
Sigma Partners III, L.P.                                      1,252,500                                1,252,500
- --------------------------------- -------------------------------------- ----------------------------------------
Series B Stockholders             Number of Shares of ISS Series B       Number of Shares of Series B Preferred
                                  Preferred Stock to be Exchanged        Stock to be Received
- --------------------------------- -------------------------------------- ----------------------------------------
AT&T Venture Fund II, L.P.                                      337,945                                  337,945
- --------------------------------- -------------------------------------- ----------------------------------------
Greylock Equity Limited                                         296,498                                  296,498
Partnership
- --------------------------------- -------------------------------------- ----------------------------------------
John P. Imlay, Jr.                                               13,427                                   13,427
- --------------------------------- -------------------------------------- ----------------------------------------
Kleiner Perkins Caufield &
Byers VIII                                                      326,196                                  326,196
- --------------------------------- -------------------------------------- ----------------------------------------
KPCB Information Sciences
Zaibatsu Fund II                                                 29,654                                   29,654
- --------------------------------- -------------------------------------- ----------------------------------------
KPCB Java Fund                                                  830,316                                  830,316
- --------------------------------- -------------------------------------- ----------------------------------------
Sigma Associates III, L.P.                                       41,804                                   41,804
- --------------------------------- -------------------------------------- ----------------------------------------
Sigma Investors III, L.P.                                         4,652                                    4,652
- --------------------------------- -------------------------------------- ----------------------------------------
Sigma Partners III, L.P.                                        168,916                                  168,916
- --------------------------------- -------------------------------------- ----------------------------------------
Venture Fund I, L.P.                                             37,549                                   37,549
================================= ====================================== ========================================
</TABLE>


                                       13


<PAGE>   1
                                 ISS GROUP, INC.                    EXHIBIT 10.5

            AMENDED AND RESTATED AGREEMENT REGARDING ACCELERATION OF
                           VESTING OF FUTURE OPTIONEES


                  This Amended and Restated Agreement Regarding Acceleration of
Vesting of Future Optionees (this "Agreement") is made as of this 24th day of
February, 1998, between ISS Group, Inc., a Delaware corporation (the "Company"),
and Greylock Equity Limited Partnership ("Greylock"), Sigma Partners III, L.P.,
Sigma Associates III, L.P. and Sigma Investors III, L.P. (collectively,
"Sigma"), AT&T Venture Fund II, L.P. and Venture Fund I, L.P. (together,
"AT&T"), and Kleiner Perkins Caufield & Byers VIII, KPCB Information Sciences
Zaibatsu Fund II and KPCB Java Fund (collectively, "KPCB").


                  WHEREAS, the parties signatory to that certain Agreement
Regarding Acceleration of Vesting of Future Optionees, dated February 2, 1996,
by and among Internet Security Systems, Inc. ("ISS"), Greylock and Sigma (the
"First Vesting Agreement") desire to amend and restate the First Vesting
Agreement in its entirety and combine it with the Second Vesting Agreement (as
hereinafter defined); and

                  WHEREAS, parties signatory to that certain Agreement Regarding
Acceleration of Vesting of Future Optionees, dated February 14, 1997, by and
among ISS, AT&T and KPCB (the "Second Vesting Agreement") desire to amend and
restate the Second Vesting Agreement in its entirety and combine it with the
First Vesting Agreement; and

                  WHEREAS, the Company is the successor to ISS' obligations
under the First Vesting Agreement and Second Vesting Agreement pursuant to that
certain Stock Exchange Agreement dated December 9, 1997 by and among the
Company, ISS and the shareholders of ISS;

                  NOW, THEREFORE, it is hereby agreed as follows:

A.       Waiver. Greylock, Sigma, AT&T and KPCB hereby waive the observance of
the terms of the First Vesting Agreement and the Second Vesting Agreement with
respect to options granted by the Board of Directors of ISS and ISS Group under
the Company's 1995 Stock Incentive Plan (as amended and restated) to the extent
such option grants may violate Section 1 of either the First Vesting Agreement
or the Second Vesting Agreement during the last vesting period of such option
grants.

B.       Combination, Amendment and Restatement. Greylock, Sigma, AT&T, KPCB and
the Company hereby agree to combine, amend and restate the First Vesting
Agreement and the Second Vesting Agreement, so that the resultant agreement
reads in its entirety as follows:


<PAGE>   2

1.       Acceleration. The Company agrees that when granting any Options to any
future Optionee, the Company may execute an agreement with such Optionee
containing provisions to the following effect:

         "in the event that both the Conditions Precedent to Acceleration set
         forth in Section 2 below arise, and this agreement is not rendered void
         by the provisions of Section 3 below, not more than the greater of (i)
         fifty percent (50%) of the Options held by such Optionee which have not
         yet vested, or (ii) the Options which would be vested in such
         Optionee's next vesting installment may become exercisable immediately,
         if the Conditions Precedent to Acceleration set forth in Section 2 have
         occurred.

                  Conditions Precedent to Acceleration

                  (a) whenever the Company sells, conveys or otherwise disposes
         of all or substantially all of its property or business, or merges into
         or effects a reorganization with any corporation (other than a
         wholly-owned subsidiary corporation) in which the shareholders of the
         Company immediately prior to the transaction possess less than 50% of
         the voting power of the surviving entity (or its parent) (together the
         "Surviving Entity") immediately after the transaction (a "Change in
         Control"); and

                  (b) the Optionee is not offered a position with the Surviving
         Entity which: (i) offers compensation equivalent to or greater than
         that provided to the Optionee by the Company immediately prior to the
         Change in Control; and (ii) offers duties and responsibilities
         comparable to those associated with the position held by the Optionee
         with the Company immediately prior to the Change in Control such that
         the duties and responsibilities of the Optionee with the Surviving
         Entity are not materially diminished from those of the Optionee at the
         Company."

The parties agree that nothing herein shall in any way effect existing vesting
provisions of current option holders.

2. Invalidity of this Agreement in the Event of Certain Business Combinations.
In the event that it is determined by the Board of Directors of the Company (the
"Board"), upon receipt of a written opinion of the Company's independent public
accountants, that the enforcement of this Agreement would preclude accounting
for any proposed business combination of the Company involving a Change in
Control as a pooling of interests, and the Board otherwise desires to approve a
proposed business transaction which requires as a condition to the closing of
such transaction that it be accounted for as a pooling of interests, this
Agreement shall be null and void, but only if the absence of enforcement of this
Agreement would preserve treatment of the proposed business combination as a
pooling of interests."

3.       Miscellaneous.

         3.1 Notices. Any notice required or permitted to be given to a party
pursuant to this


                                       2

<PAGE>   3

Agreement shall be in writing and shall be effective upon personal delivery or
five (5) business days after deposit in the U.S. Mail, postage prepaid and
properly addressed to the party to be notified.

         3.2 Governing Law. This Agreement shall be governed by and construed
under the laws of the State of Delaware without regard to choice of law rules.

         3.3 Counterparts. This Agreement may be executed in two (2) or more
counterparts, each of which shall be deemed an original, but all of which
together shall constitute one and the same instrument.

         3.4 Successors and Assigns. Except as otherwise expressly provided in
this Agreement, the provisions hereof shall inure to the benefit of, and be
binding upon, the successors and assigns of the parties hereto.

         3.5 Amendments and Waivers. Any term hereof may be amended and the
observance of any term hereof may be waived (either generally or in a particular
instance and either retroactively or prospectively) only with the written
consent of Greylock, Sigma, AT&T and Kleiner. Any amendment or waiver so
effected shall be binding upon the Company.

         3.6 Termination. All parties' rights under this Agreement will
terminate upon the earliest to occur of (i) the date on which this Agreement is
terminated by a writing executed by Greylock, Sigma, AT&T and Kleiner, or (ii)
the dissolution of the Company.

         IN WITNESS WHEREOF, the parties have executed this Agreement as of the
date and year hereinabove first written.

                                 ISS GROUP, INC.


                                 By:
                                     ----------------------------------
                                          Thomas E. Noonan
                                          President


                                 GREYLOCK EQUITY LIMITED PARTNERSHIP

                                 By:      Greylock Equity GP Limited Partnership
                                          Its General partner

                                 By:
                                          -----------------------------
                                 Name:
                                          -----------------------------
                                 Title:
                                          -----------------------------


                                       3

<PAGE>   4

                                 AT & T VENTURE FUND II, L.P.

                                 By:
                                          -----------------------------
                                 Name:
                                          -----------------------------
                                 Title:
                                          -----------------------------


                                 VENTURE FUND I, L.P.

                                 By:
                                          -----------------------------
                                 Name:
                                          -----------------------------
                                 Title:
                                          -----------------------------



                                 SIGMA  ASSOCIATES III, L.P.

                                 By:      Sigma Management III, L.P.
                                          Its General Partner

                                 By:
                                          -----------------------------
                                 Name:
                                          -----------------------------
                                 Title:
                                          -----------------------------

                                 SIGMA INVESTORS III, L.P.

                                 By:      Sigma Management III, L.P.
                                          Its General Partner

                                 By:
                                          -----------------------------
                                 Name:
                                          -----------------------------
                                 Title:
                                          -----------------------------

                                 SIGMA PARTNERS III, L.P.

                                 By:      Sigma Management III, L.P.
                                          Its General Partner

                                 By:
                                          -----------------------------
                                 Name:
                                          -----------------------------
                                 Title:
                                          -----------------------------

                                       4


<PAGE>   5

                                 KLEINER PERKINS CAUFIELD & BYERS VIII

                                 By:      KPCB VIII Associates

                                 By:
                                          -----------------------------
                                 Name:
                                          -----------------------------
                                 Title:
                                          -----------------------------

                                 KPCB INFORMATION SCIENCES
                                 ZAIBATSU FUND II

                                 By:      KPCB VII Associates

                                 By:
                                          -----------------------------
                                 Name:
                                          -----------------------------
                                 Title:
                                          -----------------------------


                                 KPCB JAVA FUND

                                 By:      KPCB VIII Associates

                                 By:
                                          -----------------------------
                                 Name:
                                          -----------------------------
                                 Title:
                                          -----------------------------

                                       5


<PAGE>   1
                                                                    EXHIBIT 10.6



                             COMPENSATION AGREEMENT

                  Agreement made as of the _______ day of ___________, 1998 by
and between ISS Group, Inc., a Georgia corporation (the "Corporation"), and
______________ ("Optionee").

                               W I T N E S S E T H

                  WHEREAS, in consideration for services performed by Optionee,
the Corporation granted Optionee a stock option on December 8, 1997 to purchase
20,000 shares of the Corporation's Common Stock (the "Option") upon the terms
and conditions set forth in the documentation evidencing such Option.

                  NOW, THEREFORE, in consideration of the above premises, the
parties hereto agree as follows:

                  1. The Corporation and Optionee acknowledge and agree that the
Option is granted solely as compensation for services rendered the Corporation
by Optionee and not for any capital-raising purposes or in connection with any
capital-raising activities.

                  2.  The Option shall not be transferable or assignable except
in connection with Optionee's death.

                  3. This agreement is intended to constitute a written
compensation contract within the meaning of (i) Rule 701 of the Securities Act
of 1933, as amended and (ii) Rule 405 of Regulation C of the Rules promulgated
under the Securities Act of 1933, as amended.

                  4. This agreement is intended solely to memorialize the
agreement and understanding which exists between Optionee and the Corporation
concerning the grant of the Option. Nothing herein or in the documentation
evidencing the Option is intended to provide Optionee with the right to remain
in the Corporation's service for any specific period, and Optionee's services
may be terminated at any time by the Corporation, for any reason, with or
without cause.

                  IN WITNESS WHEREOF, the parties hereto have executed this
agreement as of the date first above written.


                                             ISS GROUP, INC.


                                             By:
- ----------------------------------               -------------------------
                ,Optionee                        Authorized Officer
- ----------------


                                       8
<PAGE>   2

                                 ISS GROUP, INC.
                    NOTICE OF GRANT OF NON-EMPLOYEE DIRECTOR
                                  STOCK OPTION



                  Notice is hereby given of the following option grant (the
"Option") to purchase shares of the Common Stock of ISS Group, Inc. (the
"Corporation"):

                  Optionee:

                  Grant Date:

                  Exercise Price:

                  Number of Option Shares:

                  Expiration Date:

                  Type of Option:  Non-Statutory Stock Option

                  Date Exercisable:  Immediately Exercisable

                  Vesting Schedule: The Option Shares shall initially be
                  unvested and subject to repurchase by the Corporation at the
                  Exercise Price paid per share. Optionee shall acquire a vested
                  interest in, and the Corporation's repurchase right shall
                  accordingly lapse with respect to, the Option Shares in a
                  series of four (4) successive equal annual installments upon
                  Optionee's completion of each year of Advisory Board or Board
                  service over the four (4)-year period measured from the Grant
                  Date. In no event shall any additional Option Shares vest
                  after Optionee's cessation of Advisory Board or Board service.

                  Optionee understands and agrees that the Option is granted
subject to and in accordance with the terms of the Stock Option Agreement
attached hereto as Exhibit A.

                  REPURCHASE RIGHT. OPTIONEE HEREBY AGREES THAT ALL UNVESTED
OPTION SHARES ACQUIRED UPON THE EXERCISE OF THE OPTION SHALL NOT BE TRANSFERABLE
AND SHALL BE SUBJECT TO REPURCHASE BY THE CORPORATION, AT THE EXERCISE PRICE
PAID PER SHARE, UPON OPTIONEE'S TERMINATION OF SERVICE AS A MEMBER OF THE
CORPORATION'S 


                                       
<PAGE>   3
ADVISORY BOARD OR BOARD OF DIRECTORS PRIOR TO VESTING IN THOSE SHARES. THE TERMS
AND CONDITIONS OF SUCH REPURCHASE RIGHT SHALL BE SPECIFIED IN A STOCK PURCHASE
AGREEMENT, IN FORM AND SUBSTANCE SATISFACTORY TO THE CORPORATION, EXECUTED BY
OPTIONEE AT THE TIME OF THE OPTION EXERCISE.

                  No Impairment of Rights. Nothing in this Notice or in the
attached Stock Option Agreement shall interfere with or otherwise restrict in
any way the rights of the Corporation or the Corporation's stockholders to
remove Optionee from the Board at any time in accordance with the provisions of
applicable law.

                  Definitions.  All capitalized terms in this Notice shall have
the meaning assigned to them in this Notice or in the attached Stock Option
Agreement.

                  , 199
- ------------------     --
          Date


                                    ISS GROUP, INC.


                                    By:
                                        ----------------------------------

                                    Title:
                                           -------------------------------


                                    --------------------------------------
                                    OPTIONEE

                                    Address:
                                             -----------------------------

                                    --------------------------------------


ATTACHMENTS
EXHIBIT A - STOCK OPTION AGREEMENT


                                       2



<PAGE>   4

                                    EXHIBIT A

                             STOCK OPTION AGREEMENT


<PAGE>   5

                                ISS GROUP, INC.
                             STOCK OPTION AGREEMENT


RECITALS

I.       The Corporation wishes to make a stock option grant to Optionee in
order to provide such person with an equity incentive to continue in the
Corporation's service.

         A.       Optionee is to render valuable services to the Corporation as
a non-employee Board member of Corporation (or a Parent or Subsidiary), and this
Agreement is executed in connection with the option grant made to such
individual to purchase shares of Common Stock.

         B.       The granted option is issued to Optionee in compensation for
the services which Optionee is to render the Corporation and not for any
capital-raising purposes or in connection with any capital-raising activities.

         C.       All capitalized terms in this Agreement shall have the meaning
assigned to them in the attached Appendix.

                  NOW, THEREFORE, it is hereby agreed as follows:

                  1.       GRANT OF OPTION. The Corporation hereby grants to
Optionee, as of the Grant Date, a Non-Statutory Option to purchase up to the
number of Option Shares specified in the Grant Notice. The Option Shares shall
be purchasable from time to time during the option term specified in Paragraph 2
at the Exercise Price.

                  2.       OPTION TERM. This option shall have a maximum term
of ten (10) years measured from the Grant Date and shall accordingly expire at
the close of business on the Expiration Date, unless sooner terminated in
accordance with Paragraph 5, 6 or 7.

                  3.       LIMITED TRANSFERABILITY. This option may, in 
connection with the Optionee's estate plan, be assigned in whole or in part
during Optionee's lifetime to one or more members of the Optionee's immediate
family or to a trust established for the exclusive benefit of one or more such
family members. The assigned portion shall be exercisable only by the person or
persons who acquire a proprietary interest in the option pursuant to such
assignment. The terms applicable to the assigned portion shall be the same as
those in effect for this option immediately prior to such assignment and shall
be set forth in such documents issued to the assignee as the Corporation may
deem appropriate. Should the Optionee die while holding this option, then this
option shall be transferred in accordance with Optionee's will or the laws of
descent and distribution.




<PAGE>   6


                  4.       EXERCISABILITY/VESTING.

                           (a)      This option shall be immediately exercisable
for any or all of the Option Shares, whether or not the Option Shares are vested
in accordance with the Vesting Schedule set forth on the Grant Notice, and shall
remain so exercisable until the Expiration Date or the sooner termination of the
option term under Paragraph 5, 6 or 7.

                           (b)      Optionee shall, in accordance with the
Vesting Schedule set forth in the Grant Notice, vest in the Option Shares in a
series of installments over his or her period of Board service. Vesting in the
Option Shares may be accelerated pursuant to the provisions of Paragraph 5, 6 or
7. In no event, however, shall any additional Option Shares vest following
Optionee's cessation of service as a Board member.

                  5.       CESSATION OF BOARD SERVICE. Should Optionee's service
as a Board member cease while this option remains outstanding, then the option
term specified in Paragraph 2 shall terminate (and this option shall cease to be
outstanding) prior to the Expiration Date in accordance with the following
provisions:

                           (i)      Should Optionee cease to serve as a Board
         member for any reason (other than death or Permanent Disability) while
         holding this option, then the period for exercising this option shall
         be reduced to a twelve (12)-month period commencing with the date of
         such cessation of Board service, but in no event shall this option be
         exercisable at any time after the Expiration Date. During such limited
         period of exercisability, this option may not be exercised in the
         aggregate for more than the number of Option Shares (if any) in which
         Optionee is vested on the date Optionee ceases service as a Board
         member. Upon the earlier of (i) the expiration of such twelve
         (12)-month period or (ii) the specified Expiration Date, the option
         shall terminate and cease to be exercisable with respect to any vested
         Option Shares for which the option has not been exercised.

                           (ii)     Should Optionee die during the twelve (12)-
         month period following his or her cessation of Board service, then the
         personal representative of Optionee's estate or the person or persons
         to whom the option is transferred pursuant to Optionee's will or in
         accordance with the laws of descent and distribution shall have the
         right to exercise this option for any or all of the Option Shares in
         which Optionee is vested at the time of Optionee's cessation of Board
         service (less any Option Shares purchased by Optionee after such
         cessation of Board service but prior to death). Such right of exercise
         shall terminate, and this option shall accordingly cease to be
         exercisable for such vested Option Shares, upon the earlier of (i) the
         expiration of the twelve (12)-month period measured from the date of
         Optionee's cessation of Board service or (ii) the specified Expiration
         Date of the option term.

                           (iii)    Should Optionee cease service as a Board
         member by reason of death or Permanent Disability, then all Option
         Shares at the time subject to this option but

                                       2.


<PAGE>   7

         not otherwise vested shall immediately vest in full so that Optionee
         (or the personal representative of Optionee's estate or the person or
         persons to whom the option is transferred upon Optionee's death) shall
         have the right to exercise this option for any or all of the Option
         Shares as fully-vested shares of Common Stock at any time prior to the
         earlier of (i) the expiration of the twelve (12)-month period measured
         from the date of Optionee's cessation of Board service or (ii) the
         specified Expiration Date.

                           (iv)     Upon Optionee's cessation of Board service
         for any reason other than death or Permanent Disability, this option
         shall immediately terminate and cease to be outstanding with respect to
         any and all Option Shares in which Optionee is not otherwise at that
         time vested in accordance with the normal Vesting Schedule set forth in
         the Grant Notice or the special vesting acceleration provisions of
         Paragraph 6 or 7 below.

                  6.       CORPORATE TRANSACTION.

                           (a)      In the event of a Corporate Transaction,
all Option Shares at the time subject to this option but not otherwise vested
shall automatically vest so that this option shall, immediately prior to the
specified effective date for the Corporate Transaction, become fully exercisable
for all of the Option Shares at the time subject to this option and may be
exercised for all or any portion of such shares as fully-vested shares of Common
Stock. Immediately following the consummation of the Corporate Transaction, this
option shall terminate and cease to be outstanding, except to the extent assumed
by the successor corporation or its parent company.

                           (b)      If this  option is assumed in connection 
with a Corporate Transaction, then this option shall be appropriately adjusted,
immediately after such Corporate Transaction, to apply to the number and class
of securities which would have been issuable to Optionee in consummation of such
Corporate Transaction had the option been exercised immediately prior to such
Corporate Transaction, and appropriate adjustments shall also be made to the
Exercise Price, provided the aggregate Exercise Price shall remain the same.

                  7.       CHANGE IN CONTROL/HOSTILE TAKE-OVER.

                           (a)      All Option Shares subject to this option at
the time of a Change in Control but not otherwise vested shall automatically
vest so that this option shall, immediately prior to the effective date of such
Change in Control, become fully exercisable for all of the Option Shares at the
time subject to this option and may be exercised for all or any portion of such
shares as fully-vested shares of Common Stock. This option shall remain
exercisable for such fully-vested Option Shares until the earliest to occur of
(i) the specified Expiration Date, (ii) the sooner termination of this option in
accordance with Paragraph 5 or 6 or (iii) the surrender of this option under
Paragraph 7(b).


                                       3.



<PAGE>   8

                           (b)      Optionee shall have an unconditional right
(exercisable during the thirty (30)-day period immediately following the
consummation of a Hostile Take-Over) to surrender this option to the Corporation
in exchange for a cash distribution from the Corporation in an amount equal to
the excess of (i) the Take-Over Price of the Option Shares at the time subject
to the surrendered option (whether or not those Option Shares are otherwise at
the time vested) over (ii) the aggregate Exercise Price payable for such shares.
This Paragraph 7(b) limited stock appreciation right shall in all events
terminate upon the expiration or sooner termination of the option term and may
not be assigned or transferred by Optionee.

                           (c)      To exercise the Paragraph 7(b) limited stock
appreciation right, Optionee must, during the applicable thirty (30)-day
exercise period, provide the Corporation with written notice of the option
surrender in which there is specified the number of Option Shares as to which
the option is being surrendered. Such notice must be accompanied by the return
of Optionee's copy of this Agreement, together with any written amendments to
such Agreement. The cash distribution shall be paid to Optionee within five (5)
business days following such delivery date, and the consent of the Board shall
not be required in connection with such option surrender and cash distribution.
Upon receipt of such cash distribution, this option shall be cancelled with
respect to the shares subject to the surrendered option (or the surrendered
portion), and Optionee shall cease to have any further right to acquire those
Option Shares under this Agreement. The option shall, however, remain
outstanding for the balance of the Option Shares (if any) in accordance with the
terms and provisions of this Agreement, and the Corporation shall accordingly
issue a new stock option agreement (substantially in the same form as this
Agreement) for those remaining Option Shares.

                  8.       ADJUSTMENT IN OPTION SHARES. Should any change be
made to the Common Stock by reason of any stock split, stock dividend,
recapitalization, combination of shares, exchange of shares or other change
affecting the outstanding Common Stock as a class without the Corporation's
receipt of consideration, appropriate adjustments shall be made to (i) the
number and/or class of securities subject to this option and (ii) the Exercise
Price in order to reflect such change and thereby preclude a dilution or
enlargement of benefits hereunder; provided, however, that the aggregate
Exercise Price shall remain the same.

                  9.       STOCKHOLDER  RIGHTS. The holder of this option 
shall not have any stockholder rights with respect to the Option Shares until
such person shall have exercised the option, paid the Exercise Price and become
a holder of record of the purchased shares.


                                       4.


<PAGE>   9


                  10.      MANNER OF EXERCISING OPTION.

                           (a)      In order to exercise this option for all or
any part of the Option Shares for which the option is at the time exercisable,
Optionee or, in the case of exercise after Optionee's death, Optionee's
executor, administrator, heir or legatee, as the case may be, must take the
following actions:

                                         (i)         To the extent the option is
         exercised for vested Option Shares, the Secretary of the Corporation
         shall be provided with written notice of the option exercise (the
         "Exercise Notice") in substantially the form of Exhibit I attached
         hereto, in which there is specified the number of vested Option Shares
         to be purchased under the exercised option. To the extent that the
         option is exercised for one or more unvested Option Shares, Optionee
         (or other person exercising the option) shall deliver to the Secretary
         of the Corporation a Purchase Agreement for those unvested Option
         Shares.

                                        (ii)         The Exercise Price for the
         purchased shares shall be paid in one or more of the following
         alternative forms:

                                             - cash or check made payable to the
                  Corporation's order; or

                                             - shares of Common Stock held by
                  Optionee (or any other person or persons exercising the
                  option) for the requisite period necessary to avoid a charge
                  to the Corporation's earnings for financial reporting purposes
                  and valued at Fair Market Value on the Exercise Date; or

                                             - to the extent the option is
                  exercised for vested Option Shares, through a special sale and
                  remittance procedure pursuant to which Optionee shall provide
                  irrevocable written instructions (A) to a
                  Corporation-designated brokerage firm to effect the immediate
                  sale of the vested shares purchased under the option and remit
                  to the Corporation, out of the sale proceeds available on the
                  settlement date, sufficient funds to cover the aggregate
                  Exercise Price payable for those shares plus the applicable
                  Federal, state and local income taxes required to be withheld
                  by the Corporation by reason of such exercise and (B) to the
                  Corporation to deliver the certificates for the purchased
                  shares directly to such brokerage firm in order to complete
                  the sale.



                                       5.

<PAGE>   10
                                    (iii)    Appropriate documentation
         evidencing the right to exercise this option shall be furnished the
         Corporation if the person or persons exercising the option is other
         than Optionee.

                                    (iv)     Appropriate arrangement must be
         made with the Corporation for the satisfaction of all Federal, state
         and local income tax withholding requirements applicable to the option
         exercise.

                           (b)      Except to the extent the sale and remittance
procedure specified above is utilized in connection with the exercise of the
option for vested Option Shares, payment of the Exercise Price for the purchased
shares must accompany the Exercise Notice or Purchase Agreement delivered to the
Corporation in connection with the option exercise.

                           (c)      As soon as practical after the Exercise
Date, the Corporation shall issue to or on behalf of Optionee (or any other
person or persons exercising this option) a certificate or certificates
representing the purchased Option Shares. To the extent any such Option Shares
are unvested, the certificates for those Option Shares shall be endorsed with an
appropriate legend evidencing the Corporation's repurchase rights and may be
held in escrow with the Corporation until such shares vest.

                           (d)      In no event may this option be exercised for
fractional shares.


                  11.      NO IMPAIRMENT OF RIGHTS. This Agreement shall not in
any way affect the right of the Corporation to adjust, reclassify, reorganize or
otherwise make changes in its capital or business structure or to merge,
consolidate, dissolve, liquidate or sell or transfer all or any part of its
business or assets. Nor shall this Agreement in any way be construed or
interpreted so as to affect adversely or otherwise impair the right of the
Corporation or the stockholders to remove Optionee from the Board at any time in
accordance with the provisions of applicable law.

                  12.      COMPLIANCE WITH LAWS AND REGULATIONS.

                           (a)      The  exercise  of this option and the
issuance of the Option Shares upon such exercise shall be subject to compliance
by the Corporation and Optionee with all applicable requirements of law relating
thereto and with all applicable regulations of any stock exchange (or the Nasdaq
National Market, if applicable) on which the Common Stock may be listed for
trading at the time of such exercise and issuance.

                           (b)      The inability of the Corporation to obtain 
approval from any regulatory body having authority deemed by the Corporation to
be necessary to the lawful issuance and sale of any Common Stock pursuant to
this option shall relieve the Corporation of any liability with respect to the
non-issuance or sale of the Common Stock as to which such approval shall not
have been obtained. However, the Corporation shall use its best efforts to
obtain all such applicable approvals.


                                       6.
<PAGE>   11

                  13.      SUCCESSORS AND ASSIGNS. Except to the extent
otherwise provided in Paragraph 3 or 6, the provisions of this Agreement shall
inure to the benefit of, and be binding upon, the Corporation and its successors
and assigns and Optionee, Optionee's assigns and the legal representatives,
heirs and legatees of Optionee's estate.

                  14.      GOVERNING  LAW. The interpretation, performance, and
enforcement of this Agreement shall be governed by the laws of the State of
Georgia without resort to that State's conflict-of-laws rules.

                  15.      NOTICES. Any notice required to be given or delivered
to the Corporation under the terms of this Agreement shall be in writing and
addressed to the Corporation at its principal corporate offices. Any notice
required to be given or delivered to Optionee shall be in writing and addressed
to Optionee at the address indicated below Optionee's signature line on the
Grant Notice. All notices shall be deemed effective upon personal delivery or
upon deposit in the U.S. mail, postage prepaid and properly addressed to the
party to be notified.



                                       7.


<PAGE>   12

                                    EXHIBIT I

                               NOTICE OF EXERCISE


                  I hereby notify ISS Group, Inc. (the "Corporation") that I
elect to purchase __________ shares of the Corporation's Common Stock (the
"Purchased Shares") at the option exercise price of $______  per share (the
"Exercise Price") pursuant to that certain option (the "Option") granted to me
on ___________, 199_ .

                  Concurrently with the delivery of this Exercise Notice to the
Secretary of the Corporation, I shall hereby pay to the Corporation the Exercise
Price for the Purchased Shares in accordance with the provisions of my agreement
with the Corporation evidencing the Option and shall deliver whatever additional
documents may be required by such agreement as a condition for exercise.
Alternatively, I may utilize the special broker/dealer sale and remittance
procedure specified in my agreement to effect payment of the Exercise Price for
any Purchased Shares in which I am vested at the time of exercise.


__________________________, 199
Date



                                             _____________________________
                                             Optionee

                                             Address:
                                                      ____________________

                                             _____________________________


Print name in exact manner
it is to appear on the
stock certificate:                           _____________________________


Address to which certificate
is to be sent, if different
from address above:                          _____________________________

                                             _____________________________

                                             _____________________________



Social Security Number:                      _____________________________


<PAGE>   13


                                    APPENDIX


         The following definitions shall be in effect under the Agreement:


         A.       AGREEMENT shall mean this Stock Option Agreement.


         B.       BOARD shall mean the Corporation's Board of Directors
including the Advisory Board.

         C.       CHANGE IN CONTROL shall mean a change in ownership or control
of the Corporation effected through either of the following transactions:

               (i)         the acquisition, directly or indirectly, by any
         person or related group of persons (other than the Corporation or a
         person that directly or indirectly controls, is controlled by, or is
         under common control with, the Corporation) of beneficial ownership
         (within the meaning of Rule 13d-3 of the 1934 Act) of securities
         possessing more than fifty percent (50%) of the total combined voting
         power of the Corporation's outstanding securities pursuant to a tender
         or exchange offer made directly to the Corporation's stockholders, or

               (ii)        a change in the composition of the Board over a
         period of thirty-six (36) consecutive months or less such that a
         majority of the Board members ceases, by reason of one or more
         contested elections for Board membership, to be comprised of
         individuals who either (A) have been Board members continuously since
         the beginning of such period or (B) have been elected or nominated for
         election as Board members during such period by at least a majority of
         the Board members described in clause (A) who were still in office at
         the time the Board approved such election or nomination.

         D.       CODE shall mean the Internal Revenue Code of 1986, as amended.

         E.       COMMON STOCK shall mean the Corporation's common stock.

         F.       CORPORATE TRANSACTION shall mean either of the following
stockholder-approved transactions to which the Corporation is a party:

               (i)         a merger or consolidation in which securities
         possessing more than fifty percent (50%) of the total combined voting
         power of the Corporation's outstanding securities are transferred to a
         person or persons different from the persons holding those securities
         immediately prior to such transaction, or



                                      A-1.
<PAGE>   14

               (ii)        the sale, transfer or other disposition of all or
         substantially all of the Corporation's assets in complete liquidation
         or dissolution of the Corporation.

         G.       CORPORATION shall mean ISS Group, Inc., a Delaware
corporation.

         H.       EXERCISE DATE shall mean the date on which the option shall
have been exercised in accordance with Paragraph 10 of the Agreement.

         I.       EXERCISE PRICE shall mean the exercise price payable per share
as specified in the Grant Notice.

         J.       EXPIRATION DATE shall mean the date on which the option term 
expires as specified in the Grant Notice.

         K.       FAIR MARKET VALUE per share of Common Stock on any relevant 
date shall be determined in accordance with the following provisions:

                  (i)      If the Common Stock is at the time traded on the
         Nasdaq National Market, then the Fair Market Value shall be the closing
         selling price per share of Common Stock on the date in question, as the
         price is reported by the National Association of Securities Dealers on
         the Nasdaq National Market. If there is no closing selling price for
         the Common Stock on the date in question, then the Fair Market Value
         shall be the closing selling price on the last preceding date for which
         such quotation exists.

                  (ii)     If the Common Stock is at the time listed on any 
         Stock Exchange, then the Fair Market Value shall be the closing selling
         price per share of Common Stock on the date in question on the Stock
         Exchange determined by the Board to be the primary market for the
         Common Stock, as such price is officially quoted in the composite tape
         of transactions on such exchange. If there is no closing selling price
         for the Common Stock on the date in question, then the Fair Market
         Value shall be the closing selling price on the last preceding date for
         which such quotation exists.

         L.       GRANT DATE shall mean the date of grant of the option as
specified in the Grant Notice.

         M.       GRANT NOTICE shall mean the Notice of Grant of Stock Option
accompanying this Agreement, pursuant to which Optionee has been informed of the
basic terms of the option evidenced hereby.

         N.       HOSTILE TAKE-OVER shall mean the acquisition, directly or
indirectly, by any person or related group of persons (other than the
Corporation or a person that directly or indirectly controls,


                                      A-2.
<PAGE>   15

is controlled by, or is under common control with, the Corporation) of
beneficial ownership (within the meaning of Rule 13d-3 of the 1934 Act) of
securities possessing more than fifty percent (50%) of the total combined voting
power of the Corporation's outstanding securities pursuant to a tender or
exchange offer made directly to the Corporation's stockholders which the Board
does not recommend such stockholders to accept.

         O.       1934 ACT shall mean the Securities Exchange Act of 1934, as
amended.

         P.       NON-STATUTORY OPTION shall mean an option not intended to
satisfy the requirements of Code Section 422.

         Q.       OPTION SHARES shall mean the number of shares of Common Stock 
subject to the option.

         R.       OPTIONEE shall mean the person to whom the option is granted
as specified in the Grant Notice.

         S.       PERMANENT DISABILITY shall mean the inability of Optionee to
perform his or her usual duties as a Board member by reason of any medically
determinable physical or mental impairment expected to result in death or to be
of continuous duration of twelve (12) months or more.

         T.       PURCHASE AGREEMENT shall mean the stock purchase agreement (in
form and substance satisfactory to the Corporation) which must be executed at
the time the option is exercised for unvested Option Shares and which will
accordingly (i) grant the Corporation the right to repurchase, at the Exercise
Price, any and all of those Option Shares in which Optionee is not otherwise
vested at the time of his or her cessation of service as a Board member and (ii)
preclude the sale, transfer or other disposition of any of the Option Shares
purchased under such agreement while those Option Shares remain subject to the
repurchase right.

         U.       STOCK EXCHANGE shall mean either the American Stock Exchange
or the New York Stock Exchange.

         V.       TAKE-OVER PRICE shall mean the greater of (i) the Fair Market
Value per share of Common Stock on the date the option is surrendered to the
Corporation in connection with a Hostile Take-Over or (ii) the highest reported
price per share of Common Stock paid by the tender offeror in effecting the
Hostile Take-Over.

         W.       WESTING SCHEDULE shall mean the vesting schedule specified in
the Grant Notice, pursuant to which Optionee will vest in the Option Shares in
one or more installments over his or her period of Board service, subject to
acceleration in accordance with the provisions of the Agreement.



                                      A-3

<PAGE>   1
                                                                    EXHIBIT 10.7


                                    SUBLEASE


         This is a Sublease, dated as of this day of January 1998, between Cabot
Corporation, a Delaware corporation, with its principal office at 75 State
Street, Boston, Massachusetts ("Landlord") and Internet Security Systems, Inc.,
a Georgia corporation, with its principal office at 41 Perimeter Center Drive,
Suite 660, Atlanta, Georgia 30346 ("Tenant").

         WHEREAS, Landlord, as tenant, has leased space (the "Premises") in the
building known as Building 300 (the "Building") located at Embassy Row Office
Park, Atlanta, Georgia from Embassy Row Venture, a joint venture between New
York Life Insurance Company, a New York Corporation and Bailey & Associates, No.
1, Ltd., a Georgia limited partnership (collectively, "Original Lessor") by
lease, dated July 14, 1992 (the "Prime Lease"), a copy of which Tenant
acknowledges receipt; and

         WHEREAS, CarrAmerica Realty Corporation ("Prime Landlord") has
succeeded to the interest of Original Lessor under the Lease; and

         WHEREAS, Landlord has agreed to sublet the Premises to Tenant and
Tenant has agreed to sublet the Premises from Landlord.

         NOW THEREFORE, Landlord and Tenant, in consideration of the mutual
covenants herein contained and each with intent to be legally bound, for
themselves and respective successors and assigns, hereby agree as follows:

1.       SUBLEASE

         Landlord hereby subleases the Premises to Tenant and Tenant hereby
subleases the Premises from Landlord, on the terms and conditions contained in
this Sublease. Landlord shall deliver the Premises to Tenant on the Commencement
Date (as hereinafter defined) in "as is" condition, except Landlord shall be
entitled, prior to the Commencement Date, to remove any or all of its or its
subtenant's fixtures, equipment and other personal property located at the
Premises. Tenant represents that it has inspected the Premises and the Building
and has found the same in satisfactory condition and is not relying on any
representations or warranties of Landlord or Landlord's agents or employees with
respect to the condition thereof.

         If the Commencement Date shall occur, Tenant shall purchase Landlord's
personal property identified on Exhibit A, in its then



<PAGE>   2
                                      -2-


"as is" condition and pay $28,000 to Landlord on or before the earlier to occur
of December 31, 1999 or the expiration of the Letter of Credit as defined in
Section 5 hereof, and Landlord shall not remove such property from the Premises
and shall, upon request of Tenant, execute a bill of sale conveying to Tenant
all of Landlord's interest in such property, without representation or warranty
of any kind.

2.       TERM

         (a) The term of this Sublease shall commence on that date (the
"Commencement Date") which is the later to occur of March 1, 1998 and the date
on which Landlord shall deliver the Premises to Tenant in the condition required
by Section 1 hereof. Landlord agrees to use all reasonable efforts to deliver
possession of that portion of the Premises constituting approximately 5,000
rentable square feet and shown on Exhibit B promptly following the execution of
this Sublease. Tenant shall, commencing retroactively from January 1, 1998, pay
rent for such space monthly in advance (except for the payment for January 1998
which shall be made upon execution hereof) at the rate of $7,473.00 per month
(prorated for any portion of a month) and shall comply with all of the other
terms and conditions of this Sublease relating to such space from the date of
possession until the day prior to the Commencement Date, all as if the term
hereof had commenced, except that Section 4 and the first sentence of Section
3(a) hereof shall not be applicable, Tenant shall only be entitled to the
services provided by Prime Landlord to such space and Tenant shall be entitled
to park not more than twenty (20) cars in the parking lot of the Building.

         Landlord and Tenant agree that if, for any reason, the Commencement
Date shall not have occurred by the Target Date, Landlord shall use reasonable
efforts to deliver the Premises to Tenant as soon as reasonably practicable
thereafter. If, despite such reasonable efforts, the Commencement Date shall not
have occurred by March 31, 1998 (the "Drop Date"), Landlord and Tenant shall
each have the right to terminate this Sublease, by the giving of notice thereof
to the other, not later than thirty (30) days after the Drop Date; and this
Sublease shall terminate on the giving of such notice without further liability
or obligation on the part of either party. Such right of termination by Tenant
shall be Tenant's sole and exclusive remedy at law or in equity for Landlord's
failure to deliver the Premises to Tenant.

         (b) The term of this Sublease shall expire at the close of business on
June 30, 2002, unless sooner terminated pursuant to the provisions of this
Sublease, applicable law or as a result of



<PAGE>   3


                                      -3-


the termination of the Prime Lease (collectively, the "Expiration Date"). Tenant
shall have no option to extend the term of this Sublease for the period
described in Section 50.1 of the Prime Lease as the renewal term. Landlord shall
not elect to terminate the Prime Lease except if due to a default by Prime
Landlord or as permitted pursuant to Section 19 hereof.

3.       RENT

         (a) Commencing on the date (the "Rent Commencement Date") which is
three (3) months following the Commencement Date, Tenant shall pay Landlord
"Rent" in the amount of eight hundred fifteen thousand eight hundred and
fifty-six dollars ($815,856) per annum, payable in advance in equal monthly
installments of sixty-seven thousand nine hundred and eighty-eight ($67,988)
each, on the first day of each month during the term.

         (b) Tenant shall pay Rent and all other amounts due from Tenant to
Landlord pursuant to this Sublease (all such other amounts, collectively,
"Additional Rent"), at such place as Landlord may designate in writing, in
lawful money of the United States of America, without demand and without any
deduction, setoff or abatement. Landlord shall have the same rights and remedies
with respect to the nonpayment of Additional Rent as with respect to the
nonpayment of Rent. Absent specific provision to the contrary, all Additional
Rent shall be due and payable within ten (10) days after invoice by Landlord.

         (c) Landlord shall pay all Base Rent due under the Prime Lease during
the term of this Sublease.

4.       RENT ADJUSTMENT

         Tenant shall pay, as Additional Rent, all amounts due from Landlord
under Section 5 of the Prime Lease with respect to the term hereof.

5.       SECURITY DEPOSIT, LETTER OF CREDIT AND FINANCIAL STATEMENTS

         Upon execution of this Sublease, Tenant shall deposit with Landlord a
security deposit (the "Security Deposit") of $135,976. The Security Deposit
shall be held by Landlord as security for the faithful performance of all the
terms of this Sublease to be observed and performed by Tenant. The Security
Deposit shall not be mortgaged, assigned, transferred or encumbered by Tenant
and any such act on the part of Tenant shall be without force and effect and
shall not be binding upon Landlord.


<PAGE>   4


                                      -4-


         If the Rent or Additional Rent payable hereunder shall be overdue and
unpaid or should Landlord make any payment on behalf of the Tenant, or Tenant
shall fail to perform any of the terms of this Sublease, then Landlord may, at
its option, upon not less than five (5) business days notice to Tenant but
without prejudice to any other remedy which Landlord may have on account
thereof, appropriate and apply the entire Security Deposit or so much thereof as
may be necessary to compensate Landlord toward the payment of Rent, Additional
Rent or other sums or loss or damage sustained by Landlord due to such breach by
Tenant; and Tenant shall forthwith upon demand restore the Security Deposit to
the original sum deposited. So long as Tenant shall not be in default of its
obligations under this Sublease, Landlord shall return the Security Deposit, or
so much thereof as shall have not theretofore been applied in accordance with
the terms hereof, to Tenant promptly following the expiration or earlier
termination of the term of this Sublease and the surrender of possession of the
Premises by Tenant to Landlord in accordance with the terms of this Lease. While
Landlord holds the Security Deposit, Landlord shall have no obligation to pay
interest on the same and shall have the right to commingle the same with
Landlord's other funds.

         In addition, on or before the Commencement Date, Tenant shall deliver
to Landlord a letter of credit (the "Letter of Credit"), which shall (a) be
unconditional and irrevocable and otherwise in form and substance satisfactory
to Landlord; (b) be in the amount of $240,000, and shall permit multiple draws;
(c) be issued by a commercial bank reasonably acceptable to Landlord from time
to time; (d) be payable at sight upon presentment to a local branch of the
issuer of a simple sight draft accompanied by a certificate of Landlord stating
either that Tenant is in default under this Sublease or that Landlord is
otherwise permitted to draw upon such Letter of Credit under the express terms
of this Sublease, and the amount that Landlord is owed (or is permitted to draw)
in connection therewith; and (e) shall expire on the earliest to occur of the
date nine (9) months following the Commencement Date, the date Tenant's stock
shall be traded on a national securities exchange or the date Tenant shall
submit to Landlord an Annual Financial Statement as hereinafter defined showing
a tangible net worth of Tenant of at least $15,000,000. If Landlord shall draw
upon any such Letter of Credit as a result of the failure of Tenant to perform
any of its obligations under this Sublease (including, without limitation,
obligations under this Section 5), Tenant shall immediately deliver to Landlord
an additional Letter of Credit in the amount so drawn by Landlord, and otherwise
on terms identical to the Letter. The Letter of Credit shall be issued by a
commercial



<PAGE>   5


                                      -5-


bank that has a credit rating with respect to certificates of deposit, short
term deposits or commercial paper of at least P-2 (or equivalent) by Moody's
Investor Service, Inc., or at least A-2 (or equivalent) by Standard & Poor's
Corporation. If the issuer's credit rating is reduced below P-2 (or equivalent)
by Moody's Investor Service, Inc., or at least A-2 (or equivalent) by Standard &
Poor's Corporation, or if the financial condition of the issuer changes in any
other materially adverse way, then Landlord shall have the right to require that
Tenant obtain from a different issuer a substitute letter of credit that
complies in all respects with the requirements of this Section, and Tenant's
failure to obtain such substitute letter of credit within ten (10) business days
after Landlord's written demand therefor (with no other notice, or grace or cure
period being applicable thereto) shall entitle Landlord to immediately draw upon
the existing Letter of Credit in full, without any further notice to Tenant.

         Tenant shall, following request by Landlord, provide to Landlord,
within ninety (90) days after the end of each fiscal year of Tenant occurring
from the date hereof through the term of this Sublease, annual financial
statements for each prior fiscal year of Tenant accurately reflecting the
financial condition of Tenant, including, without limitation, balance sheets,
cash flow statements, statements of income and expenses, and statements of
changes in financial position, all prepared in accordance with generally
accepted accounting principles consistently applied and certified to Landlord by
a national independent certified public accountant (an "Annual Financial
Statement"). Notwithstanding the foregoing, if at any time Tenant is subject to
reporting obligations under Section 13 or 15d of the Securities Exchange Act of
1934, Tenant may satisfy its obligations hereunder by delivering to Landlord
copies of its annual and quarterly reports on Forms 10-K and 10-Q not later than
the time such reports are filed with the United States Securities Exchange
Commission.

6.       REPAIRS AND MAINTENANCE OF THE PREMISES

         Any repair and maintenance obligations with respect to the Premises
which are the responsibility of the Landlord, as tenant under the Prime Lease,
shall be performed by Tenant, at Tenant's sole cost and expense. Tenant shall
promptly notify Landlord of the need for any such repair, even though Landlord
shall not be responsible or liable therefor.


<PAGE>   6


                                      -6-


7.       ALTERATIONS

         Tenant shall not make any alterations, improvements or installations
(collectively, "Alterations") in or to the Premises without Landlord's prior
written consent. All alterations and improvements shall be subject to the terms
and conditions of the Prime Lease, and in those instances where applicable,
shall be subject to the Prime Landlord's approval as provided in the Prime
Lease. Any alterations, improvements or installations consented to by Landlord
shall be performed at the sole cost and expense of Tenant, by contractors
approved in advance by Landlord, but shall become the property of Landlord
(subject to the terms of the Prime Lease and the remainder of this Sublease).
Landlord may condition its approval to any Alterations on the removal of the
same, and restoration of any damage caused by installation and removal, on or
prior to the Expiration Date.

8.       ASSIGNMENT AND SUBLETTING

         Tenant shall not assign, mortgage, pledge, hypothecate, encumber or
otherwise transfer this Sublease (which term shall be deemed to include the
granting of concessions and licenses and the like) all or any part of the
Premises, or suffer or permit this Sublease or the leasehold estate hereby
created or any other rights arising under this Sublease to be assigned,
transferred, mortgaged, pledged, hypothecated or encumbered, in whole or in
part, whether voluntarily, involuntarily or by operation of law, or permit the
use or occupancy of the Premises by anyone other than Tenant, or the Premises to
be offered or advertised for assignment or subletting, without the prior written
consent of Landlord, which consent shall not be unreasonably withheld or
delayed.

         An assignment of this Sublease shall be deemed to include any transfer
of the stock or partnership or beneficial interests or other evidences of
ownership of Tenant or the issuance of additional stock or partnership or
beneficial interests or other indicia of ownership in Tenant or any transaction
pursuant to which Tenant is merged or consolidated with another entity or
pursuant to which all or substantially all of Tenant's assets are transferred to
any other entity; provided, however, that (A) no sale of stock of Tenant shall
be deemed an assignment so long as Tenant's stock is traded on a national
securities exchange, nor shall any initial public offering of Tenant's equity
securities pursuant to a registration statement under the Securities Act of 1933
be deemed an assignment and (B) neither (i) any transaction pursuant to which
Tenant is merged or consolidated with another entity or pursuant to which all or
substantially all of Tenant's assets are transferred nor (ii) the transfer of
Tenant's rights under this Sublease to any entity which controls, is controlled


<PAGE>   7


                                      -7-


by or is under common control with Tenant shall be deemed a prohibited
assignment of this Sublease, if (w) after any such transaction or transfer, the
successor to Tenant or the transferee of or successor to any of Tenant's rights
hereunder has a tangible net worth computed in accordance with generally
accepted accounting principles at least equal to the greater of (1) the net
worth of Tenant immediately prior to such merger, consolidation or transfer, or
(2) the net worth of Tenant herein named on the date of this Sublease, (x) proof
satisfactory to Landlord of such net worth shall have been delivered to Landlord
at least 10 days prior to the effective date of any such transaction, (y) proof
reasonably satisfactory to Landlord that the transferee of such right controls
or is controlled by or under common control with Tenant (or in the case of a
sale of assets, that substantially all of Tenant's assets have been sold to such
transferee) shall have been delivered to Landlord at least 10 days prior to the
effective date of any such transfer and (z) the assignee, transferee or
successor agrees directly with Landlord, by written instrument in form
satisfactory to Landlord, to be bound by all the terms of this Sublease
including, without limitation, the covenants contained in this Section 8. The
foregoing prohibitions and provisions shall also apply to the period (if any)
from the Date of this Sublease through the Commencement Date. The term "control"
shall mean the possession, directly or indirectly, of the power to direct or
cause the direction of the management or policies of any corporation or other
entity, or the disposition of such corporation's or other entity's assets or
properties, whether through the ownership of stock, equity or other ownership,
by contract, arrangement or understanding.

         If this Sublease is assigned or if the Premises or any part thereof are
sublet (or occupied by anybody other than Tenant and its employees) Landlord,
after default by Tenant hereunder, may collect the rents from such assignee,
subtenant or occupant, as the case may be, and apply the net amount collected to
the rent herein reserved, but no such collection shall be deemed a waiver of the
provisions set forth in the first paragraph of this Section 9, the acceptance by
Landlord of such assignee, subtenant or occupant, as the case may be, as a
tenant, or a release of Tenant from the future performance by Tenant of its
covenants, agreements or obligations contained in this Sublease.

         No subletting or assignment shall in any way impair the continuing
primary liability of Tenant hereunder, and no consent to any subletting or
assignment in a particular instance shall be deemed to be a waiver of the
obligation to obtain the Landlord's written approval in the case of any other
subletting or



<PAGE>   8


                                      -8-


assignment. No assignment, subletting or occupancy shall affect uses permitted
hereunder. Any subletting, assignment or other transfer of Tenant's interest in
this Lease in contravention of this Section shall be voidable at Landlord's
option.

         If the rent and other sums (including, without limitation, the
reasonable value of any services performed by any assignee or subtenant in
consideration of such assignment or sublease), either initially or over the term
of any assignment or sublease, payable by such assignee or subtenant on account
of an assignment of sublease of all or any portion of the Premises exceed the
sum of Rent plus Additional Rent called for hereunder with respect to the space
assigned or sublet, plus brokerage commissions, reasonable attorneys fees and
leasehold improvement costs relating to such assignment or sublease, Tenant
shall pay to Landlord as Additional Rent one hundred percent (100%) of such
excess payable monthly at the time for payment of Rent. Nothing in this
paragraph shall be deemed to abrogate the provisions of this Section and
Landlord's acceptance of any sums pursuant to this paragraph shall not be deemed
a granting of consent to any assignment of the Lease or sublease of all or any
portion of the Premises.

9.       INSURANCE

         Tenant shall comply with all of the requirements and obligations of
Landlord, as tenant, under the Prime Lease, set forth in Section 26(a) and (b)
of the Prime Lease.


<PAGE>   9


                                      -9-


10.      TENANT'S INDEMNITY

         Tenant shall save Landlord and Prime Landlord harmless, and shall
exonerate, defend and indemnify Landlord and Prime Landlord from and against any
and all claims, liabilities or penalties asserted by or on behalf of any person,
firm, corporation or public authority on account of injury, death, damage or
loss to person or property in or upon the Premises and the Building arising out
of the use or occupancy of the Premises by Tenant or by any person claiming by,
through or under Tenant (including, without limitation, all patrons, employees
and customers of Tenant), or arising out of any delivery to or service supplied
to the Premises, or on account of or based upon anything whatsoever done on or
occurring in the Premises or property adjacent to the Premises, except that
Landlord shall not be exonerated, indemnified or held harmless to the extent of
any damage caused by the negligence or willful misconduct of Landlord, its
agents, servants or employees. In respect of all of the foregoing, Tenant shall
indemnify Landlord and Prime Landlord from and against all costs, expenses
(including reasonable attorneys' fees), and liabilities incurred in or in
connection with any such claim, action or proceeding brought thereon; and, in
case of any action or proceeding brought against Landlord by reason of any such
claim, Tenant, upon notice from Landlord and at Tenant's expense, shall resist
or defend such action or proceeding and employ counsel therefor reasonably
satisfactory to Landlord.

11.      TENANT'S OBLIGATIONS UPON TERMINATION OF THIS SUBLEASE

         Tenant shall keep the Premises in good order and condition and, at the
expiration or sooner termination of this Sublease, shall surrender and deliver
up the same, broom clean and in good order and condition, except as otherwise
required by this Sublease and by the Prime Lease, ordinary wear and tear and
damage by fire and other casualty excepted (unless the same results from the act
of Tenant or its agents or employees). Tenant shall repair any damage to the
Premises or the Building caused by removal of any property by or on behalf of
Tenant. Any of Tenant's personal property, fixtures or equipment which shall
remain in the Premises after the expiration or sooner termination of this
Sublease shall be deemed conclusively to have been abandoned and either may be
retained by Landlord as its property or may be disposed of in such manner as
Landlord may see fit, at Tenant's sole cost and expense.

<PAGE>   10


                                      -10-


12.      BROKERS

         Tenant warrants and represents that it has dealt only with Julien J.
Studley, Inc. and Brannen/Goddard and with no other broker in connection with
this Sublease. Landlord shall be responsible for the commission or fee due or
owing to Julien J. Studley, Inc. and Brannen/Goddard arising out of this
Sublease, pursuant to a separate agreement. Tenant shall indemnify Landlord and
hold it harmless from and against any and all claims of any other broker
claiming to have dealt with Tenant relating to this Sublease.

13.      DEFAULTS

         Each of the following shall be a "Default of Tenant":

         (i)   Tenant shall fail to make any payment of Rent, Additional Rent or
any other payment Tenant is required to make when such payment is due and such
failure shall continue for five (5) business days after notice from Landlord to
Tenant.

         (ii)  Tenant shall fail to perform any other obligation of Tenant
pursuant to this Sublease (either directly or derivatively pursuant to
obligations arising under the Prime Lease) and such failure shall continue for
ten (10) business days after notice from Landlord; provided, if such failure
cannot be cured solely by the payment of money and more than ten (10) business
days are reasonably required for its cure, a Default of Tenant shall not be
deemed to have occurred if Tenant shall commence such cure within said ten (10)
business day period and thereafter diligently prosecute such cure to completion.

         (iii) Tenant shall (u) file a voluntary petition in bankruptcy or
insolvency, or (v) be adjudicated bankrupt or insolvent, or (w) take any action
seeking or consenting to or acquiescing in a reorganization arrangement,
composition, liquidation, dissolution, appointment of a trustee or receiver or
liquidator or similar relief under any federal or state bankruptcy or other law
or (x) make an assignment for the benefit of creditors, or (y) dissolve or
liquidate or adopt any plan or commence any proceeding, the result of which is
intended to include dissolution or liquidation, or (z) fail to discharge, within
thirty (30) days, any proceeding brought against Tenant seeking the relief
described in clause (w) above.

         (iv)   Tenant's leasehold interest shall be taken on execution.

<PAGE>   11

                                      -11-


         (v)    A lien or other involuntary encumbrance is filed against
Tenant's property, and is not discharged within ten (10) days thereafter.

         (vi)   A custodian or similar agent is authorized or appointed to take 
charge of all or substantially all of the assets of Tenant.

         (vii)  An order is entered in any proceeding by or against Tenant
decreeing or permitting the dissolution of Tenant or the winding up of its
affairs.

         (viii) A default of the kind set forth in clauses (i), (ii), or (iii)
above shall occur and if either (x) Tenant shall cure such default within the
applicable grace period or (y) Landlord shall, in its sole discretion, permit
Tenant to cure such default after the applicable grace period has expired, and
an event which would constitute a similar default if not cured within the
applicable grace period shall occur more than once within the next 365 days,
whether or not such event is cured within the applicable grace period.

14.      REMEDIES

         (a) In the event of a Default of Tenant, Landlord (by and through its
agents, if and as appropriate) shall have the power and right:

         (i)    To enforce any remedies generally available at law or in equity
                to a landlord on account of a default by a tenant.

         (ii)   To obtain injunctive relief against any continuing Default of
                Tenant.

         (iii)  To maintain this Sublease in effect and collect the Rent,
                Additional Rent and any other payments due from Tenant to
                Landlord.

         (iv)   In addition to and not in derogation of any remedies for any
                preceding breach of covenant, immediately or at any time
                thereafter without demand or notice and with or without process
                of law (forcibly, if necessary) to enter into and upon the
                Premises or any part thereof or mail a notice of termination
                addressed to Tenant, and repossess the same as of Landlord's
                former estate and expel Tenant and those claiming through or
                under Tenant
<PAGE>   12


                                      -12-


               and remove its and their effects (forcibly, if necessary) without
               being deemed guilty of any manner of trespass and without
               prejudice to any remedies which might otherwise be used for
               arrears of rent or prior breach of covenant, and upon such entry
               or mailing as aforesaid this Sublease shall terminate, Tenant
               hereby waiving all statutory rights to the Premises (including
               without limitation rights of redemption, if any, to the extent
               such rights may be lawfully waived) and Landlord, without notice
               to Tenant, may store Tenant's effects, and those of any person
               claiming through or under Tenant, at the expense and risk of
               Tenant, and, if Landlord so elects, may sell such effects at
               public auction or private sale and apply the net proceeds to the
               payment of all sums due to Landlord from Tenant, if any, and pay
               over the balance, if any, to Tenant.

         (b) In the event of any termination pursuant to Section 13, Tenant
shall pay the Rent, Additional Rent and other charges payable hereunder up to
the time of such termination, and thereafter Tenant, until the end of what would
have been the term of this Sublease in the absence of such termination, and
whether or not the Premises shall have been relet, shall be liable to Landlord
for, and shall pay to Landlord, as current damages, the Rent, Additional Rent
and other charges which would be payable hereunder for the remainder of the term
of this Sublease if such termination had not occurred, less the net proceeds, if
any, of any reletting of the Premises, after deducting all expenses in
connection with such reletting, including, without limitation, all repossession
costs, brokerage commissions, legal expenses, attorneys' fees, advertising,
expenses of employees, alteration costs and expenses of preparation for such
reletting. Tenant shall pay such current damages to Landlord monthly on the days
on which the Rent would have been payable hereunder if this Sublease had not
been terminated.

         At any time after such termination, whether or not Landlord shall have
collected any such current damages, as liquidated final damages and in lieu of
all such current damages beyond the date of such demand, at Landlord's election
Tenant shall pay to Landlord either (i) an amount equal to the excess, if any of
the Rent, Additional Rent and other charges as hereinbefore provided which would
be payable hereunder from the date of such demand (assuming that, for the
purposes of this paragraph, annual payments by Tenant on account of additional
rent due under Section 5 of the Prime Lease would be the same as payments

<PAGE>   13


                                      -13-


required for the immediately preceding twelve calendar months, or if lesser than
twelve calendar months have expired since the Commencement Date, the payments
required for such lesser period projected to an annual amount) for what would be
the then unexpired term of this Sublease if the same remained in effect, over
the then fair net rental value of the Premises for the same period or (ii) an
amount equal to the lesser of (x) the Rent, Additional Rent and other charges
that would have been payable for the balance of the term of this Sublease had it
not been terminated or (y) the aggregate of the Rent, Additional Rent and other
charges accrued in the twelve (12) months ended next prior to such termination
(without reduction for any abatement, free rent or other concession). In the
event this Sublease is so terminated prior to the expiration of the first full
year of the term of this Sublease, the liquidated damages which Landlord may
elect to recover pursuant to clause (ii) (y) of this paragraph shall be
calculated as if such termination had occurred on the first anniversary of the
Commencement Date. Nothing contained in this Sublease shall, however, limit or
prejudice the right of Landlord to prove for and obtain in proceedings for
bankruptcy or insolvency by reason of the termination of this Sublease, an
amount equal to the maximum allowed by any statute or rule of law in effect at
the time when, and governing the proceedings in which, the damages are to be
proved, whether or not the amount be greater than, equal to, or less than the
amount of the loss or damages referred to above.

         In case of any Default by Tenant, re-entry, expiration and
dispossession by summary proceedings or otherwise, Landlord may (i) relet the
Premises or any part or parts thereof, either in the name of Landlord or
otherwise, for a term or terms which may at Landlord's option be equal to or
less than or exceed the period which would otherwise have constituted the
balance of the term of this Sublease and may grant concessions or free rent to
the extent that Landlord considers advisable and necessary to relet the same and
(ii) may make such reasonable alterations, repairs and decorations in the
Premises as Landlord in its sole judgment considers advisable and necessary for
the purpose of reletting the Premises; and the making of such alterations,
repairs and decorations shall not operate or be construed to release Tenant from
liability hereunder as aforesaid. Landlord shall in no event be liable in any
way whatsoever for failure to relet the Premises, or, in the event that the
Premises are relet, for failure to collect the rent under such reletting despite
use of commercially reasonable efforts to obtain such rent.

         (c) To the fullest extent permitted by law, Tenant hereby expressly
waives any and all rights of redemption or of



<PAGE>   14


                                      -14-


limitation or exemption from liability or stays or other rights that contravene
the rights granted to Landlord hereunder or under any present of future laws in
the event of Tenant being evicted or dispossessed, or in the event of Landlord
obtaining possession of the Premises by reason of the violation by Tenant of any
of the covenants and conditions of this Sublease. Any and all rights and
remedies which Landlord may have under this Sublease, and at law and equity
(including without limitation) actions at law for direct, indirect, special and
consequential (foreseeable and unforeseeable) damages, for Tenant's failure to
comply with its obligations under the Sublease shall be cumulative and shall not
be deemed inconsistent with each other, and any two or more of all such rights
and remedies may be exercised at the same time insofar as permitted by law.

         (d) At any time with or without notice, Landlord shall have the right,
but shall not be required, to pay such sums or do any act which requires the
expenditure of monies which may be necessary or appropriate by reason of the
failure or neglect of Tenant to comply with any of its obligations under this
Sublease (irrespective of whether the same shall have ripened into a Default of
Tenant), and in the event of the exercise of such right by Landlord, Tenant
agrees to pay to Landlord forthwith upon demand, as Additional Rent, all such
sums including reasonable attorneys fees, together with interest thereon at a
rate equal to the lesser of 5% over the so-called prime or base rate in effect
from time to time at BankBoston, N.A. (or if such bank ceases to exist, the
largest bank in Boston) or the maximum rate allowed by law.

         (e) The failure of Landlord to seek redress for violation of, or to
insist upon the strict performance of, any covenant or condition of this
Sublease shall not be deemed a waiver of such violation nor prevent a subsequent
act, which would have originally constituted a violation, from having all the
force and effect on an original violation. The receipt by Landlord of rent with
knowledge of the breach of any covenant of this Sublease shall not be deemed to
have been a waiver of such breach by Landlord unless such waiver be in writing
signed by the party to be charged. No consent or waiver, express or implied, by
Landlord to or of any breach of any agreement or duty shall be construed as a
waiver or consent to or of any other breach of the same or any other agreement
or duty.

         (f) No acceptance by Landlord of a lesser sum than the Rent, Additional
Rent or any other charge then due shall be deemed to be other than on account of
the earliest installment of such rent or charge due, nor shall any endorsement
or statement


<PAGE>   15


                                      -15-


on any check or any letter accompanying any check or payment as rent or other
charge be deemed an accord and satisfaction, and Landlord may accept such check
or payment without prejudice to Landlord's right to recover the balance of such
installment or pursue any other remedy in this Sublease provided.

15.      SUBORDINATION TO THE PRIME LEASE

         In addition to Tenant's obligations under this Sublease and to the
extent not inconsistent with this Sublease, Tenant shall observe and perform all
of the terms, covenants and conditions of the Prime Lease which Landlord, as
tenant under the Prime Lease, is obligated to observe and perform to the same
extent as if such terms, covenant and conditions of the Prime Lease were set
forth at length in this Sublease but incorporating such provisions herein shall
not obligate Landlord or be construed as causing Landlord to assume or agree to
perform any obligations assumed by the Prime Landlord under the Prime Lease.
Tenant shall defend, indemnify and hold Landlord harmless from and against any
and all claims, suits, liabilities, costs and expenses (including reasonable
attorneys' fees) asserted against or sustained by Landlord under the Prime Lease
with respect to the Premises. Tenant shall not do, omit to do or permit to be
done or omitted any act in or related to the Premises which could constitute a
breach or default under the terms of the Prime Lease or result in the
termination of the Prime Lease by the Prime Landlord.

16.      CONSENT OR APPROVAL OF PRIME LANDLORD

         If the consent or approval of the Prime Landlord is required under the
Prime Lease with respect to any matter relating to the Premises, it shall also
be required hereunder. Tenant shall be required first to obtain the consent or
approval of Landlord with respect thereto and, if Landlord grants such consent
or approval, such consent may be conditioned upon receipt of consent or approval
from the Prime Landlord, but Landlord shall not be responsible for obtaining
such consent or approval. Tenant shall reimburse Landlord, as Additional Rent,
promptly on demand, for all reasonable legal, engineering and other professional
services expenses incurred by Landlord in connection with any request by Tenant
for consent or approval hereunder from and after the date of this Sublease.

17.      LIMITATIONS ON LANDLORD'S LIABILITY

         Tenant acknowledges that Landlord has made no representations or
warranties with respect to the Building or the Premises except as provided in
this Sublease.


<PAGE>   16


                                      -16-


         In no event shall Landlord be liable to Tenant for any loss of business
or any other special, indirect or consequential damages irrespective of cause.

18.      UTILITIES AND SERVICES

         Landlord shall not be required to perform any of the covenants and
obligations of the Prime Landlord under the Prime Lease and, insofar as any of
the obligations of the Landlord hereunder are required to be performed under the
Prime Lease by the Prime Landlord, Tenant shall rely on and look solely to the
Prime Landlord for the performance thereof. If the Prime Landlord shall default
in the performance of any of its obligations under the Prime Lease or breach any
provision of the Prime Lease pertaining to the Premises, such default shall not
constitute an actual or constructive eviction nor result in any offset,
abatement or deduction against the Rent, Additional Rent or other charges due
under this Sublease, but Tenant may, at its expense, and upon prior notice to
Landlord, make any demand or institute any action or proceeding permitted by the
Prime Lease, against Prime Landlord for enforcement of Prime Landlord's
obligation under the Prime Lease, so long as any such demand, action or
proceeding shall not prejudice Landlord's rights or increase Landlord's
liability under the Prime Lease.

         To the extent that the Prime Landlord charges Landlord for any
additional service provided to the Premises beyond that required to be supplied
by the Prime Lease without charge (i.e. additional cleaning, after hours "HVAC",
etc.), Tenant shall pay such charge, as Additional Rent, within ten (10) days
after demand therefor.

19.      FIRE, CASUALTY AND EMINENT DOMAIN, ETC.

         In the event of a fire, casualty, taking or any interruption of
services that affects the Premises but does not result in termination of the
Prime Lease, the Rent hereunder shall be abated in the same percentage as the
rent payable by Landlord under the Prime Lease shall be abated. The provisions
of this Section 20 shall be considered an express agreement governing any cause
of damage or destruction to the Premises by fire or other casualty, and no local
or state statute, law, rule or regulation, now or hereafter in effect, providing
for such a contingency shall have any application in such case, to the extent
permitted by law.


<PAGE>   17


                                      -17-


         Irrespective of the form in which recovery may be had by law, as
between Landlord and Tenant, all rights to damages or compensation for any
taking affecting the Premises shall belong to Landlord in all cases. Tenant
hereby grants to Landlord all of Tenant's rights to such damages and covenants
to deliver such further assignments thereof as Landlord may from time to time
request. Nothing contained herein shall be construed to prevent Tenant from
prosecuting in any condemnation proceedings a claim for the value of any of
Tenant's personal property and business machines and equipment installed in the
Premises by Tenant at Tenant's expense and for relocation expenses, provided
that such action shall not affect the amount of compensation otherwise
recoverable by Landlord from the taking authority.

         Tenant agrees that Landlord may elect to terminate the Prime Lease if
it shall be entitled to do so due to a fire or other casualty or a taking by
eminent domain or condemnation; and that if the Prime Lease shall be terminated
for such or any other reason prior to the scheduled Expiration Date (other than
due to a default in the payment of rent under the Prime Lease), this Sublease
shall terminate as of the date of the termination of the Prime Lease and
Landlord shall have no liability to Tenant due or arising directly or indirectly
out of such early termination.

20.      LANDLORD ACCESS

         Landlord and Landlord's agents and employees shall have the right to
enter onto the Premises at reasonable times, from time to time, upon reasonable
notice to Tenant (which notice may be oral and shall not be required in the
event of emergency) to ascertain whether Tenant is in compliance with the
provisions of this Sublease, to make such repairs as Landlord deems necessary,
to comply with Landlord's obligations hereunder or under the Prime Lease, to
perform work with respect to the remainder of the Prime Lease Premises and
(within the last year of the term) to exhibit the Premises.

21.      NO ESTATE IN LAND

         This Sublease shall create the relationship of Landlord and Tenant; no
estate shall pass out of Landlord. Tenant shall only have a usufruct, not
subject to levy and sale and not assignable by Tenant except as expressly
provided in Section 8. Tenant hereby waives all homestead rights and exemptions
to which it might otherwise be entitled.


<PAGE>   18


                                      -18-


22.      INTEREST ON UNPAID RENT

         All installments of Rent, Additional Rent and all other charges which
are not paid within five (5) days after the date when due shall bear interest
from the date due until paid, at a rate equivalent to the so-called prime or
base rate in effect from time to time at BankBoston, N.A. (or if such bank
ceases to exist, the largest bank in Boston) plus five percent, or such lesser
amount as allowed by law.

23.      HOLDOVER

         If Tenant holds possession of the Premises after the expiration or
sooner termination of this Sublease, Tenant shall become a tenant at sufferance
on a day-to-day basis upon the terms specified herein at 200% of the then
existing Rent, Additional Rent and other charges. In addition, Tenant shall be
responsible for any and all damages suffered by Landlord, including, without
limitation, damages or costs resulting from actions initiated by third parties
(including the Prime Landlord) as a result of said holding over. Such tenancy
shall not constitute a renewal of this Sublease.

24.      ESTOPPEL CERTIFICATES

         Either party hereto (the "requested party") agrees that, from time to
time, upon not less than five (5) business days prior notice by the other party
(the "requesting party"), the requested party or its duly authorized
representative having knowledge of the following facts shall deliver to the
requesting party, or to such person or persons as the requesting party may
designate, a statement in writing certifying (a) that this Sublease is
unmodified and in full force and effect (or if there have been modifications,
that the Sublease as modified is in full force and effect); (b) the date to
which the Rent, Additional Rent and other charges have been paid; (c) that to
the best of the requested party's knowledge, the requesting party is not in
default under any provision of this Sublease or if in default, the nature
thereof in detail; (d) the commencement and expiration of this Sublease, and (e)
any other information required by the requesting party.

<PAGE>   19


                                      -19-


25.      NOTICES

         Any notice, statement, certificate, consent, approval, disapproval,
request or demand required or permitted to be given in this Sublease shall be in
writing and sent by United States mail, registered or certified, postage
prepaid, addressed, as the case may be:

         To Landlord at the following addresses:

         Prior to the Commencement Date:
                  200 Embassy Row
                  Suite 500
                  Atlanta, GA  30339
                  Attn: John Branan, General Manager

         After the Commencement Date:

                  NA Carbon Black Division
                  1095 Windward Ridge Parkway
                  Suite 200
                  Alpharetta, GA  30005

         in either case with a copy to:

                  Cabot Corporation
                  75 State Street
                  Boston, MA  02109
                  Attention:  General Counsel

         and to Tenant at the following addresses:

         Prior to the Commencement Date:
                  41 Perimeter Center East
                  Suite 660
                  Atlanta, GA  30346
                  Attn:  Jon Ver Steeg

         After the Commencement Date:
                  300 Embassy Row
                  Suite 500
                  Atlanta, GA  30339
                  Attn:  Jon Ver Steeg

         Either party by notice to the other may change or add persons and
places where notices are to be sent or delivered. In no event shall notice have
to be sent on behalf of either party to more than two (2) persons. Mailed
notices will be deemed


<PAGE>   20


                                      -20-


served three (3) business days after mailing certified or registered mail
properly addressed with postage prepaid, provided the same are received in the
ordinary course of business.

26.      LANDLORD'S AND TENANT'S POWER TO EXECUTE

         Landlord and Tenant covenant, warrant and represent that they have full
power and proper authority to execute this Sublease.

27.      ENTIRE AGREEMENT

         This Sublease contains the entire agreement between Landlord and Tenant
and can be changed only by a signed agreement.

28.      CONSENT TO SUBLEASE BY PRIME LANDLORD

         This Sublease shall not become operative until and unless the Prime
Landlord has given to Landlord its consent hereto in a form reasonably
satisfactory to Landlord and Tenant. Landlord shall not be responsible for the
failure of Prime Landlord to consent to this Sublease. Should Prime Landlord
fail to consent to this Sublease in a form reasonably satisfactory to Landlord
and Tenant within ten (10) business days of the date hereof, Landlord and Tenant
shall be released from all obligations with respect hereto and neither shall
have any further rights in law or in equity with respect to this Sublease.

29.      BINDING EFFECT

         The submission of this document for examination and negotiation does
not constitute an offer to sublease or a reservation of, or option for, the
Premises and Tenant shall have no right to the Premises hereunder until the
execution hereof by both Landlord and Tenant. Once fully executed, all the
covenants, agreements and undertakings in this Sublease contained shall extend
to and be binding upon the legal representatives, successors and assigns of the
respective parties hereto, the same as if they were in every case named and
expressed, but nothing herein shall be construed as a consent by Landlord to any
assignment or subletting by Tenant of any interest of Tenant in this Sublease.


<PAGE>   21


                                      -21-


30.      MISCELLANEOUS

         If any provisions of this Sublease shall to any extent be invalid, the
remainder of this Sublease shall not be affected thereby. There are no oral or
written agreements between Landlord and Tenant affecting this Sublease. This
Sublease may be amended, and the provisions hereof may be waived or modified,
only by instruments in writing executed by Landlord and Tenant. The titles of
the several Sections contained herein are for convenience only and shall not be
considered in construing this Sublease. Except as herein otherwise provided, the
terms hereof shall be binding upon and shall inure to the benefit of the
successors and assigns, respectively, of Landlord and Tenant and, if Tenant
shall be an individual, upon and to his heirs, executors, administrators,
successors and assigns. If two or more persons are named as Tenant herein, each
of such persons shall be jointly and severally liable for the obligations of the
Tenant hereunder, and Landlord may proceed against any one without first having
commenced proceedings against any other of them. Each term and each provision of
this Sublease to be performed by Tenant shall be construed to be both an
independent covenant and a condition. The reference contained to successors and
assigns of Tenant is not intended to constitute a consent to assignment of
Tenant. Except as otherwise set forth in this Sublease, any obligations of
Tenant (including, without limitation, rental and other monetary obligations,
repair obligations and obligations to indemnify Landlord), shall survive the
expiration or sooner termination of this Sublease, and Tenant shall immediately
reimburse Landlord for any expense incurred by Landlord in curing Tenant's
failure to satisfy any such obligation (notwithstanding the fact that such cure
might be effected by Landlord following the expiration or earlier termination of
this Sublease).

         IN WITNESS WHEREOF, Landlord and Tenant have each caused these presents
to be executed, as a sealed instrument, as of the date first above written.


                                    LANDLORD:

                                    CABOT CORPORATION


ATTEST:                             By:
        --------------------------      ----------------------------------

                                    By:
                                        ----------------------------------

<PAGE>   22


                                      -22-


                                    TENANT:

                                    INTERNET SECURITY SYSTEMS, INC.


ATTEST:                             By:
        --------------------------      ----------------------------------

                                    By:
                                        ----------------------------------

<PAGE>   1
                                                                    EXHIBIT 10.8


                            INDEMNIFICATION AGREEMENT

                 THIS AGREEMENT is made and entered into this ______________
day of ___________, 1998 between ISS Group, Inc., a Delaware corporation
("Corporation"), and __________________ ("Director" or "Officer").

                                   RECITALS:

                 A.       Director, a member of the Board of Directors of
Corporation, performs a valuable service in such capacity for Corporation
[Officer is the Corporation's ____________________ and in such capacity
performs a valuable serive for Corporation]; and

                 B.       The stockholders of Corporation have adopted By-laws
(the "By-laws") providing for the indemnification of the officers, directors,
agents and employees of Corporation to the maximum extent authorized by Section
145 of the Delaware Corporations Code, as amended ("Code"); and

                 C.       The By-laws and the Code, by their non-exclusive
nature, permit contracts between Corporation and the members of its Board of
Directors and officers with respect to indemnification of such directors; and

                 D.       In accordance with the authorization as provided by
the Code, Corporation has purchased and presently maintains a policy or
policies of Directors and Officers Liability Insurance ("D & 0 Insurance"),
covering certain liabilities which may be incurred by its directors and
officers in the performance of their duties as directors or officers of
Corporation; and

                 E.       As a result of developments affecting the terms,
scope and availability of D & 0 Insurance there exists general uncertainty as
to the extent of protection afforded members of the Board of Directors and
officers of the Corporation by such D & O Insurance and by statutory and by-law
indemnification provisions; and

                 F.       In order to induce Director to continue to serve as a
member of the Board of Directors of Corporation [officer to continue to serve
the Corporation], Corporation has determined and agreed to enter into this
contract with Director/Officer;

                 NOW, THEREFORE, in consideration of Director's/Officer's
continued service as a director [officer's continued service] after the date 
hereof, the parties hereto agree as follows:

                 1.       INDEMNITY OF DIRECTOR.  Corporation hereby agrees to
hold harmless and indemnify Director/Officer to the fullest extent authorized
or permitted by the provisions of the Code, as may be amended from time to
time.

                 2.       ADDITIONAL INDEMNITY. Subject only to the exclusions
set forth in Section 3 hereof, Corporation hereby further agrees to hold
harmless and indemnify Director/Officer:
<PAGE>   2


                          a.      against any and all expenses (including
attorneys' fees), witness fees, judgments, fines and amounts paid in settlement
actually and reasonably incurred by Director/Officer in connection with any
threatened, pending or completed action, suit or proceeding, whether civil,
criminal, administrative or investigative (including an action by or in the
right of Corporation) to which Director/Officer is, was or at any time becomes
a party, or is threatened to be made a party, by reason of the fact that
Director/Officer is, was or at any time becomes a director, officer, employee
or agent of Corporation, or is or was serving or at any time serves at the
request of Corporation as a director, officer, employee or agent of another
corporation, partnership, joint venture, trust, employee benefit plan or other
enterprise; and

                          b.      otherwise to the fullest extent as may be
provided to Director/Officer by Corporation under the non-exclusivity
provisions of Article XI of the By-laws of Corporation and the Code.

                 3.       LIMITATIONS ON ADDITIONAL INDEMNITY.  No indemnity
pursuant to Section 2 hereof shall be paid by Corporation:

                          a.      except to the extent the aggregate of losses
to be indemnified thereunder exceeds the sum of such losses for which the
Director/Officer is indemnified pursuant to Section I hereof or pursuant to any
D & 0 Insurance purchased and maintained by Corporation;

                          b.      in respect to remuneration paid to
Director/Officer if it shall be determined by a final judgment or other final
adjudication that such remuneration was in violation of law;

                          c.      on account of any suit in which judgment is
rendered against Director/Officer for an accounting of profits made from the
purchase or sale by Director/Officer of securities of Corporation pursuant to
the provisions of Section 16(b) of the Securities Exchange Act of 1934 and
amendments thereto or similar provisions of any federal, state or local
statutory law,

                          d.      on account of Director's/Officer's conduct
which is finally adjudged to have been knowingly fraudulent or deliberately
dishonest, or to constitute willful misconduct;

                          e.      on account of Director's/Officer's conduct
which is the subject of an action, suit or proceeding described in Section
7(c)(ii) hereof;

                          f.      on account of any action, claim or proceeding
(other than a proceeding referred to in Section 8(b) hereof) initiated by the
Director/Officer unless such action, claim or proceeding was authorized in the
specific case by action of the Board of Directors;

                          g.      if a final decision by a Court having
jurisdiction in the matter shall determine that such indemnification is not
lawful (and, in this respect, both Corporation and Director/Officer have been
advised that the Securities and Exchange Commission believes that
indemnification for liabilities arising under the federal securities laws is
against public policy and
<PAGE>   3

is, therefore, unenforceable and that claims for indemnification should be
submitted to appropriate courts for adjudication).

                 4.       CONTRIBUTION.  If the indemnification provided in
Sections 1 and 2 hereof is unavailable by reason of a Court decision
described in Section 3(g) hereof based on grounds other than any of those set
forth in paragraphs (b) through (f) of Section 3 hereof, then in respect of any
threatened, pending or completed action, suit or proceeding in which
Corporation is jointly liable with Director/Officer (or would be if joined in
such action, suit or proceeding), Corporation shall contribute to the amount of
expenses (including attorneys' fees), judgments, fines and amounts paid in
settlement actually and reasonably incurred and paid or payable by
Director/Officer in such proportion as is appropriate to reflect (i) the
relative benefits received by Corporation on the one hand and Director/Officer
on the other hand from the transaction from which such action, suit or
proceeding arose, and (ii) the relative fault of Corporation on the one hand
and of Director/Officer on the other in connection with the events which
resulted in such expenses, judgments, fines or settlement amounts, as well as
any other relevant equitable considerations.  The relative fault of Corporation
on the one hand and of Director/Officer on the other shall be determined by
reference to, among other things, the parties' relative intent, knowledge,
access to information and opportunity to correct or prevent the circumstances
resulting in such expenses, judgments, fines or settlement amounts.
Corporation agrees that it would not be just and equitable if contribution
pursuant to this Section 4 were determined by pro rata allocation or any other
method of allocation which does not take account of the foregoing equitable
considerations.

                 5.       CONTINUATION OF OBLIGATIONS.  All agreements and
obligations of Corporation contained herein shall continue during the period
Director/Officer is a director, officer, employee or agent of Corporation (or
is or was serving at the request of Corporation as a director, officer,
employee or agent of another corporation, partnership, joint venture, trust,
employee benefit plan or other enterprise) and shall continue thereafter so
long as Director/Officer shall be subject to any possible claim or threatened,
pending or completed action, suit or proceeding, whether civil, criminal or
investigative, by reason of the fact that Director/Officer was a director of
Corporation or serving in any other capacity referred to herein.

                 6.       NOTIFICATION AND DEFENSE OF CLAIM.  Not later than
thirty (30) days after receipt by Director/Officer of notice of the
commencement of any action, suit or proceeding, Director/Officer will, if a
claim in respect thereof is to be made against Corporation under this
Agreement, notify Corporation of the commencement thereof; but the omission so
to notify Corporation will not relieve it from any liability which it may have
to Director/Officer otherwise than under this Agreement.  With respect to any
such action, suit or proceeding as to which Director/Officer notifies
Corporation of the commencement thereof;

                          a.      Corporation will be entitled to participate 
therein at its own expense;

                          b.      except as otherwise provided below, to the
extent that it may wish, Corporation jointly with any other indemnifying party
similarly notified will be entitled to assume the defense thereof, with counsel
reasonably satisfactory to Director/Officer.  After notice from
<PAGE>   4

Corporation to Director/Officer of its election so as to assume the defense
thereof, Corporation will not be liable to Director/Officer under this
Agreement for any legal or other expenses subsequently incurred by
Director/Officer in connection with the defense thereof other than reasonable
costs of investigation or as otherwise provided below.  Director/Officer shall
have the right to employ its counsel in such action, suit or proceeding but the
fees and expenses of such counsel incurred after notice from Corporation of its
assumption of the defense thereof shall be at the expense of Director/Officer
unless (i) the employment of counsel by Director/Officer has been authorized by
Corporation, (ii) Director/Officer shall have reasonably concluded that there
may be a conflict of interest between Corporation and Director/Officer in the
conduct of the defense of such action or (iii) Corporation shall not in fact
have employed counsel to assume the defense of such action, in each of which
cases the fees and expenses of Director's/Officer's separate counsel shall be
at the expense of Corporation.  Corporation shall not be entitled to assume the
defense of any action, suit or proceeding brought by or on behalf of
Corporation or as to which Director/Officer shall have made the conclusion
provided for in (ii) above; and

                          c.      Corporation shall not be liable to indemnify
Director/Officer under this Agreement for any amounts paid in settlement of any
action or claim effected without its written consent.  Corporation shall be
permitted to settle any action except that it shall not settle any action or
claim in any manner which would impose any penalty or limitation on
Director/Officer without Director's/Officer's written consent.  Neither
Corporation nor Director/Officer will unreasonably withhold its consent to any
proposed settlement.

                 7.       ADVANCEMENT AND REPAYMENT OF EXPENSES.

                          a.      In the event that Director/Officer employs
his/her own counsel pursuant to Section 6(b)(i) through (iii) above,
Corporation shall advance to Director/Officer, prior to any final disposition
of any threatened or pending action, suit or proceeding, whether civil,
criminal, administrative or investigative, any and all reasonable expenses
(including legal fees and expenses) incurred in investigating or defending any
such action, suit or proceeding within ten (10) days after receiving copies of
invoices presented to Director/Officer for such expenses.

                          b.      Director/Officer agrees that Director/Officer
will reimburse Corporation for all reasonable expenses paid by Corporation in
defending any civil or criminal action, suit or proceeding against
Director/Officer in the event and only to the extent it shall be ultimately
determined by a final judicial decision (from which there is no right of
appeal) that Director/Officer is not entitled, under the provisions of the
Code, the By-laws, this Agreement or otherwise, to be indemnified by
Corporation for such expenses.

                          c.      Notwithstanding the foregoing, Corporation
shall not be required to advance such expenses to Director/Officer if
Director/Officer (i) commences any action, suit or proceeding as a plaintiff
unless such advance is specifically approved by a majority of the Board of
Directors or (ii) is a party to an action, suit or proceeding brought by
Corporation and approved by a majority of the Board which alleges willful
misappropriation of corporate assets by Director/Officer, disclosure of
confidential information in violation of Director's/Officer's
<PAGE>   5

fiduciary or contractual obligations to Corporation, or any other willful and
deliberate breach in bad faith of Director's/Officer's duty to Corporation or
its shareholders.

                 8.       ENFORCEMENT.

                          a.      Corporation expressly confirms and agrees
that it has entered into this Agreement and assumed the obligations imposed on
Corporation hereby in order to induce Director/Officer to continue as a
director of Corporation, and acknowledges that Director/Officer is relying upon
this Agreement in continuing in such capacity.

                          b.      In the event Director/Officer is required to
bring any action to enforce rights or to collect moneys due under this
Agreement and is successful in such action, the Corporation shall reimburse
Director/Officer for all Director's/Officer's reasonable fees and expenses in
bringing and pursuing such action.

                 9.       SUBROGATION.  In the event of payment under this
agreement, Corporation shall be subrogated to the extent of such payment to all
of the rights of recovery of Director/Officer, who shall execute all documents
required and shall do all acts that may be necessary to secure such rights and
to enable Corporation effectively to bring suit to enforce such rights.

                 10.      NON-EXCLUSIVITY OF RIGHTS.  The rights conferred on
Director/Officer by this Agreement shall not be exclusive of any other right
which Director/Officer may have or hereafter acquire under any statute,
provision of Corporation's Certificate of Incorporation or By-laws, agreement,
vote of stockholders or directors, or otherwise, both as to action in his
official capacity and as to action in another capacity while holding office.

                 11.      SURVIVAL OF RIGHTS.  The rights conferred on
Director/Officer by this Agreement shall continue after Director/Officer has
ceased to be a director, officer, employee or other agent of Corporation and
shall inure to the benefit of Director's/Officer'sheirs, executors and
administrators.

                 12.      SEPARABILITY.  Each of the provisions of this
Agreement is a separate and distinct agreement and independent of the others,
so that if any or all of the provisions hereof shall be held to be invalid or
unenforceable for any reason, such invalidity or unenforceability shall not
affect the validity or enforceability of the other provisions hereof or the
obligation of the Corporation to indemnify the Director/Officer to the full
extent provided by the By-laws or the Code.

                 13.      GOVERNING LAW. This Agreement shall be interpreted
and enforced in accordance with the laws of the State of Delaware.

                 14.      BINDING EFFECT.  This Agreement shall be binding upon
Director/Officer and upon Corporation, its successors and assigns, and shall
inure to the benefit of
<PAGE>   6

Director/Officer, his/her heirs, personal representatives and assigns and to
the benefit of Corporation, its successors and assigns.

                 15.      AMENDMENT AND TERMINATION.  No amendment,
modification, termination or cancellation of this Agreement shall be effective
unless in writing signed by both parties hereto.

                 IN WITNESS WHEREOF, the parties hereto have executed this
Agreement on and as of the day and year first above written.

                                                   ISS GROUP, INC.
                                                   a Delaware corporation



                                                   By:                         
                                                       ------------------------

                                                   Print Name:                 
                                                               ----------------

                                                   Title:                      
                                                          ---------------------



                                                                               
                                                   ----------------------------
                                                   Director/Officer
                                                                   

<PAGE>   1
                                                                   EXHIBIT 10.9









                         INTERNET SECURITY SYSTEMS, INC.



                   SERIES B PREFERRED STOCK PURCHASE AGREEMENT



                                February 14, 1997






<PAGE>   2



                                TABLE OF CONTENTS

<TABLE>
<CAPTION>
                                                                                 PAGE
                                                                                 ----
<S>      <C>                                                                     <C>
1.       Purchase and Sale of Preferred Stock..................................   -1-
         1.1      Sale and Issuance of Series B Preferred Stock................   -1-
         1.2      Closing......................................................   -1-

2.       Representations and Warranties of the Company.........................   -1-
         2.1      Organization Good Standing and Qualification.................   -2-
         2.2      Capitalization...............................................   -2-
         2.3      Subsidiaries.................................................   -3-
         2.4      Authorization................................................   -3-
         2.5      Governmental Consents........................................   -3-
         2.6      Permits......................................................   -4-
         2.7      Litigation...................................................   -4-
         2.8      Proprietary Information and Inventions Agreement.............   -4-
         2.9      Patents and Other Intangible Assets..........................   -4-
         2.10     Manufacturing and Marketing Rights...........................   -5-
         2.11     Compliance with Other Instruments............................   -5-
         2.12     Agreements, Action...........................................   -5-
         2.13     Brokers or Finders; Other Offers.............................   -6-
         2.14     Disclosure...................................................   -6-
         2.15     No Conflict of Interest......................................   -7-
         2.16     Rights of Registration.......................................   -7-
         2.17     Private Placement............................................   -7-
         2.18     Corporate Documents..........................................   -7-
         2.19     Title to Property and Assets.................................   -7-
         2.20     Financial Statements.........................................   -8-
         2.21     Changes......................................................   -8-
         2.22     Employee Benefit Plans.......................................   -9-
         2.23     Tax Returns and Payments.....................................   -9-
         2.24     Insurance....................................................   -9-
         2.25     Labor Agreements and Actions.................................   -9-
         2.26     Environmental and Safety Laws................................  -10-
         2.27     Minute Books.................................................  -10-
         2.28     Section 1202 of the Internal Revenue Code....................  -10-
         2.29     Use of Proceeds..............................................  -11-

3.       Representations and Warranties of the Purchasers......................  -11-
         3.1      Authorization................................................  -11-
         3.2      Purchase Entirely for Own Account............................  -12-
         3.3      Disclosure of Information....................................  -12-
         3.4      Investment Experience........................................  -12-
</TABLE>

                                       -i-

<PAGE>   3


                                TABLE OF CONTENTS
                                   (CONTINUED)

<TABLE>
<CAPTION>
                                                                                                  PAGE
                                                                                                  ----
<S>      <C>      <C>                                                                             <C>
         3.5      Restricted Securities.........................................................  -12-
         3.6      No Public Market..............................................................  -13-
         3.7      Further Limitations on Disposition............................................  -13-
         3.8      Legends.......................................................................  -13-
         3.9      Accredited Investor...........................................................  -14-
         3.10     Brokers or Finders............................................................  -14-

         4.       Representations and Warranties of the Founders.

         4.1      Litigation....................................................................  -14-
         4.2      Capitalization................................................................  -15-
         4.3      Patents and Other Intangible Assets...........................................  -15-

5.       Conditions of the Purchasers' Obligations at Closing...................................  -16-
         5.1      Representations and Warranties................................................  -16-
         5.2      Performance...................................................................  -16-
         5.3      Compliance Certificate........................................................  -16-
         5.4      Qualifications................................................................  -16-
         5.5      Proceedings and Documents.....................................................  -16-
         5.6      Opinion of Company Counsel....................................................  -17-
         5.7      Rights Agreement..............................................................  -17-
         5.8      Right of First Refusal and Co-Sale Agreement..................................  -17-
         5.9      Letter Agreement Relating to Sale of Stock in the Event Directed Shares
                  are Offered...................................................................  -17-
         5.10     Agreement Regarding Acceleration of  Vesting of Future Optionees..............  -17-
         5.11     Voting Agreement..............................................................  -17-

6.       Conditions of the Company's Obligations at Closing.....................................  -17-
         6.1      Representations and Warranties................................................  -17-
         6.2      Qualifications................................................................  -17-
         6.3      Covenants.....................................................................  -18-

7.       Right of First Offer...................................................................  -18-

8.       Miscellaneous..........................................................................  -19-
         8.1      Survival of Warranties........................................................  -19-
         8.2      Transfer; Successors and Assigns..............................................  -19-
         8.3      Governing Law.................................................................  -20-
         8.4      Counterparts..................................................................  -20-
         8.5      Titles and Subtitles..........................................................  -20-
</TABLE>

                                      -ii-

<PAGE>   4


                                TABLE OF CONTENTS
                                   (CONTINUED)

<TABLE>
<CAPTION>
                                                              PAGE
                                                              ----
         <S>      <C>                                         <C>
         8.6      Notices...................................  -20-
         8.7      Finder's Fee..............................  -20-
         8.8      Expenses..................................  -21-
         8.9      Attorneys' Fees...........................  -21-
         8.10     Amendments and Waivers....................  -21-
         8.11     Severability..............................  -21-
         8.12     Delays or Omissions.......................  -21-
         8.13     Entire Agreement..........................  -21-
</TABLE>



                                      -iii-

<PAGE>   5


                                TABLE OF CONTENTS
                                   (CONTINUED)


Exhibit A       -     Schedule of Purchasers

Exhibit B       -     Certificate of Amendment

Exhibit C       -     Schedule of Exceptions to Representations and Warranties

Exhibit D       -     List of Stockholders of the Company

Exhibit E       -     Form of Amended and Restated Rights Agreement

Exhibit F       -     Form of Amended and Restated Right of First Refusal and 
                      Co-Sale Agreement

Exhibit G       -     Letter Agreement Relating to Sale of Stock in the Event 
                      Directed Shares are Offered

Exhibit H       -     Form of Agreement Regarding Acceleration of Vesting of 
                      Future Optionees

Exhibit I       -     Form of Voting Agreement

Exhibit J       -     Form of Legal Opinion of Brobeck, Phleger & Harrison LLP

Exhibit K       -     List of Company Founders


                                      -iv-

<PAGE>   6


                         INTERNET SECURITY SYSTEMS, INC.

                   SERIES B PREFERRED STOCK PURCHASE AGREEMENT


         THIS SERIES B PREFERRED STOCK PURCHASE AGREEMENT (the "AGREEMENT") is
made as of the 14th day of February, 1997 by and between INTERNET SECURITY
SYSTEMS, INC. a Georgia corporation (the "COMPANY"), the investors purchasing
Series B Preferred Stock (the "Series B Preferred") listed on Exhibit A attached
hereto (each a "PURCHASER" and together the "PURCHASERS") and Thomas Noonan and
Christopher Klaus (each a "FOUNDER" and together the "FOUNDERS")


         THE PARTIES HEREBY AGREE AS FOLLOWS:

         1.       Purchase and Sale of Preferred Stock.

                  1.1      Sale and Issuance of Series B Preferred Stock.

                           (a) The Company shall file with the Secretary of
State of the State of Georgia on or before the Closing (as defined below) a
Certificate of Amendment setting forth the rights, privileges, preferences and
limitations of the Series B Preferred Stock in the form attached hereto as
Exhibit B.

                           (b) Subject to the terms and conditions of this
Agreement, each Purchaser agrees, severally and not jointly, to purchase at the
Closing (as defined below) and the Company agrees to sell and issue to each
Purchaser at the Closing that number of shares set forth opposite each
Purchaser's name on Exhibit A attached hereto at a purchase price of $2.53 per
share. The shares of Series B Preferred sold to the Purchasers pursuant to this
Agreement shall be hereinafter referred to as the "STOCK."

                  1.2      Closing. The purchase and sale of the Stock shall
take place at the offices of the Company, 41 Perimeter Center East, Suite 660,
Atlanta, Georgia 30348 at 10:00 a.m., on February 14, 1997 or at such other time
and place as the Company and the Purchasers mutually agree upon, orally or in
writing (which time and place are designated as the "CLOSING"). At the Closing,
the Company shall deliver to each Purchaser a certificate representing the Stock
being purchased thereby against payment of the purchase price therefor, by a
bank or certified check payable to the Company or by wire transfer to the
Company's bank account.

         2.       Representations and Warranties of the Company. The Company
hereby represents and warrants to each Purchaser that, as of the date hereof and
the date of the closing, except as set forth on the Schedule of Exceptions
attached hereto as Exhibit C, specifically identifying the relevant subsection
hereof which exceptions shall be deemed to be representations and warranties as
if made hereunder:




<PAGE>   7




                  2.1      Organization Good Standing and Qualification. The
Company is a corporation duly organized, validly existing and in good standing
under the laws of the State of Georgia and has all requisite corporate power and
authority to carry on its business as now conducted and as proposed to be
conducted. The Company and its subsidiary are duly qualified to transact
business and is in good standing in each jurisdiction in which the failure so to
qualify would have a material adverse effect on its business or properties.

                  2.2      Capitalization.  The authorized capital of the
Company consists, or will consist, immediately prior to the Closing, of:

                                    (i)   Preferred Stock. 10,000,000 shares of
Preferred Stock, of which (A) 3,650,000 shares have been designated Series A
Preferred Stock all of which are issued and outstanding and (B) 2,086,957 shares
have been designated Series B Preferred Stock all of which shall be issued and
outstanding immediately following the Closing. The rights, privileges and
preferences of the Preferred Stock are as stated in the Restated Articles of
Incorporation as amended by the Certificate of Amendment.

                                    (ii)  Common Stock. 25,000,000 shares of 
Common Stock and 7,901,971 shares of which shall be issued and outstanding as of
the Closing.

                                    (iii) An accurate list of the Company's
stockholders and their holdings is set forth in Exhibit D to this Agreement.
Based in part upon the representations of the Purchasers in this Agreement and
subject to the provisions of Section 2.5 below, the Stock (and the Common Stock
issuable upon conversion thereof) has been issued or will be issued in
compliance with all applicable federal and state securities laws.

                                    (iv)  Except for (A) conversion privileges
of Series A Preferred Stock, (B) conversion privileges of Series B Preferred
Stock, (C) the Rights of First Offer described in Section 7 of that certain
Series A Preferred Stock Purchase Agreement dated as of February 2, 1996 by and
between the Company and the investors listed on Exhibit A thereto (the "SERIES A
PURCHASE AGREEMENT"), (D) the Rights of First Offer described in Section 7
hereof, and (E) outstanding options to purchase 894,900 shares of Common Stock
granted to employees, there are no outstanding options, warrants, rights
(including conversion or preemptive rights) or agreements, orally or in writing,
for the purchase or acquisition from the Company of any shares of its capital
stock. The Company has reserved 1,548,029 shares of Common Stock for issuance,
at the discretion of the Board of Directors, to officers, directors, employees
and consultants. Except as otherwise contemplated herein, the Company is not a
party or subject to any agreement or understanding, and, to the best of the
Company's knowledge, there is no agreement or understanding between any persons
that affects or relates to the voting or giving of written consents with respect
to any security or the voting by a director of the Company.

                  2.3      Subsidiaries. The Company does not currently own or
control, directly or indirectly, any interest in any other corporation,
association, or other business entity.




                                       -2-

<PAGE>   8



                  2.4      Authorization. All corporate action on the part of
the Company, its officers, directors and stockholders necessary for the
authorization, execution and delivery of this Agreement, the Amended and
Restated Rights Agreement in the form attached as Exhibit E (the "RIGHTS
AGREEMENT"), the Amended and Restated Right of First Refusal and Co-Sale
Agreement in the form attached as Exhibit F (the "CO-SALE AGREEMENT"), the
Letter Agreement Relating to the Sale of Stock in the Event Directed Shares are
Offered in the form attached as Exhibit G (the "DIRECTED SHARE AGREEMENT"), the
Amended and Restated Agreement Regarding Acceleration of Vesting of Future
Optionees in the form attached as Exhibit H (the "ACCELERATION AGREEMENT") and
the Amended and Restated Voting Agreement in the form attached as Exhibit I
hereto (the "VOTING AGREEMENT"); the performance of all obligations of the
Company hereunder and thereunder and the authorization, issuance and delivery of
the Stock (and the Common Stock issuable upon conversion of the Stock) has been
taken or will be taken prior to the Closing, and this Agreement, the Rights
Agreement, the Co-Sale Agreement, the Acceleration Agreement, the Directed Share
Agreement and the Voting Agreement constitute valid and legally binding
obligations of the Company, enforceable against the Company in accordance with
their respective terms except (i) as limited by applicable bankruptcy,
insolvency, reorganization, moratorium, fraudulent conveyance, and other laws of
general application affecting enforcement of creditor's rights generally, as
limited by laws relating to the availability of specific performance, injunctive
relief, or other equitable remedies, or (ii) to the extent the indemnification
provisions contained in the Rights Agreement may be limited by applicable
federal or state securities laws. The Stock, when issued in compliance with the
provisions of this Agreement, will be validly issued and will be fully paid and
nonassessable and will have the rights, preferences and privileges described in
the Certificate of Amendment. The shares of Common Stock issuable upon
conversion of the Stock have been duly and validly reserved and, when issued in
compliance with the provisions of this Agreement and the Amended and Restated
Articles of Incorporation of the Company, as amended (the "RESTATED ARTICLES")
will be validly issued, fully paid and nonassessable, and the Stock (and the
Common Stock issuable upon conversion thereof) will be free of any liens or
encumbrances other than those created by or imposed upon the holders thereof
through no action of the Company, and the Stock (and the Common Stock issuable
upon conversion thereof) will be free of restrictions on transfer other than the
restrictions on transfer under this Agreement, the Rights Agreement and the
Co-Sale Agreement and under the applicable state and federal securities laws.

                  2.5      Governmental Consents. No consent, approval, order or
authorization of, or registration, qualification, designation, declaration or
filing with, any federal, state or local governmental authority on the part of
the Company is required in connection with the consummation of the transactions
contemplated by this Agreement, except (i) the filing of the Certificate of
Amendment with the Secretary of State of the State of Georgia and (ii) such
filings as may be required under applicable state and federal securities laws,
which filings will be timely filed within the applicable periods therefor.

                  2.6      Permits. The Company has all franchises, permits,
licenses and any similar authority as necessary for the conduct of its business
as now being conducted by it, the lack of which could materially and adversely
affect the business, properties, prospects or financial 



                                                          -3-

<PAGE>   9



condition of the Company and believes it can obtain, without undue burden or
expense, any similar authority for the conduct of its business as planned to be
conducted. The Company is not in default in any material respect under any of
such franchises, permits, licenses or other similar authority.

                  2.7      Litigation. There is no action, suit or proceeding
pending against the Company or any of its real property, or against any Founder,
nor, to the best knowledge of the Company, is there any basis therefor, nor is
there any action, suit, proceeding or investigation pending or currently
threatened against the Company that questions the validity of this Agreement,
the Rights Agreement, the Co-Sale Agreement, the Voting Agreement or the right
of the Company to enter into each such agreement, or to consummate the
transactions contemplated hereby or thereby. The foregoing includes, without
limitation, actions pending or threatened (or any basis therefor known to the
Company) involving the prior employment of any of the Company's employees, their
use in connection with the Company's business of any information or techniques
allegedly proprietary to any of their former employers, or their obligations
under any agreements with prior employers. The Company is not a party or subject
to the provisions of any order, writ, injunction, judgment or decree of any
court or government agency or instrumentality. There is no investigation pending
or threatened against the Company, its properties or any of its officers or
directors (nor, to the best knowledge of the Company, is there any basis
therefor) by or before any governmental agency or entity. There is no action,
suit, proceeding or investigation by the Company currently pending or which the
Company intends to initiate.

                  2.8      Proprietary Information and Inventions Agreement.
Each employee and officer of the Company has executed an agreement with the
Company regarding confidentiality and proprietary information substantially in
the form or forms delivered to the Purchasers. The Company is not aware that any
of its employees are in violation thereof.

                  2.9      Patents and Other Intangible Assets. The Company owns
or possesses sufficient legal rights to all patents, trademarks, service marks,
trade names, copyrights, trade secrets, licenses, information and proprietary
rights and processes necessary for its business as now conducted and to the best
of the Company's knowledge, as proposed to be conducted without any conflict
with, or infringement with the rights of, others. The Company has not received
any communications alleging that the Company has violated or, by conducting its
business as proposed, would violate any of the patents, trademarks, service
marks, trade names, copyrights, trade secrets or other proprietary rights or
processes of any other person or entity. Furthermore, the Company is not
obligated to pay any royalty or fee to any third party on account of the
Company's ownership of such patents, trademarks, service marks, trade names,
copyrights, trade secrets, licenses, information and proprietary rights, nor is
the Company obligated to pay any future royalty or fee to any of the Company's
employees or consultants on account of any such intellectual property rights of
such employee or consultant that have not been assigned to the Company. The
Company is not aware that any of its employees is obligated under any contract
(including licenses, covenants or commitments of any nature) or other agreement,
or subject to any judgment, decree of order of any court or administrative
agency, that would interfere with the use of such employees' best efforts to
promote the interest



                                       -4-

<PAGE>   10



of the Company or that would conflict with the Company's business as proposed to
be conducted. Neither the execution nor delivery of this Agreement, nor the
carrying on of the Company's business by the employees of the Company, nor the
conduct of the Company's business as proposed, will, to the best of the
Company's knowledge, conflict with or result in a breach of the terms,
conditions, or provisions of, or constitute a default under, any contract,
covenant or instrument under which any such employee is now obligated. The
Company does not believe it is or will be necessary to use any inventions of any
of its employees (or persons it currently intends to hire) made prior to their
employment by the Company.

                  2.10     Manufacturing and Marketing Rights. The Company has
not granted rights to manufacture, produce, assemble, license, market, or sell
its products to any other person (other than rights to sell the Company's
products granted to distributors and resellers in the ordinary course) and is
not bound by any agreement that affects the Company's exclusive right to
develop, manufacture, assemble, distribute, market or sell its products.

                  2.11     Compliance with Other Instruments.

                           (a) The Company is not in violation or default of any
provisions of its Restated Articles or By-laws or in any material respect of any
instrument, contract, indenture or agreement relating to the payment or receipt
of money on an annual basis in excess of $3,000 (a "MATERIAL CONTRACT") to which
it is a party or by which it is bound or, of any provision of federal or state
judgment, order, writ, decree, statute, rule or regulation applicable to the
Company. To the best of the Company's knowledge, all parties having material
contracts and commitments with the Company are in compliance therewith in all
material respects. The execution, delivery and performance of this Agreement,
the Rights Agreement, the Co-Sale Agreement, the Acceleration Agreement, the
Directed Share Agreement and the Voting Agreement and the consummation of the
transactions contemplated hereby and thereby will not result in any such
violation or be in conflict with or constitute, with or without the passage of
time and giving of notice, either a default under any such provision,
instrument, judgment, order, writ, decree or contract or an event which results
in the creation of any lien, charge or encumbrance upon any assets of the
Company.

                           (b) The Company has materially complied with all
Material Contracts and has not performed any act, the occurrence of which would
result in the Company's loss of any right granted under any license,
distribution or other agreement (other than the terms of employment arrangements
previously disclosed in writing to the Purchasers).

                  2.12     Agreements, Action.

                           (a) There are no agreements, understandings or
proposed transactions between the Company and any of its officers, directors,
affiliates, or any affiliate thereof.

                           (b) Except for agreements explicitly contemplated
hereby and agreements for the sale or distribution of the Company's products and
services in the ordinary



                                       -5-

<PAGE>   11



course of business, there are no agreements, understandings, instruments,
contracts or proposed transactions to which the Company is a party or by which
it is bound that involve (i) current or future obligations of, or payments to
the Company in excess of, $50,000, (ii) obligations that have a duration of
greater than one year, or (iii) the license of any patent, copyright, trade
secret or other proprietary right to or from the Company.

                           (c) The Company has not (i) declared or paid any
dividends, or authorized or made any distribution upon or with respect to any
class or series of its capital stock, (ii) incurred any indebtedness for money
borrowed that remains outstanding or incurred any other liabilities that remain
outstanding individually in excess of $25,000 or in excess of $125,000 in the
aggregate, (iii) made any loans or advances to any person, other than ordinary
advances for travel expenses, or (iv) sold, exchanged or otherwise disposed of
any of its assets or rights, other than the sale of its inventory in the
ordinary course of business.

                           (d) The Company is not a party to and is not bound by
any contract, agreement or instrument, or subject to any restriction under its
Restated Articles or By-laws, that materially adversely affects its business as
now conducted or as proposed to be conducted, its properties or its financial
condition.

                           (e) The Company has not engaged in the past six (6)
months in any discussion (i) with any representative of any corporation or
corporations regarding the merger of the Company with or into any such
corporation or corporations, (ii) with any corporation, partnership, association
or other business entity or any individual regarding the sale, conveyance or
disposition of all or substantially all of the assets of the Company or a
transaction or series of related transactions in which more than fifty percent
(50%) of the voting power of the Company is disposed of, or (iii) regarding any
other form of liquidation, dissolution or winding up of the Company.

                  2.13     Brokers or Finders; Other Offers. The Company has not
incurred, and will not incur, directly or indirectly, as a result of any action
taken by the Company, any liability for brokerage or finders' fees or agents'
commissions or any similar charges in connection with this Agreement.

                  2.14     Disclosure. The Company has fully provided the
Purchasers with all the information which the Purchasers have requested for
deciding whether to acquire the Stock. In addition, the Company has made
representations concerning its business, including certain of the Company's
projections describing its proposed business (collectively, the "Business Plan")
to the Purchasers. In the course of its representations to the Purchasers
concerning its business, the Company has not omitted any information of which it
is aware that is material to its business prospects. No representation or
warranty of the Company contained in this Agreement and the exhibits attached
hereto, any certificate furnished or to be furnished to Purchasers at the
Closing, or the Business Plan (when read together) contains any untrue statement
of a material fact or omits to state a material fact necessary in order to make
the statements contained herein or therein not misleading in light of the
circumstances under which they were made. The Business



                                       -6-

<PAGE>   12



Plan and the financial projections contained in the Business Plan were prepared
in good faith; provided, however, that the Company does not represent or warrant
that it will achieve such financial projections.

                  2.15     No Conflict of Interest. The Company is not indebted,
directly or indirectly, to any of its officers or directors or to their
respective spouses or children, in any amount whatsoever other than in
connection with expenses or advances of expenses incurred in the ordinary course
of business. None of the Company's officers or directors, or any members of
their immediate families, are indebted to the Company or to the best of the
Company's knowledge, have any direct or indirect ownership interest in any firm
or corporation with which the Company is affiliated or with which the Company
has a business relationship, or any firm or corporation which competes with the
Company except that officers, directors and/or stockholders of the Company may
own stock in publicly traded companies which may compete with the Company. To
the best of the Company's knowledge, no officer or director or any member of
their immediate families is, directly or indirectly, interested in any Material
Contract with the Company. The Company is not a guarantor or indemnitor of any
indebtedness of any other person, firm or corporation.

                  2.16     Rights of Registration. Except as contemplated in the
Rights Agreement, the Company has not granted or agreed to grant any
registration rights, including piggyback rights, to any person or entity. At the
Closing, the Company will enter into the Rights Agreement in the form attached
hereto as Exhibit E between the Company, certain members of the Company's
Management and each Purchaser.

                  2.17     Private Placement. Subject in part to the truth and
accuracy of each Purchaser's representations set forth in this Agreement, the
offer, sale and issuance of the Stock as contemplated by this Agreement is
exempt from the registration requirements of the Securities Act of 1933, as
amended (the "SECURITIES ACT"), and neither the Company nor any authorized agent
acting on its behalf will take any action hereafter that would cause the loss of
such exemption.

                  2.18     Corporate Documents. The Restated Articles and Bylaws
of the Company are in the form provided to the Purchasers.

                  2.19     Title to Property and Assets. The Company owns its
property and assets free and clear of all mortgages, liens, loans and
encumbrances, except such encumbrances and liens which arise in the ordinary
course of business and do not materially impair the Company's ownership or use
of such property or assets. With respect to the property and assets it leases,
the Company is in compliance with such leases and, to the best of its knowledge,
holds a valid leasehold interest free of any liens, claims or encumbrances.

                  2.20     Financial Statements. The Company has delivered to
the Purchasers its unaudited financial statements (including balance sheet and
profit and loss statement) for the period ended December 31, 1996 (the
"FINANCIAL STATEMENTS"). The Financial Statements have



                                       -7-

<PAGE>   13



been complied on a consistent basis throughout the periods indicated and with
each other. The Financial Statements fairly present the financial condition and
operating results of the Company as of the dates, and for the periods, indicated
therein, subject to normal year-end audit adjustments. Except as set forth in
the Financial Statements, the Company has no material liabilities, obligations,
claims or guarantees contingent or otherwise, other than (i) liabilities
incurred in the ordinary course of business subsequent to December 31, 1996 and
(ii) obligations under contracts and commitments incurred in the ordinary course
of business and not required under generally accepted accounting principles to
be reflected in the Financial Statements, which, in both cases, individually or
in the aggregate are not material to the financial condition or operating
results of the Company. The Company hereby represents and warrants that the
Financial Statements and all yearly financials thereafter shall be audited by an
independent certified public accounting firm of national recognition and such
financials shall be in accordance with generally accepted accounting principles.

                  2.21     Changes. Since December 31, 1996, there has not been:

                           (a) any change in the assets, liabilities, financial
condition or operating results of the Company from that reflected in the
Financial Statements, except changes in the ordinary course of business that
have not been, in the aggregate, materially adverse;

                           (b) any damage, destruction or loss, whether or not
covered by insurance, materially and adversely affecting the business,
properties, prospects, or financial condition of the Company (as such business
is presently conducted and as it is proposed to be conducted);

                           (c) any waiver or compromise by the Company of a
valuable right or of a material debt owed to it;

                           (d) any satisfaction or discharge of any lien, claim,
or encumbrance or payment of any obligation by the Company, except in the
ordinary course of business and that is not material to the business,
properties, prospects or financial condition of the Company (as such business is
presently conducted and as it is proposed to be conducted);

                           (e) any material change to a Material Contract or
agreement by which the Company or any of its assets is bound or subject;

                           (f) any material change in any compensation
arrangement or agreement with any employee, officer, director or stockholder;

                           (g) any sale, assignment or transfer of any patents,
trademarks, copyrights, trade secrets or other intangible assets;




                                       -8-

<PAGE>   14



                           (h) any resignation or termination of employment of
any key officer of the Company; and the Company, to the best of its knowledge,
does not know of any impending resignation or termination of employment of any
such officers;

                           (i) receipt of notice that there has been a loss of,
or material order cancellation by, any major customer of the Company;

                           (j) any mortgage, pledge, transfer of a security
interest in, or lien, created by the Company, with respect to any of its
material properties or assets, except liens for taxes not yet due or payable;

                           (k) any loans or guarantees made by the Company to or
for the benefit of its employees, officers or directors, or any members of their
immediate families, other than travel advances and other advances made in the
ordinary course of its business;

                           (l) any declaration, setting aside or payment or
other distribution in respect to any of the Company's capital stock, or any
direct or indirect redemption, purchase, or other acquisition of any of such
stock by the Company; or

                           (m) any arrangement or commitment by the Company to
do any of the above items described in this Section 2.21.

                  2.22     Employee Benefit Plans. The Company does not have any
Employee Benefit Plan as defined in the Employee Retirement Income Security Act
of 1974.

                  2.23     Tax Returns and Payments. The Company has filed all
tax returns and reports as required by law. These returns and reports are true
and correct in all material respects. The Company has paid all taxes and other
assessments due.

                  2.24     Insurance. The Company has in full force and effect
fire and casualty insurance policies, with extended coverage, sufficient in
amount (subject to reasonable deductibles) to allow it to replace any of its
properties that might be damaged or destroyed. The Company has in effect term
life insurance policies, payable to the Company, on the lives of Christopher
Klaus and Thomas Noonan, each in the amount of $2,500,000.

                  2.25     Labor Agreements and Actions. The Company is not
bound by or subject to (and none of its assets or properties is bound by or
subject to) any written or oral, express or implied, contract, commitment or
arrangement with any labor union, and no labor union has requested or, to the
knowledge of the Company, has sought to represent any of the employees,
representatives or agents of the Company. There is no strike or other labor
dispute involving the Company pending, or to the knowledge of the Company
threatened, which could have a material adverse effect on the assets,
properties, financial condition, operating results, or business of the Company
(as such business is presently conducted and as it is proposed to be conducted),
nor is the Company aware of any labor organization activity involving its
employees. The Company is 



                                       -9-

<PAGE>   15



not aware that any officer or key employee, or that any group of key employees,
intends to terminate their employment with the Company, nor does the Company
have a present intention to terminate the employment of any of the foregoing.

                  2.26     Environmental and Safety Laws. To the Company's
knowledge, it is not in violation of any applicable statute, law or regulation
relating to the environment or occupational health and safety which would have a
material effect on the employees, and to the best of its knowledge, no material
expenditures are or will be required in order to comply with any such existing
statute, law or regulation.

                  2.27     Minute Books. The copy of the minute books of the

Company provided to the counsel for the Purchasers contains minutes of all
meetings of directors and stockholders and all actions by written consent
without a meeting by the directors and stockholders since the date of
incorporation and reflects all actions by the directors (and any committee of
directors) and stockholders with respect to all transactions referred to in such
minutes accurately in all material respects.

                  2.28     Section 1202 of the Internal Revenue Code. The
capital stock issuable hereunder will constitute "qualified small business
stock" within the meaning of Section 1202 of the Internal Revenue Code of 1986,
as amended (the "CODE"), as of the date of issuance and the Company hereby
represents and warrants that it shall continue to do the following:

                           (a)      use its best efforts to comply with the
reporting and record keeping requirements of Section 1202 of the Code and any
regulations promulgated thereunder; and

                           (b)      use its best efforts to provide the
Purchasers with notice at least ten (10) business days prior to taking any of
the following actions:

                                    (i)      Within the two-year period ending
one year from the date hereof, purchase an amount of its own stock (within the
meaning of Section 1202(c)(3) of the Code) having an aggregate value at the
time(s) of purchase exceeding five percent of the aggregate value of all of its
outstanding stock determined as of the start of such period;

                                    (ii)     Conduct any of the following
businesses (as defined for purposes of Section 1202(e)(3) of the Code):

                                             (A) any business involving the
performance of services in the fields of law, accounting, actuarial science,
performing arts, athletics, or brokerage services;

                                             (B) any banking or insurance 
business;

                                             (C) any farming business 
(including the business of raising or harvesting trees);




                                      -10-

<PAGE>   16



                                             (D) any business involving the
production or extraction of natural resources with respect to which a deduction
is allowable under Section 613 or 613A of the Code; or

                                             (E) any business of operating a
hotel, motel, restaurant or similar establishment;

                                    (iii)    Permit more than 10 percent of the
value of its assets to consist of stock issued by other companies (other than
stock of companies that qualify as subsidiaries of the Company within the
meaning of Section 1202(e)(5) of the Code or stock that is held as working
capital or reasonably expected to be sold within two years to finance research
and experimentation within the meaning of Section 1202(e)(6) of the Code);

                                    (iv)     Permit more than 10 percent of the
value of its assets to consist of real property which is not used in the active
conduct of a qualified trade or business within the meaning of Section
1202(e)(7) of the Code;

                                    (v)      Make an election under Section 936
of the Code (relating to the Puerto Rico and possessions tax credit) or permit a
subsidiary to make such an election; or

                                    (vi)     In a single transaction or series 
of related transactions, raise capital of more than $1 million through the
issuance of securities or the incurrence of indebtedness if such transaction or
series of related transactions likely would cause the Company to fail to satisfy
the active business requirement set forth in Section 1202(e)(1) of the Code by
virtue of holding excess cash or investment assets.

                           For purposes of the foregoing, any valuation or other
determination (including, without limitation, a determination that a specific
course of action does not constitute the conduct of a business described in
2(b), above) made by the Company's Board of Directors in good faith or for which
there was, at the time made, a reasonable basis in law or fact shall be
conclusive.

                  2.29     Use of Proceeds. The proceeds of the financing
contemplated herein shall be used for general corporate and working capital
purposes including repayments of advances made under existing lines of credit.

         3.       Representations and Warranties of the Purchasers. Each
Purchaser hereby represents and warrants to the Company that:

                  3.1      Authorization. This Agreement and the Rights
Agreement, when executed and delivered by such Purchaser will constitute a valid
and legally binding obligation of the Purchaser, enforceable in accordance with
its terms, except (i) as limited by applicable bankruptcy, insolvency,
reorganization, moratorium, fraudulent conveyance, and any other laws of general
application affecting enforcement of creditors rights generally, as limited by
laws relating 



                                      -11-

<PAGE>   17



to the availability of a specific performance, injunctive relief or
other equitable remedies, or (ii) to the extent the indemnification provisions
contained in the Rights Agreement may be limited by applicable federal or state
securities laws.

                  3.2      Purchase Entirely for Own Account. This Agreement is
made with the Purchaser in reliance upon the Purchaser's representation to the
Company, which by the Purchaser's execution of this Agreement the Purchaser
hereby confirms, that the Stock (and Common Stock issuable upon conversion
thereof) to be acquired by the Purchaser will be acquired for investment for the
Purchaser's own account, not as a nominee or agent, and not with a view to the
resale or distribution of any part thereof and that the Purchaser has no present
intention of selling, granting any participation in, or otherwise distributing
the same. By executing this Agreement, the Purchaser further represents that the
Purchaser does not presently have any contract, undertaking, agreement or
arrangement with any person to sell, transfer or grant participation to such
person or to any third person, with respect to any of the Stock (or the Common
Stock issuable upon conversion thereof). The Purchaser understands that the
Stock (and the Common Stock issuable upon conversion thereof) have not been, and
will not be, registered under the Securities Act by reason of a specific
exemption from the registration provisions of the Securities Act which depends
upon, among other things, the bona fide nature of the investment intent and the
accuracy of the Purchaser's representations as expressed herein. The Purchaser
has not been formed for the specific purpose of acquiring the Stock (and the
Common Stock issuable upon conversion thereof). The Purchaser represents that it
has full power and authority to enter into this Agreement.

                  3.3      Disclosure of Information. The Purchaser believes it
has received all the information it considers necessary or appropriate for
deciding whether to acquire the Stock. The Purchaser further represents that it
has had an opportunity to ask questions and receive answers from the Company
regarding the terms and conditions of the offering of the Stock. The Purchaser's
decision to purchase the Stock is based in part on the answers to such questions
as the Purchaser and its representatives have raised concerning the transaction
and on its own evaluation of the risks and merits of the purchase and the
Company's proposed business activities. The foregoing, however, does not limit
or modify the representations and warranties of the Company in Section 2 of this
Agreement or the right of the Purchaser to rely thereon.

                  3.4      Investment Experience. Such Purchaser is an investor
in securities of companies in the development stage and acknowledges that it is
able to fend for itself, can bear the economic risk of its investment, and has
such knowledge and experience in financial or business matters that it is
capable of evaluating the merits and risks of the investment in the Series B
Preferred Stock.

                  3.5      Restricted Securities. The Purchaser understands that
the Stock (and the Common Stock issuable upon conversion thereof) are
characterized as "restricted securities" under the federal securities laws
inasmuch as they are being acquired from the Company in a transaction not
involving a public offering and that under such laws and applicable regulations
such Stock (and the Common Stock issuable upon conversion thereof) may be resold
without



                                      -12-

<PAGE>   18



registration under the Securities Act only in certain limited circumstances. The
Purchaser acknowledges that the Stock (and the Common Stock issuable upon
conversion thereof) must be held indefinitely unless subsequently registered
under the Securities Act or an exemption from such registration is available.
The Purchaser is aware of the provisions of Rule 144 promulgated under the
Securities Act which permit limited resale of shares purchased in a private
placement subject to the satisfaction of certain conditions, including, among
other things, the existence of a public market for the shares, the availability
of certain current public information about the Company, the resale occurring
not less than two years after a party has purchased and paid for the security to
be sold, the sale being effected through a "broker's transaction" or in
transactions directly with a "market maker" (as provided by Rule 144(f)) and the
number of shares being sold during any three-month period not exceeding
specified limitations.

                  3.6      No Public Market. The Purchaser understands that no
public market now exists for any of the securities issued by the Company, that
the Company has made no assurances that a public market will ever exist for the
Stock or the underlying Common Stock and that, even if such a public market
exists at some future time, the Company may not then be satisfying the current
public information requirements of Rule 144.

                  3.7      Further Limitations on Disposition. Without in any
way limiting the representations set forth above, the Purchaser further agrees
not to make any disposition of all or any portion of the Stock (and the Common
Stock issuable upon conversion thereof) unless and until:

                           (a)      There is then in effect a Registration
Statement under the Securities Act covering such proposed disposition and such
disposition is made in accordance with such Registration Statement; or

                           (b)      (i) The Purchaser shall have notified the
Company of the proposed disposition and shall have furnished the Company with a
detailed statement of the circumstances surrounding the proposed disposition,
and (ii) if reasonably requested by the Company, the Purchaser shall have
furnished the Company with an opinion of counsel, reasonably satisfactory to the
Company, that such disposition will not require registration under the
Securities Act. It is agreed that the Company will not require opinions of
counsel for routine transactions made pursuant to Rule 144.

                           (c)      Notwithstanding the provisions of paragraphs
(a) and (b) above, no such registration statement or opinion of counsel shall be
necessary for a transfer by the Purchaser to a constituent stockholder or
constituent partner (including any constituent of a constituent) of the
Purchaser, if the transferee or transferees agree in writing to be subject to
the terms hereof to the same extent as if they were the Purchaser hereunder.

                  3.8      Legends. The Purchaser understands that the Stock 
(and the Common Stock issuable upon conversion thereof), and any securities
issued in respect thereof or exchange therefor, may bear one or all of the
following legends:



                                      -13-

<PAGE>   19




                           (a)      "THESE SECURITIES HAVE NOT BEEN REGISTERED
UNDER THE SECURITIES ACT OF 1933. THEY MAY NOT BE SOLD, OFFERED FOR SALE,
PLEDGED OR HYPOTHECATED IN THE ABSENCE OF A REGISTRATION STATEMENT IN EFFECT
WITH RESPECT TO THE SECURITIES UNDER SUCH ACT OR AN OPINION OF COUNSEL
SATISFACTORY TO THE COMPANY THAT SUCH REGISTRATION IS NOT REQUIRED."

                           (b)      Any legend required by the laws of the State
of Georgia and the laws of the State of California.

                           (c)      Any legend required by the Blue Sky laws of
any other state to the extent such laws are applicable to the shares represented
by the certificate so legended.

         A certificate shall not bear such legends if in the opinion of counsel
satisfactory to the Company (it being agreed that Wilson Sonsini Goodrich &
Rosati or Brobeck, Phleger & Harrison LLP shall be satisfactory) that the
securities represented thereby may be publicly sold without registration under
the Securities Act and any applicable state securities laws.

                  3.9      Accredited Investor. The Purchaser is an
accredited investor as defined in Rule 501(a) of Regulation D promulgated under
the Act.

                  3.10     Brokers or Finders. The Company has not incurred, and
will not incur, directly or indirectly, as a result of any action taken by the
Purchaser any liability for brokerage or finders' fees or agents' commissions or
any similar charges in connection with this Agreement.

         4.       Representations and Warranties of the Founders.

                  4.1      Litigation. Each Founder, severally and not jointly,
represents and warrants to the Purchasers that, to the best knowledge of such
Founder, there is no action, suit or proceeding pending against the Company or
any of its real property, or against such Founder, nor is there any basis
therefor, nor is there any action, suit, proceeding or investigation pending or
currently threatened against the Company that questions the validity of this
Agreement, the Rights Agreement or the Co-Sale Agreement or the right of the
Company to enter into each such agreement, or to consummate the transactions
contemplated hereby or thereby. The foregoing includes, without limitation,
actions pending or threatened (or any basis therefor known to such Founder)
involving the prior employment of any of the Company's employees, their use in
connection with the Company's business of any information or techniques
allegedly proprietary to any of their former employers, or their obligations
under any agreements with prior employers. The Company is not a party or subject
to the provisions of any order, writ, injunction, judgment or decree of any
court or government agency or instrumentality. There is no investigation pending
or threatened against the Company, its properties or such Founder (nor, to the
best knowledge of such Founder, is there any basis therefor) by or before any
governmental agency or entity. There is no action, suit, proceeding or
investigation by the Company currently pending or which the Company intends to
initiate.


                                      -14-

<PAGE>   20




                  4.2      Capitalization. Each Founder, severally and not
jointly, represents and warrants to the Purchasers that, except as set forth in
the Schedule of Exceptions under Section 2.2, to the best knowledge of such
Founder, the authorized capital of the Company consists, or will consist,
immediately prior to the Closing, of:

                                    (i)   Preferred Stock. 10,000,000 shares of
Preferred Stock, of which (A) 3,650,000 shares have been designated Series A
Preferred Stock all of which are issued and outstanding and (B) 2,086,957 shares
have been designated Series B Preferred Stock all of which shall be issued and
outstanding immediately following the Closing. The rights, privileges and
preferences of the Preferred Stock are as stated in the Restated Articles and
the Certificate of Amendment.

                                    (ii)  Common Stock. 25,000,000 shares of 
Common Stock and 7,901,971 shares of which shall be issued and outstanding as of
the Closing.

                                    (iii) An accurate list of the Company's
stockholders and their holdings is set forth in Exhibit D to this Agreement.

                                    (iv)  Except for (A) conversion privileges 
of Series A Preferred Stock, (B) Conversion Privileges of Series B Preferred
Stock, (C) the Rights of First Offer described in Section 7 of the Series A
Purchase Agreement, (D) the Rights of First Offer described in Section 7 hereof,
and (E) outstanding options to purchase 894,900 shares of Common Stock granted
to employees, there are no outstanding options, warrants, rights (including
conversion or preemptive rights) or agreements, orally or in writing, for the
purchase or acquisition from the Company of any shares of its capital stock. The
Company has reserved 1,548,029 shares of Common Stock for issuance, at the
discretion of the Board of Directors, to officers, directors, employees and
consultants. Except as otherwise contemplated herein, the Company is not a party
or subject to any agreement or understanding, and, to the best of such Founders
knowledge, there is no agreement or understanding between any persons that
affects or relates to the voting or giving of written consents with respect to
any security or the voting by a director of the Company.

                  4.3      Patents and Other Intangible Assets. Christopher
Klaus represents and warrants to the Purchasers that, except as set forth in the
Schedule of Exceptions under Section 2.9, to the best of his knowledge, the
Company owns or possesses sufficient legal rights to all patents, trademarks,
service marks, trade names, copyrights, trade secrets, licenses, information and
proprietary rights and processes necessary for its business as now conducted and
as proposed to be conducted without any conflict with, or infringement with the
rights of, others. Neither he nor the Company has received any communications
alleging that the Company has violated or, by conducting its business as
proposed, would violate any of the patents, trademarks, service marks, trade
names, copyrights, trade secrets or other proprietary rights or processes of any
other person or entity. Furthermore, the Company is not obligated to pay any
royalty or fee to any third party on account of the Company's ownership of such
necessary patents, trademarks, service marks, trade names, copyrights, trade
secrets, licenses, information and proprietary rights, nor is the 


                                      -15-

<PAGE>   21



Company obligated to pay any future royalty or fee to any of the Company's
employees or consultants on account of any such intellectual property rights of
such employee or consultant that have not been assigned to the Company.
Christopher Klaus is not aware that any employee is obligated under any contract
(including licenses, covenants or commitments of any nature) or other agreement,
or subject to any judgment, decree of order of any court or administrative
agency, that would interfere with the use of such employees' best efforts to
promote the interest of the Company or that would conflict with the Company's
business as proposed to be conducted. Neither the execution nor delivery of this
Agreement, nor the carrying on of the Company's business by the employees of the
Company, nor the conduct of the Company's business as proposed, will, to the
best of Christopher Klaus' knowledge conflict with or result in a breach of the
terms, conditions, or provisions of, or constitute a default under, any
contract, covenant or instrument under which any such employee is now obligated.
Christopher Klaus does not believe that or that it will be necessary to use any
inventions of any of the Company's employees (or persons the Company currently
intends to hire) made prior to their employment by the Company.

         5.       Conditions of the Purchasers' Obligations at Closing. The
obligations of each Purchaser to the Company under this Agreement are subject to
the fulfillment, on or before the Closing, of each of the following conditions,
unless otherwise waived:

                  5.1      Representations and Warranties. The representations
and warranties of the Company contained in Section 2 shall be true on and as of
the Closing with the same effect as though such representations and warranties
had been made on and as of the date of the Closing.

                  5.2      Performance. The Company shall have performed and
complied with all covenants, agreements, obligations and conditions contained in
this Agreement that are required to be performed or complied with by it on or
before the Closing.

                  5.3      Compliance Certificate. The President of the Company
shall deliver to the Purchasers at the Closing a certificate certifying that the
conditions specified in Sections 5.1 and 5.2 have been fulfilled.

                  5.4      Qualifications. All authorizations, approvals or
permits, if any, of any governmental authority or regulatory body of the United
States or of any state that are required in connection with the lawful issuance
and sale of the Stock pursuant to this Agreement shall be obtained and effective
as of the Closing.

                  5.5      Proceedings and Documents. All corporate and other
proceedings in connection with the transactions contemplated at such Closing and
all documents incident thereto shall be reasonably satisfactory in form and
substance to the Purchasers' counsel, and the Purchasers' counsel shall have
received all such counterpart original and certified or other copies of such
documents as it may reasonably request.



                                      -16-

<PAGE>   22




                  5.6      Opinion of Company Counsel. The Purchasers shall
have received from Brobeck, Phleger & Harrison LLP, counsel for the Company, an
opinion, dated as of the Closing, in substantially the form of Exhibit J.

                  5.7      Rights Agreement. The Company and each Purchaser
shall have executed and delivered the Rights Agreement in substantially the form
attached as Exhibit E.

                  5.8      Right of First Refusal and Co-Sale Agreement. The
Company, each Founder of the Company listed in Exhibit K, and each Purchaser
shall have executed and delivered the Right of First Refusal and Co-Sale
Agreement in substantially the form attached as Exhibit F.

                  5.9      Letter Agreement Relating to Sale of Stock in the
Event Directed Shares are Offered. The Company, AT & T Ventures and Kleiner
Perkins Caufield & Byers shall have executed and delivered a Letter Agreement
Relating to Sale of Stock in the Event Directed Shares are Offered in the form
attached as Exhibit G.

                  5.10     Agreement Regarding Acceleration of Vesting of
Future Optionees. The Company, AT & T Ventures and Kleiner Perkins Caufield &
Byers shall have executed and delivered an Agreement to Accelerate Vesting of
Future Optionees in the Form attached as Exhibit I.

                  5.11     Voting Agreement. The Company, certain
shareholders of the Company and each Purchaser shall have executed and delivered
the Voting Agreement in the Form attached as Exhibit H.

         6.       Conditions of the Company's Obligations at Closing. The
obligations of the Company to each Purchaser under this Agreement are subject to
the fulfillment, on or before the Closing, of each of the following conditions,
unless otherwise waived:

                  6.1      Representations and Warranties. The representations
and warranties of each Purchaser contained in Section 3 shall be true on and as
of the Closing with the same effect as though such representations and
warranties had been made on and as of the Closing.

                  6.2      Qualifications. All authorizations, approvals or
permits, if any, of any governmental authority or regulatory body of the United
States or of any state that are required in connection with the lawful issuance
and sale of the Stock pursuant to this Agreement shall be obtained and effective
as of the Closing.

                  6.3      Covenants. All covenants, agreements and
conditions contained in this Agreement to be performed by the Purchasers on or
prior to the Closing shall have been performed or complied with in all material
respects.



                                      -17-

<PAGE>   23



         7.       Right of First Offer. The Company hereby grants to each
Purchaser (each a "RIGHTS HOLDER") the right of first offer to purchase a pro
rata portion of any "New Securities" (as defined below) that the Company may,
from time to time, propose to sell and issue. The Rights Holder's pro rata
share, for purposes of this right of first offer, is the ratio of (X) the number
of shares of Common Stock (assuming conversion of all outstanding Preferred)
owned by such Rights Holder to (Y) the total number of shares of Common Stock
then outstanding (assuming conversion of all outstanding Preferred) and all
outstanding options of the Company. This right of first offer shall be subject
to the following provisions:

                           (a)      "NEW SECURITIES" shall mean any Common Stock
or Preferred Stock of the Company whether or not authorized on the date hereof,
or rights, options, or warrants to purchase such Common Stock or Preferred
Stock, or securities of any type whatsoever that are, or may become, convertible
into said Common Stock or Preferred Stock; provided, however, that "New
Securities" does not include the following:

                                    (i)   up to 1,548,029 shares of Common
Stock, or options to purchase shares of Common Stock, issued or granted to
officers, directors, employees and consultants of the Company pursuant to stock
and option plans or arrangements approved by the Board of Directors;

                                    (ii)  shares of Common Stock issuable upon
conversion of the Company's Series A Preferred Stock;

                                    (iii) shares of Common Stock issuable upon
conversion of the Company's Series B Preferred Stock;

                                    (iv)  securities of the Company offered to
the public pursuant to a bona fide public offering;

                                    (v)   securities of the Company issued to
persons or entities with whom the Company has business relationships, including
under equipment leasing arrangements, bank or other institutional loans,
acquisitions of companies or product lines or other arrangements or transactions
wherein the principal purpose of the issuance of such shares (or warrants or
options) is for non-equity financing purposes; provided, that such arrangements
are approved by the majority vote or written consent of the Board of Directors
of the Company;

                                    (vi)  shares of Common Stock or Preferred
Stock issued in connection with any stock split, stock dividend, or
recapitalization by the Company; or

                                    (vii) the shares of Series B Preferred
issued pursuant to this Agreement;

                           (b)      In the event that the Company proposes to
undertake an issuance of New Securities, it shall give the Rights Holder written
notice of its intention, describing the type


                                      -18-

<PAGE>   24




of New Securities, the price, and the general terms upon which the Company
proposes to issue the same (the "COMPANY'S NOTICE"). The Rights Holder shall
have ten (10) business days from the date such notice is given to agree to
purchase its share of such New Securities at the price and upon the general
terms specified in the notice by giving written notice to the Company and
stating therein the quantity of New Securities to be purchased. In the event
that a Rights Holder does not elect to purchase its pro rata share (a
"NON-PARTICIPATING HOLDER"), then each Rights Holder purchasing such New
Securities shall have ten (10) business days to elect to purchase, on a pro rata
basis, each Non-Participating Holder's pro rata share.

                           (c)      The Company shall have one hundred twenty 
(120) days thereafter to sell (or enter into an agreement pursuant to which the
sale of New Securities covered thereby shall be closed, if at all, within sixty
(60) days from the date of such agreement) any New Securities not acquired by
the Rights Holder at a price and upon general terms no more favorable to the
purchasers thereof than specified in the Company's Notice. In the event the
Company has not sold the New Securities within such one hundred twenty (120) day
period (or sold and issued New Securities in accordance with the foregoing
within sixty (60) days from the date of such agreement), the Company shall not
thereafter issue or sell any New Securities without first offering such New
Securities to the Rights Holder in the manner provided above.

                           (d)      The right of first offer granted under this
Agreement shall expire in the event the Company becomes a reporting Company
under the Securities Exchange Act of 1934, as amended.

                           (e)      This right of first offer shall expire with
respect to any Rights Holder immediately at such time as such Rights Holder no
longer owns, in the aggregate, one-half of the shares of Series B Preferred
Stock (or Common Stock issuable upon conversion thereof) owned as of the date
hereof.

         8.       Miscellaneous.

                  8.1      Survival of Warranties. Unless otherwise set
forth in this Agreement, the warranties, representations and covenants of the
Company and the Purchasers contained in or made pursuant to this Agreement shall
survive the execution and delivery of this Agreement and the Closing for a
period of two (2) years following the Closing.

                  8.2      Transfer; Successors and Assigns. The terms and
conditions of this Agreement shall inure to the benefit of and be binding upon
the respective successors and assigns of the parties. Nothing in this Agreement,
express or implied is intended to confer upon any party other than the parties
hereto or their respective successors and assigns any rights, remedies,
obligations, or liabilities under or by reason of this Agreement, except as
expressly provided in this Agreement. Notwithstanding any other provision of
this Agreement to the contrary, the rights and obligations of this Agreement may
be expressly transferred by one Purchaser to another Purchaser or by a Purchaser
to any entity that is under common control with such Purchaser.



                                      -19-

<PAGE>   25




                  8.3      Governing Law. This Agreement shall be governed
by and construed under the laws of the State of California.

                  8.4      Counterparts. This Agreement may be executed in
two or more counterparts, each of which shall be deemed an original, but all of
which together shall constitute one and the same instrument.

                  8.5      Titles and Subtitles. The titles and subtitles
used in this Agreement are used for convenience only and are not to be
considered in construing or interpreting this Agreement.

                  8.6      Notices.

                           (a) All notices, requests, demands and other
communications under this Agreement or in connection herewith shall be given to
or made upon (i) the Purchasers at each such Purchaser's address set forth on
Exhibit A, with a copy to Wilson Sonsini Goodrich & Rosati, 650 Page Mill Road,
Palo Alto, California 94304, attention: Steven E. Bochner; and (ii) the Company
at Internet Security Systems, Inc. attention: Thomas Noonan, with a copy to
Brobeck, Phleger & Harrison LLP, 301 Congress Avenue, Suite 1200, Austin, Texas
78701, attention: Carmelo M. Gordian.

                           (b) All notices, requests, demands and other
communications given or made in accordance with the provisions of this Agreement
shall be in writing, and shall be sent by airmail, return receipt requested, or
by facsimile with confirmation of receipt, and shall be deemed to be given or
made when receipt is so confirmed.

                           (c) Any party may, by written notice to the other,
alter its address or respondent, and such notice shall be considered to have
been given three (3) days after the airmailing or faxing thereof.

                  8.7      Finder's Fee. Each party represents that it neither
is nor will be obligated for any finder's fee or commission in connection with
this transaction. Each Purchaser agrees to indemnify and to hold harmless the
Company from any liability for any commission or compensation in the nature of a
finder's fee (and the costs and expenses of defending against such liability or
asserted liability) for which each Purchaser or any of its officers, employees,
or representatives is responsible. The Company agrees to indemnify and hold
harmless each Purchaser from any liability for any commission or compensation in
the nature of a finder's fee (and the costs and expenses of defending against
such liability or asserted liability) for which the Company or any of its
officers, employees or representatives is responsible.

                  8.8      Expenses. Each of the Company and the Purchasers
shall bear their own expenses incurred with respect to this Agreement and the
transactions contemplated hereby; however, the Company will pay the reasonable
fees and expenses of one special counsel to the Purchasers, in an amount not to
exceed $15,000.



                                      -20-

<PAGE>   26




                  8.9      Attorneys' Fees. If any action at law or in
equity (including arbitration) is necessary to enforce or interpret the terms of
this Agreement, the prevailing party shall be entitled to reasonable attorneys'
fees, costs and necessary disbursements in addition to any other relief to which
such party may be entitled as determined by such court, equity or arbitration
proceeding.
         
                  8.10     Amendments and Waivers. Any term of this
Agreement may be amended with the written consent of the Company and the holders
of a majority of the Common Stock issued or issuable upon conversion of the
Stock. Any amendment or waiver effected in accordance with this Section 8.10
shall be binding upon the Purchasers and each transferee of the Stock (or the
Common Stock issuable upon conversion thereof), each future holder of all such
securities, and the Company.

                  8.11     Severability. If one or more provisions of this
Agreement are held to be unenforceable under applicable law, portions of such
provisions, or such provisions in their entirety, to the extent necessary, shall
be severed from this Agreement and the balance of the Agreement shall be
interpreted as if such provision were so excluded and shall be enforceable in
accordance with its terms.

                  8.12     Delays or Omissions. No delay or omission to
exercise any right, power or remedy accruing to any holder of any of the Stock,
upon any breach or default of the Company under this Agreement shall impair any
such right, power or remedy of such holder nor shall it be construed to be a
waiver of any such breach or default, or an acquiescence therein, or of or in
any similar breach or default thereafter occurring; nor shall any waiver of any
single breach or default be deemed a waiver of any other breach or default
theretofore or thereafter occurring. Any waiver, permit, consent or approval of
any kind or character on the part of any holder of any breach or default under
this Agreement, or any waiver on the part of any holder of any provisions or
conditions of this agreement, must be in writing and shall be effective only to
the extent specifically set forth in such writing. All remedies, either under
this Agreement or by law or otherwise afforded to any holder shall be cumulative
and not alternative.

                  8.13     Entire Agreement. This Agreement and the documents
referred to herein constitute the entire agreement between the parties hereto
pertaining to the subject matter hereof, and any and all other written or oral
agreements existing between the parties hereto are expressly canceled.


         IN WITNESS WHEREOF, the parties hereto have executed this Series B
Preferred Stock Purchase Agreement as of the date first above written.

                                    COMPANY:

                                    INTERNET SECURITY SYSTEMS, INC.


                                      -21-

<PAGE>   27






                                    By:
                                       -----------------------------------------
                                    Name:
                                         ---------------------------------------
                                    Title:
                                          --------------------------------------


                                    FOUNDERS:


                                    --------------------------------------------
                                                 Christopher Klaus



                                    --------------------------------------------
                                                   Thomas Noonan














                            ***PURCHASE AGREEMENT***



<PAGE>   28



                                    PURCHASERS:


                                    AT & T VENTURE FUND I, L.P.


                                    By;
                                       -----------------------------------------
                                       Name:  Richard S. Bodman
                                       Title: General Partner


                                    GREYLOCK EQUITY LIMITED PARTNERSHIP

                                    By:  Greylock Equity Limited Partnership,
                                          Its Partner


                                    By:
                                       -----------------------------------------
                                       General Partner


                                    --------------------------------------------
                                    John P. Imlay, Jr.


                                    KLEINER PERKINS CAUFIELD & BYERS VIII

                                    By: KPCB VIII Associates


                                    By:
                                       -----------------------------------------
                                       Name:
                                       Title:


                                    KPCB INFORMATION SCIENCES
                                    ZAIBATSU FUND II

                                    By: KPCB VII Associates


                                    By:
                                       -----------------------------------------
                                       Name:
                                       Title:




                            ***PURCHASE AGREEMENT***



<PAGE>   29



                                    KPCB JAVA FUND

                                    By: KPCB VIII Associates


                                    By:
                                       -----------------------------------------
                                       Name:
                                       Title:


                                    SIGMA ASSOCIATES, III, L.P.

                                    By: Sigma Management III, L.P.


                                    By:
                                       -----------------------------------------
                                       General Partner


                                    SIGMA INVESTORS III, L.P.

                                    By: Sigma Management III, L.P.


                                    By:
                                       -----------------------------------------
                                       General Partner


                                    SIGMA PARTNERS III, L.P.

                                    By: Sigma Management III, L.P.


                                    By:
                                       -----------------------------------------
                                       General Partner


                                    VENTURE FUND I, L.P.


                                    By:
                                       -----------------------------------------
                                       Name:  Richard S. Bodman
                                       Title: General Partner



                            ***PURCHASE AGREEMENT***



<PAGE>   30



                                    EXHIBIT A



<TABLE>
<CAPTION>
                                                                        SERIES B
                                                    INVESTMENT          PREFERRED
         PURCHASER                                    AMOUNT              STOCK
         ---------                                  ----------          ---------
<S>                                               <C>                    <C>    
AT & T Venture Fund II, L.P.                      $  855,000.85          337,945
Venture Fund I, L.P.                                  94,998.97           37,549
Two Wisconsin Circle, Suite 610
Chevy Chase, MD 20815
Attn: Mr. Richard S. Bodman

Greylock Equity Limited Partnership                  750,139.94          296,498
c/o Greylock Management Corporation
755 Page Mill Road A-100
Palo Alto, CA 94304
Attn:  Mr. Roger Evans

John P. Imlay, Jr                                     33,970.31           13,427
[Address]

Kleiner Perkins Caufield & Byers VIII                825,275.88          326,196
KPCB Information Sciences Zaibatsu                    75,024.62           29,654
Fund II
KPCB Java Fund                                     2,100,699.48          830,316
c/o Kleiner Perkins Caufield & Byers
2750 Sand Hill Road
Menlo Park, California 94025
Attn:  Mr. Ted Schlein

Sigma Partners III, L.P.                             427,357.48          168,916
Sigma Associates, III, L.P.                          105,764.12           41,804
Sigma Investors III, L.P.                             11,769.56            4,652
c/o Sigma Partners
2884 Sand Hill Road, Suite 121
Menlo Park, CA 94025
Attn: Wade Woodson

TOTAL                                             $5,280,001.21        2,086,957
                                                  =============        =========
</TABLE>





                            ***PURCHASE AGREEMENT***


<PAGE>   1

                                                                   EXHIBIT 10.10

                          AMENDED AND RESTATED RIGHT OF
                       FIRST REFUSAL AND CO-SALE AGREEMENT


         This Agreement is made as of February 14, 1997, by and among Internet
Security Systems, Inc., a Georgia corporation (the "COMPANY"), the holders of
shares of the Company's Series A Preferred Stock (the "SERIES A HOLDERS"), the
holders of shares of the Company's Series B Preferred Stock (the "SERIES B
HOLDERS") and those shareholders of the Company listed on Exhibit A hereto (the
"SHAREHOLDERS" and each individually a "SHAREHOLDER"). The Series A Holders and
Series B Holders are referred to collectively herein as the "PREFERRED HOLDERS."

                                    RECITALS

         A.       The Series A Holders possess co-sale and first refusal rights
pursuant to a Right of First Refusal and Co-Sale Agreement dated as of February
2, 1996, as amended, between the Company, the Series A Holders and certain of
the Shareholders (the "ORIGINAL AGREEMENT").

         B.       The Series A Holders and the Shareholders desire to amend and
restate the Original Agreement and to accept the rights created pursuant hereto
in lieu of the rights granted to them under the Original Agreement.

         C.       The Shareholders currently own capital stock and/or stock
options issued by the Company.

         D.       The Series B Holders intend to purchase from the Company
shares of its Series B Preferred Stock, pursuant to the Series B Preferred Stock
Purchase Agreement between the Company and the Series B Holders dated of even
date herewith (the "SERIES B PURCHASE AGREEMENT").

         E.       To induce the Series B Holders to enter into this Agreement
and the Series B Purchase Agreement, each Shareholder has agreed to grant the
Holders (as defined below) and the Company certain rights of first refusal with
respect to equity securities owned by each Shareholder and any other equity
securities of the Company hereafter owned or acquired by each Shareholder.

         F.       To induce the Series B Holders to enter this Agreement and the
Series B Purchase Agreement, each Shareholder has agreed to grant to the Series
B Holders certain rights of co-sale with respect to equity securities owned by
each Shareholder and any other equity securities of the Company hereafter owned
or acquired by each Shareholder (the "STOCK").

         NOW, THEREFORE, in consideration of the mutual promises herein
contained, and other consideration, the receipt and adequacy of which is hereby
acknowledged, the parties hereto hereby amend and restate the Original Agreement
in its entirety and agree as follows:

         1.       Certain Definitions. For purposes of this Agreement, the
following terms have the following meanings:



<PAGE>   2



                  (a)      "HOLDER" means the Preferred Holders and the
Shareholders.

                  (b)      "IPO" means the closing of an underwritten public
offering of the Company's securities registered under the Securities Act of
1933, as amended.

                  (c)      "SELLER" means any Shareholder proposing to transfer
Common Stock.

                  (d)      "PREFERRED HOLDER'S SHARE" means, as to the Right of
Co-Sale, the percentage determined by dividing (A) the number of shares of Stock
held by the Preferred Holder by (B) the number of shares of Stock held by the
Seller and all Preferred Holders participating in the Right of Co-Sale.

                  (e)      "OFFERED STOCK" means all Stock proposed to be
Transferred by the Seller.

                  (f)      "RIGHT OF CO-SALE" means the right of co-sale, to
which the Stock held by Christopher Klaus and Thomas Noonan is subject, provided
to the Preferred Holders in Section 4 of this Agreement.

                  (g)      "RIGHT OF FIRST REFUSAL" means the right of first
refusal over Common Stock provided to the Preferred Holders in Section 3 of this
Agreement.

                  (h)      "TRANSFER" means and includes any sale, assignment,
encumbrance, hypothecation, pledge, conveyance in trust, gift, transfer by
bequest, devise or descent, or other transfer or disposition of any kind,
including but not limited to transfers to receivers, levying creditors, trustees
or receivers in bankruptcy proceedings or general assignees for the benefit of
creditors, whether voluntary or by operation of law, directly or indirectly,
except:

                           (i)   any bona fide pledge if the pledgee executes a
counterpart copy of this Agreement and becomes bound thereby as a Shareholder;

                           (ii)  any transfers of Stock by a Seller to the
Seller's spouse, lineal descendant or antecedent, father, mother, brother or
sister of the Seller, the adopted child or adopted grandchild of the Seller, or
the spouse of any child, adopted child, grandchild or adopted grandchild of the
Seller, or to a trust or trusts for the exclusive benefit of the Seller of the
Seller's family members as described in this Section, or transfers of Stock by
the Seller by devise or descent or transfers of Stock to a general or limited
partner of the Seller; provided that, in all cases, the transferee or other
recipient executes a counterpart copy of this Agreement and becomes bound
thereby as a Shareholder; or

                           (iii) a bona fide pledge if the pledgee is a
Preferred Holder.

         2.       Notice of Proposed Transfer. Before any Seller may effect any
Transfer of Stock, the Seller must give at the same time to the Company and to
the Preferred Holders a written notice signed by the Seller (the "SELLER'S
NOTICE") stating (a) the Seller's bona fide intention to Transfer



                                       -2-

<PAGE>   3



such Offered Stock and the name and address of the proposed Transferee; (b) the
number of shares of the Offered Stock; and (c) the bona fide cash price or, in
reasonable detail, other consideration, per share for which the Seller proposes
to Transfer such Offered Stock (the "OFFERED PRICE"). Upon the request of the
Company or any of the Preferred Holders, the Seller will promptly furnish
information, to the Company and to the Preferred Holders, as may be reasonably
requested to establish that the offer and proposed transferee (the "TRANSFEREE")
are bona fide.

         3.       Holders' Right of First Refusal.

                  (a)      The Right.

                           (i)   Company's Initial Right. The Company has the
right of first refusal to purchase all or any part of the Offered Stock, if the
Company gives written notice of the exercise of such right to the Seller within
thirty (30) days (the "COMPANY'S REFUSAL PERIOD") after the date of the Seller's
Notice to the Company. If the Company desires to purchase less than all of the
Offered Stock, within ten (10) days after expiration of the Company's Refusal
Period, the Company will give written notice to each Holder specifying the
number of shares of Offered Stock that were not subscribed by the Company
exercising its Rights of First Refusal (the "COMPANY'S NOTICE").

                           (ii)  Holders' Right. If the Company desires to
purchase less than all of the Offered Stock, the Holders and their assignees
have the right of first refusal to purchase all or any part of the remaining
Offered Stock; provided, that each Holder gives written notice of the exercise
of such right to the Seller within thirty (30) days (the "HOLDERS' REFUSAL
PERIOD") after the date of the Company's Notice to the Holders. To the extent
the aggregate number of shares the Holders desire to purchase exceeds the
Offered Stock available, each Holder will be entitled to purchase a fraction of
the Offered Stock, the numerator of which is the number of shares of Stock held
by such Holder and the denominator of which is the number of Shares of Stock
held by all Holders exercising their Right of First Refusal. Within ten (10)
days after expiration of the Holders' Refusal Period, the Seller will give
written notice to the Company and each Holder specifying the number of shares of
Offered Stock that was subscribed by the Holders exercising their Rights of
First Refusal (the "CONFIRMATION NOTICE").

                  (b)      Purchase Price. The purchase price for the Offered
Stock to be purchased by the Company or by a Holder exercising its Right of
First Refusal under this Agreement will be the Offered Price, and will be
payable as set forth in Section 3(c) hereof. If the Offered Price includes
consideration other than cash, the cash equivalent value of the non-cash
consideration will be determined by the Board of Directors of the Company in
good faith, which determination will be binding upon the Company, each Holder
and the Seller, absent fraud or error.

                  (c)      Payment. Payment of the purchase price for the
Offered Stock purchased by the Company or by a Holder exercising its Right of
First Refusal will be made within thirty (30) days after the later of (i) the
end of the Company's Refusal Period, or (ii) the delivery of the Company's
Notice and the end of the Holders' Refusal Period. Payment of the purchase price
will be made, at the option of the Company or the exercising Holder, (i) in cash
(by check), (ii) by



                                       -3-

<PAGE>   4



cancellation of all or a portion of any outstanding indebtedness of the Seller
to the Company or the Holder, as the case may be, or (iii) by any combination of
the foregoing.

                  (d)      Rights as a Shareholder. If the Company or any Holder
exercises its Right of First Refusal to Purchase the Offered Stock, then, upon
the date the notice of such exercise is given by the Company or any Holder, the
Seller will have no further rights as a holder of the Offered Stock except the
right to receive payment for the Offered Stock from the Company or the Holder,
as the case may be, in accordance with the terms of this Agreement, and the
Seller will forthwith cause all certificate(s) evidencing such Offered Stock to
be surrendered for transfer to the Company or the Holder, as the case may be.

                  (e)      Seller's Right To Transfer. If the Company and each
Holder have not elected to purchase the Offered Stock, then, subject to the
Preferred Holders' Right of Co-Sale as defined in Section 4 hereof, the Seller
may transfer that portion of the Offered Stock permitted to be sold, to any
person named as a purchaser or other Transferee in the Seller's Notice, at the
Offered Price or at a higher price, provided that such Transfer (i) is
consummated within thirty (30) days after the end of the Holders' Refusal
Period, (ii) is on terms no more favorable than the terms proposed in the
Seller's Notice and (iii) is in accordance with all the terms of this Agreement.
If the Offered Stock is not so Transferred during such thirty (30) day period,
then the Seller may not Transfer any of such Offered Stock without complying
again in full with the provisions of this Agreement.

         4.       Preferred Holders' Right of Co-Sale.

                  (a)      Right of Co-Sale. If the Company and the Holders have
waived or failed to timely exercise their Rights of First Refusal under
paragraph 3 with respect to any portion of the Offered Stock, and if the Seller
is either Thomas Noonan ("NOONAN") or Christopher Klaus ("KLAUS") and Noonan or
Klaus offers a number of shares of Stock exceeding ten percent (10%) of their
respective total holdings of Stock, then, subject to the Preferred Holders'
Right of Co-Sale, Noonan or Klaus may Transfer to the Transferee such Offered
Stock, as is specified in the Seller's Notice, by giving written notice to each
Preferred Holder within fifteen (15) days after the date of the expiration of
the Preferred Holders' Refusal Period (the "RIGHT OF CO-SALE NOTICE"),
specifying the date of the Transfer of the Offered Stock to such transferee
which shall not occur within fifteen (15) days of the Right of Co-Sale Notice
(the "CLOSING"), and the number of shares and type of Stock that Noonan or Klaus
desire to Transfer to the Transferee. If Noonan or Klaus desire to transfer to
the Transferee such Offered Stock, the Preferred Holders shall have the right to
require, as a condition to such sale or transfer, that Noonan or Klaus sell to
the Transferee, at the same price per share and on the same terms and conditions
as involved in such sale or disposition by Noonan or Klaus, a number of shares
of the Preferred Holder's shares equal to a percentage of the Offered Stock
(regardless of whether the Offered Stock consists of preferred or common issued
upon conversion of the preferred) equivalent to the Preferred Holder's Share.
This Right of Co-Sale shall not apply with respect to Offered Stock sold or to
be sold to Preferred Holders under the Right of First Refusal.




                                       -4-

<PAGE>   5



                  (b)      Consummation of Co-Sale. A Preferred Holder may
exercise the Right of Co-Sale by delivering to Noonan or Klaus at or before the
Closing, one or more certificates, properly endorsed for Transfer, representing
a number of shares not to exceed such Preferred Holder's Share, representing
such Stock to be Transferred by Noonan or Klaus on behalf of the Preferred
Holder. If the Preferred Holder does not hold a certificate in that series,
class or type of stock representing the number of securities to be sold by such
Preferred Holder pursuant to this Section 4, then the Company shall promptly
issue a certificate representing the proper number of shares to be sold pursuant
to this Right of Co-Sale. Following the Closing, the Company shall deliver a
certificate for the remaining balance of the securities held by the Preferred
Holder, if any, to such Preferred Holder. At the Closing, such certificates or
other instruments will be Transferred and delivered to the Transferee as set
forth in the Right of Co-Sale Notice in consummation of the transfer of the
Offered Stock pursuant to the terms and conditions specified in the Right of
Co-Sale Notice, and the Seller will remit, or will cause to be remitted, to each
participating Preferred Holder, within ten (10) days after such Closing, that
portion of the proceeds of the Transfer to which each participating Preferred
Holder is entitled by reason of each Preferred Holder's participation in such
Transfer pursuant to the Right of Co-Sale.

         5.       Multiple Series, Class or Type of Stock. If the Offered Stock
consists of more than one series, class or type of Stock, the Seller has the
right to Transfer hereunder each such series, class or type; provided, however,
that if, as to the Right of Co-Sale, a Preferred Holder does not hold any of
such series, class or type, and the proposed transferee is not willing, at the
Closing, to purchase some other series, class or type of Stock from such
Preferred Holder, or is unwilling to purchase any Stock from such Preferred
Holder at the Closing, then the Seller may complete the sale of the Offered
Stock to the proposed Transferee and such Preferred Holder will have the put
right (the "PUT RIGHT") set forth in Section 6(b) hereof.

         6.       Refusal to Transfer: Put Right.

                  (a)      Refusal to Transfer. Any attempt by any Shareholder
to transfer any Stock in violation of any provision of this Agreement will be
void. The Company will not be required (i) to transfer on its books any Stock
that has been sold, gifted or otherwise transferred in violation of this
Agreement, or (ii) to treat as owner of such Stock, or to accord the right to
vote or pay dividends to any purchaser, donee or other transferee to whom such
Stock may have been so transferred.

                  (b)      Put Right. If Noonan or Klaus transfers any Stock in
contravention of the Preferred Holders' Right of Co-Sale under this Agreement (a
"PROHIBITED TRANSFER"), or if the proposed transferee of Offered Stock desires
to purchase a class, series or type of stock offered by Noonan or Klaus not held
by a Preferred Holder or is unwilling to purchase any Stock from a Preferred
Holder and Noonan or Klaus, as the case may be, completes a transfer to such
proposed Transferee, such Preferred Holder may, by delivery of written notice to
Noonan or Klaus (a "PUT NOTICE") within ten (10) days after (i) the Closing as
defined in subsection 4(a) above, or (ii) the date on which such Preferred
Holder becomes aware of the Prohibited Transfer or the terms thereof, require
Noonan or Klaus to purchase from such Preferred Holder, for cash or such other



                                       -5-

<PAGE>   6



consideration as the Shareholder received in the Prohibited Transfer or at the
Closing, a number of shares of Stock (of the same class or type as transferred
in the Prohibited Transfer or at the Closing if such Preferred Holder then owns
Stock of such class or type; otherwise of Series A Preferred Stock, Series B
Preferred Stock or Common Stock) having a purchase price equal to the aggregate
purchase price Noonan or Klaus would have received in the closing of such
Prohibited Transfer if such Preferred Holder had elected to exercise its right
of Co-Sale with respect thereto or in the Closing if the proposed transferee had
been willing to purchase the Stock of the Preferred Holder. The closing of such
sale to Noonan or Klaus will occur within ten (10) days after the date of such
Preferred Holder's Put Notice to Noonan or Klaus.

         7.       Restrictive Legend and Stop-Transfer Orders.

                  (a)      Legend. Each Shareholder understands and agrees that
the Company will cause the legend set forth below, or a legend substantially
equivalent thereto, to be placed upon any certificate(s) or other documents or
instruments evidencing ownership of Stock by the Shareholder:

         THE SHARES REPRESENTED BY THIS CERTIFICATE ARE SUBJECT TO CERTAIN
         RIGHTS OF FIRST REFUSAL AND RIGHTS OF CO-SALE AS SET FORTH IN A RIGHT
         OF FIRST REFUSAL AND CO-SALE AGREEMENT DATED FEBRUARY 14, 1997, ENTERED
         INTO BY THE HOLDER OF THESE SHARES, THE COMPANY AND CERTAIN
         SHAREHOLDERS OF THE COMPANY. A COPY OF SUCH AGREEMENT IS ON FILE AT THE
         PRINCIPAL OFFICE OF THE COMPANY. SUCH RIGHTS OF FIRST REFUSAL AND
         RIGHTS OF CO-SALE ARE BINDING ON CERTAIN TRANSFEREES OF THESE SHARES.

                  (b)      Stop Transfer Instructions. Each Shareholder agrees,
to ensure compliance with the restrictions referred to herein, that the Company
may issue appropriate "stop transfer" certificates or instructions and that, if
the Company transfers its own securities, it may make appropriate notations to
the same effect in its records.

                  (c)      Transfers. No securities shall be transferred by a
Shareholder unless (i) such transfer is made in compliance with the all of the
terms of this Agreement and in compliance with the terms of applicable federal
and state securities laws and (ii) prior to such transfer, the transferee or
transferees sign a counterpart to this Agreement pursuant to which it or they
agree to be bound by the terms of this Agreement. The Company shall not be
required (a) to transfer on its books any shares that shall have been sold or
transferred in violation of any of the provisions of this Agreement or (b) to
treat as the owner of such shares or to accord the right to vote as such owner
or to pay dividends to any transferee to whom such shares shall have been so
transferred.

         8.       Termination and Waiver.

                  (a)      Termination. The Right of First Refusal and Right of
Co-Sale will terminate upon the earliest to occur of (i) the IPO, (ii) the date
on which this Agreement is terminated by a writing executed by holders of  
66 2/3% of the shares then held by the Preferred Holders, (iii) the



                                       -6-

<PAGE>   7



dissolution of the Company, (iv) the effective date of a consolidation or merger
with or into another corporation as a result of which the shareholders of the
Company immediately prior to such consolidation or merger will own less than
fifty percent (50%) of the outstanding stock of the surviving corporation, or
(v) as to any Holder when such Holder ceases to own, in the aggregate, at least
one-half of the shares of Common Stock or Preferred Stock (or Common Stock
issuable upon conversion of the Preferred Stock) owned by such Holder as of the
date of execution of this Agreement. The Company's Right of First Refusal will
terminate upon the earliest to occur of (a) a written election of the Company
pursuant to an action by the Board of Directors or (b) the occurrence of any of
(i), (iii) or (iv) in the preceding sentence.

                  (b)      Waiver. Any waiver by a party of its rights hereunder
will be effective only if evidenced by a written instrument executed by such
party or its authorized representative.

         9.       Miscellaneous Provisions.

                  (a)      Notice. Any notice required or permitted to be given
to a party pursuant to the provisions of this Agreement will be in writing and
will be effective and or (ii) the date of delivery by facsimile, or (iii) the
business day after deposit with a nationally-recognized courier or overnight
service, including Express Mail, for United States deliveries or (iii) five (5)
business days after deposit in the United States mail by registered or certified
mail for United States deliveries. All notices not delivered personally or by
facsimile will be sent with postage and other charges prepaid and properly
addressed to the party to be notified at the address set forth below such
party's signature on this Agreement or at such other address as such party may
designate by ten (10) days advance written notice to the other parties hereto.
All notices for delivery outside the United States will be sent by facsimile, or
by nationally recognized courier or overnight service. Any notice given
hereunder to more than one person will be deemed to have been given, for
purposes of counting time periods hereunder, on the date given to the last party
required to be given such notice. Notices to the Company will be marked to the
attention of the President.

                  (b)      Binding on Successors and Assigns: Inclusion Within
Certain Definitions. This Agreement, and the rights and obligations of the
parties hereunder, will inure to the benefit of, and be binding upon, their
respective successors, assigns, heirs, executors, administrators and legal
representatives. Any permitted transferee of a Shareholder who is required to
become a party hereto will be considered a "Shareholder" for purposes of this
Agreement and any permitted transferee of Stock held by the Seller will be
considered a "Seller" for purposes of this Agreement.

                  (c)      Severability. If any provision of this Agreement is
held to be invalid, illegal or unenforceable in any respect, such provision will
be enforced to the maximum extent possible and such invalidity, illegality or
unenforceability will not affect any other provision of this Agreement, and this
Agreement will be construed as if such invalid, illegal or unenforceable
provision had (to the extent not enforceable) never been contained herein.

                  (d)      Amendment. This Agreement may be amended only by a
written instrument executed by the Company, a majority in interest of the
Shareholders, and the Preferred Holders.



                                       -7-

<PAGE>   8




                  (e)      Continuity of Other Restrictions. Any Stock not
purchased by the Company or any Preferred Holder under their Right of First
Refusal hereunder will continue to be subject to all other restrictions imposed
upon such Stock by law, including any restrictions imposed under the Company's
Articles of Incorporation or By-laws, or by agreement.

                  (f)      Governing Law. This Agreement will be governed by and
construed in accordance with the laws of the State of California without regard
to conflict of law rules.

                  (g)      Obligation of Company: Binding Nature of Exercise.
The Company agrees to use its best efforts to enforce the terms of this
Agreement, to inform the Preferred Holders of any breach hereof (to the extent
the Company has knowledge thereof) and to assist the Preferred Holders in the
exercise of its rights and the performance of its obligations hereunder. Any
exercise of the Right of First Refusal or Right of Co-Sale will be binding upon
the party so exercising, and may not be withdrawn without the written consent of
the Company or the Shareholder as to whom it is given, as the case may be,
except that such exercise may be withdrawn unilaterally by the exercising party
if there is any legal prohibition as to a party's consummation of its purchase
or sale hereunder.

                  (h)      Counterparts. This Agreement may be executed in
any number of counterparts, each of which when so executed and delivered will be
deemed an original, and all such counterparts together will constitute one and
the same instrument.

                  (i)      Further Assurances. Each party hereby agrees to
execute and deliver all such further instruments and documents and take all such
other actions as the other party may reasonably request in order to carry out
the intent and purposes of this Agreement.

                  (j)      Conflict. In the event of any conflict between the
terms of this Agreement and the Company's Articles of Incorporation, or its
By-laws, the terms of the Company's Articles of Incorporation, or its By-laws,
as the case may be, will control. In the event of any conflict between the terms
of this Agreement and any other agreement to which a Shareholder is a party or
by which such Shareholder is bound, the terms of this Agreement will control. In
the event of any conflict between the Company's books and records and this
Agreement or any notice delivered hereunder, the Company's books and records
will control absent fraud or error.





                                       -8-

<PAGE>   9



         IN WITNESS WHEREOF, the parties hereto have executed this Agreement of
the day and year first above written.


                                    COMPANY:

                                    INTERNET SECURITY SYSTEMS, INC.

                                    By:
                                       ----------------------------------------


                                    SHAREHOLDERS:


                                    -------------------------------------------
                                    Christopher Klaus


                                    -------------------------------------------
                                    Thomas Noonan


                                    -------------------------------------------
                                    Kevin O'Connor







               ***RIGHT OF FIRST REFUSAL AND CO-SALE AGREEMENT***

<PAGE>   10



                                    PREFERRED HOLDERS:


                                    AT & T VENTURE FUND II, L.P.


                                    By:
                                        ----------------------------------------
                                        Name:  Richard S. Bodman
                                        Title: General Partner


                                    GREYLOCK EQUITY LIMITED PARTNERSHIP

                                    By Greylock Equity GP Limited Partnership
                                    Its General Partner


                                    By:
                                        ----------------------------------------


                                    --------------------------------------------
                                    John P. Imlay, Jr.


                                    KLEINER PERKINS CAUFIELD & BYERS VIII

                                    By:  KPCB VIII Associates


                                    By:
                                        ----------------------------------------
                                         Name:
                                         Title:


                                    KPCB INFORMATION SCIENCES
                                    ZAIBATSU FUND II

                                    By:  KPCB VII Associates


                                    By:
                                        ----------------------------------------
                                         Name:
                                         Title:


               ***RIGHT OF FIRST REFUSAL AND CO-SALE AGREEMENT***



<PAGE>   11


                                    KPCB JAVA FUND

                                    By:  KPCB VIII Associates


                                    By:
                                        ----------------------------------------
                                        Name:
                                        Title:


                                    SIGMA ASSOCIATES, III, L.P.

                                    By:  Sigma Management III, L.P.


                                    By:
                                        ----------------------------------------
                                        General Partner


                                    SIGMA INVESTORS III, L.P.

                                    By:  Sigma Management III, L.P.


                                    By:
                                        ----------------------------------------
                                        General Partner


                                    SIGMA PARTNERS III, L.P.

                                    By:  Sigma Management III, L.P.


                                    By:
                                        ----------------------------------------
                                        General Partner


                                    VENTURE FUND I, L.P.


                                    By:
                                        ----------------------------------------
                                        Name:  Richard S. Bodman
                                        Title: General Partner


               ***RIGHT OF FIRST REFUSAL AND CO-SALE AGREEMENT***



<PAGE>   1
                                                                    EXHIBIT 21.1



                        Subsidiaries of the Registrant.


1.   Internet Security Systems, Inc. (Georgia).

2.   Internet Security Systems Europe N.V. (Belgium).

3.   Internet Security Systems K.K. (Japan).

   
4.   ISS Investment Holdings, Inc. (Delaware)
    


<PAGE>   1
                                                                    EXHIBIT 23.1





                        CONSENT OF INDEPENDENT AUDITORS


We consent to the reference to our firm under the caption "Experts" and to the
use of our reports dated January 13, 1998, in Amendment No. 1 to the
Registration Statement (Form S-1 No. 333-44529) and related Prospectus of ISS
Group, Inc. for the registration of 3,000,000 shares of its Common Stock.


                                                         /S/ Ernst & Young LLP


Atlanta, Georgia
March 2, 1998



© 2022 IncJournal is not affiliated with or endorsed by the U.S. Securities and Exchange Commission