ISS GROUP INC
S-1, 1999-01-29
PREPACKAGED SOFTWARE
Previous: HUGHES FUNDS INC, 485APOS, 1999-01-29
Next: RESIDENTIAL ASSET FUNDING CORP, 8-K, 1999-01-29



<PAGE>   1
 
   AS FILED WITH THE SECURITIES AND EXCHANGE COMMISSION ON JANUARY 29, 1999.
                                                      REGISTRATION NO. 333-
- --------------------------------------------------------------------------------
- --------------------------------------------------------------------------------
                       SECURITIES AND EXCHANGE COMMISSION
                             WASHINGTON, D.C. 20549
                             ----------------------
 
                                    FORM S-1
                             REGISTRATION STATEMENT
                                     UNDER
                           THE SECURITIES ACT OF 1933
                             ----------------------
 
                                ISS GROUP, INC.
             (Exact name of registrant as specified in its charter)
 
<TABLE>
<S>                                    <C>                                    <C>
               DELAWARE                                 7372                                58-2362189
   (State or other jurisdiction of          (Primary Standard Industrial                 (I.R.S. Employer
    incorporation or organization)          Classification Code Number)               Identification Number)
</TABLE>
 
                          6600 PEACHTREE-DUNWOODY ROAD
                           300 EMBASSY ROW, SUITE 500
                             ATLANTA, GEORGIA 30328
                                 (678) 443-6000
(Address, including zip code, and telephone number, including area code, of the
                   registrant's principal executive offices)
                             ----------------------
 
                                THOMAS E. NOONAN
                CHAIRMAN, PRESIDENT AND CHIEF EXECUTIVE OFFICER
                                ISS GROUP, INC.
                          6600 PEACHTREE-DUNWOODY ROAD
                           300 EMBASSY ROW, SUITE 500
                             ATLANTA, GEORGIA 30328
                           TELEPHONE: (678) 443-6000
                           FACSIMILE: (678) 443-6477
 (Name, address, including zip code, and telephone number, including area code,
                             of agent for service)
 
                                   COPIES TO:
 
<TABLE>
<S>                                                      <C>
                CARMELO M. GORDIAN, P.C.                                  KEITH F. HIGGINS, ESQ.
                 S. MICHAEL DUNN, P.C.                                 CHRISTOPHER J. AUSTIN, ESQ.
            BROBECK, PHLEGER & HARRISON LLP                                    ROPES & GRAY
            301 CONGRESS AVENUE, SUITE 1200                              ONE INTERNATIONAL PLACE
                  AUSTIN, TEXAS 78701                                  BOSTON, MASSACHUSETTS 02110
               TELEPHONE: (512) 477-5495                                TELEPHONE: (617) 951-7000
               FACSIMILE: (512) 477-5813                                FACSIMILE: (617) 951-7050
</TABLE>
 
                             ----------------------
 
    APPROXIMATE DATE OF COMMENCEMENT OF PROPOSED SALE TO THE PUBLIC:  As soon as
practicable after the effective date of this Registration Statement.
 
    If any of the securities being registered on this Form are to be offered on
a delayed or continuous basis pursuant to Rule 415 under the Securities Act of
1933, as amended, check the following box.  [ ]
 
    If this Form is filed to register additional securities for an offering
pursuant to Rule 462(b) under the Securities Act, please check the following
box and list the Securities Act registration statement number of the earlier
effective registration statement for the same offering.  [ ] ---------------

    If this Form is a post-effective amendment filed pursuant to Rule 462(c)
under the Securities Act, check the following box and list the Securities Act
registration statement number of the earlier effective registration statement
for the same offering.  [ ] ---------------
 
    If this Form is a post-effective amendment filed pursuant to Rule 462(d)
under the Securities Act, check the following box and list the Securities Act
registration statement number of the earlier effective registration statement
for the same offering.  [ ] ---------------
 
    If delivery of the prospectus is expected to be made pursuant to Rule 434,
please check the following box.  [ ]
 
                        CALCULATION OF REGISTRATION FEE
 
<TABLE>
<CAPTION>
- -------------------------------------------------------------------------------------------------------------------------------
- -------------------------------------------------------------------------------------------------------------------------------
                                                                   PROPOSED MAXIMUM     PROPOSED MAXIMUM
          TITLE OF EACH CLASS OF                 AMOUNT TO          OFFERING PRICE         AGGREGATE            AMOUNT OF
        SECURITIES TO BE REGISTERED          BE REGISTERED (1)     PER SHARE(2)(3)     OFFERING PRICE(2)     REGISTRATION FEE
- -------------------------------------------------------------------------------------------------------------------------------
<S>                                         <C>                  <C>                  <C>                  <C>
Common Stock, $0.001 par value.............   2,760,000 shares          $60.44            $166,814,400           $46,375
- -------------------------------------------------------------------------------------------------------------------------------
- -------------------------------------------------------------------------------------------------------------------------------
</TABLE>
 
(1) Includes 375,000 shares that the Underwriters have the option to purchase to
    cover over-allotments, if any.
(2) Estimated solely for the purpose of computing the amount of the registration
    fee pursuant to Rule 457(a).
(3) A portion of the shares to be registered represents shares that are to be
    offered outside the United States but that may be resold from time to time
    in the United States. Such shares are not being registered for the purposes
    of sales outside the United States.
 
    THE REGISTRANT HEREBY AMENDS THIS REGISTRATION STATEMENT ON SUCH DATE OR
DATES AS MAY BE NECESSARY TO DELAY ITS EFFECTIVE DATE UNTIL THE REGISTRANT SHALL
FILE A FURTHER AMENDMENT THAT SPECIFICALLY STATES THAT THIS REGISTRANT STATEMENT
SHALL THEREAFTER BECOME EFFECTIVE IN ACCORDANCE WITH SECTION 8(A) OF THE
SECURITIES ACT OF 1933, AS AMENDED, OR UNTIL THE REGISTRATION STATEMENT SHALL
BECOME EFFECTIVE ON SUCH DATE AS THE SECURITIES AND EXCHANGE COMMISSION, ACTING
PURSUANT TO SUCH SECTION 8(A), MAY DETERMINE.
- --------------------------------------------------------------------------------
- --------------------------------------------------------------------------------
<PAGE>   2
 
THE INFORMATION IN THIS PRELIMINARY PROSPECTUS IS NOT COMPLETE AND MAY BE
CHANGED. THESE SECURITIES MAY NOT BE SOLD UNTIL THE REGISTRATION STATEMENT FILED
WITH SECURITIES AND EXCHANGE COMMISSION IS EFFECTIVE. THIS PRELIMINARY
PROSPECTUS IS NOT AN OFFER TO SELL NOR DOES IT SEEK AN OFFER TO BUY THESE
SECURITIES IN ANY JURISDICTION WHERE THE OFFER OR SALE IS NOT PERMITTED.
 
                 SUBJECT TO COMPLETION. DATED JANUARY 29, 1999.
 
                                2,400,000 Shares
 
                                   (ISS Logo)
                                ISS GROUP, INC.
                                  Common Stock
                             ----------------------
     This is an offering of shares of common stock of ISS Group, Inc. This
prospectus relates to an offering of 1,920,000 shares in the United States. In
addition, 480,000 shares are being offered outside the United States in an
international offering.
 
     ISS Group is offering 1,200,000 shares to be sold in the offering. The
selling stockholders identified in this prospectus are offering an additional
1,200,000 shares. ISS Group will not receive any of the proceeds from the sale
of the shares sold by the selling stockholders.
 
     The common stock is traded on the Nasdaq National Market under the symbol
"ISSX". On January 28, 1999, the last reported sale price for our common stock
on the Nasdaq National Market was $62.94 per share.
 
     See "Risk Factors" beginning on page 3 to read about certain factors you
should consider before buying shares of the common stock.
                             ----------------------
     NEITHER THE SECURITIES AND EXCHANGE COMMISSION NOR ANY OTHER REGULATORY
BODY HAS APPROVED OR DISAPPROVED OF THESE SECURITIES OR PASSED UPON THE ADEQUACY
OR ACCURACY OF THIS PROSPECTUS. ANY REPRESENTATION TO THE CONTRARY IS A CRIMINAL
OFFENSE.
                             ----------------------
 
<TABLE>
<CAPTION>
                                                                   Per Share        Total
                                                                   ---------        -----
<S>                                                                <C>             <C>
Initial public offering price...............................        $              $
Underwriting discount.......................................        $              $
Proceeds, before expenses, to ISS Group.....................        $              $
Proceeds to the selling stockholders........................        $              $
</TABLE>
 
     The U.S. underwriters may, under certain circumstances, purchase up to an
additional 288,000 shares from ISS Group and the selling stockholders at the
initial public offering price less the underwriting discount. The international
underwriters may similarly purchase up to an aggregate of an additional 72,000
shares.
                             ----------------------
     The underwriters expect to deliver the shares against payment in New York,
New York on             , 1999.
 
GOLDMAN, SACHS & CO.
            DAIN RAUSCHER WESSELS
               A DIVISION OF DAIN RAUSCHER
                     INCORPORATED
                          WARBURG DILLON READ LLC
                                      BANCBOSTON ROBERTSON STEPHENS
                             ----------------------
 
                      Prospectus dated             , 1999.
<PAGE>   3
                             ----------------------
 
                               TABLE OF CONTENTS
 
<TABLE>
<CAPTION>
                                          Page
                                          ----
<S>                                       <C>
Prospectus Summary......................    1
Risk Factors............................    3
Use of Proceeds.........................   12
Price Range of Common Stock.............   12
Dividend Policy.........................   12
Capitalization..........................   13
Dilution................................   14
Selected Consolidated Financial Data....   15
Management's Discussion and Analysis of
  Financial Condition and Results of
  Operations............................   16
Business................................   24
Management..............................   43
Certain Transactions....................   52
Principal and Selling Stockholders......   54
Description of Securities...............   56
Shares Eligible for Future Sale.........   60
Validity of Common Stock................   62
Experts.................................   62
Additional Information..................   62
Index to Consolidated Financial
  Statements............................  F-1
Underwriting............................  U-1
</TABLE>
 
<PAGE>   4


                       [Inside Front Cover of Prospectus]


     Picture headed "Adaptive Network Security Process" depicts a large circle 
with three arrows linked together to form the circle. One arrow states the term 
"monitor", the second arrow states the term "detect" and the third arrow states 
the term "respond". In the center of this circle is the phrase "Enterprise 
Security Policy". In the upper right hand section of the graphic outside of the 
"monitor" section of the circle are the terms "Applications", "Databases", 
"Operating Systems" and "Networks". In the lower right hand section of the 
graphic outside of the "detect" section of the circle are the terms "Policy 
Violations", "Vulnerabilities" and "Threats". In the left hand section of 
the graphic outside of the "respond" section of the circle are the terms 
"Alarms", "Corrective Action", "Active Response" and "Actionable Information". 
At the lower far right hand corner of the graphic is the ISS logo and the terms 
"ISS Internet Security Systems."

     Our trademarks include Database Scanner, Firewall Scanner, Internet 
Scanner, Internet Security Systems, ISS, RealSecure, RealSecure Agents, 
RealSecure Engine, RealSecure Manager, SAFEsuite, SAFEsuite Decisions, 
System Scanner, Web Security Scanner and the ISS logo. All other trademarks or 
trade names referred to in this Prospectus are the property of their respective 
owners.

<PAGE>   5
 
                               PROSPECTUS SUMMARY
 
     You should read the following summary together with the more detailed
information and consolidated financial statements and related notes appearing
elsewhere in this prospectus. Unless otherwise indicated, all information in
this prospectus, including share and per share information, assumes neither the
exercise of stock options after December 31, 1998 nor the exercise of the
underwriters' over-allotment option.
 
                                ISS GROUP, INC.
 
     We are a leading provider of network security monitoring, detection and
response solutions that protect the security and integrity of enterprise
information systems. Our SAFEsuite family of products protects distributed
computing environments, such as internal corporate networks, inter-company
networks and the Internet, from attacks, misuse and security policy violations.
Our innovative Adaptive Network Security approach uses continuous security risk
monitoring and response to develop and enforce an active network security
policy. We also offer professional services that enable us to deliver
comprehensive solutions to our customers.
 
     The proliferation and growth of corporate intranets and the growth of
electronic commerce have dramatically increased the use and openness of computer
networks. Their accessibility and the relative anonymity of users make these
systems, and the integrity of the information that is stored on them, vulnerable
to security threats. As a result, security breaches of corporate networks have
been increasing in recent years. According to the annual Information
Week/PricewaterhouseCoopers LLP 1998 Global Information Security Survey of
information technology managers and professionals, 59% of those surveyed who are
associated with sites selling products or services on the Web reported at least
one security breach in the past year. In a separate PricewaterhouseCoopers LLP
1998 survey of chief executive officers, 84% cited security concerns as a
barrier to deployment of information technology initiatives. Because of the
complexity of vulnerabilities in open systems and the pervasiveness of the
threats to such systems, many organizations seek out a trusted security advisor
to assist them in developing effective security policies and managing their
information risks.
 
     We pioneered the technology for vulnerability and threat detection and we
believe that we have the most comprehensive vulnerability and threat database in
existence. Over 3,000 organizations worldwide, including firms in the Global
2000, U.S. and international government agencies and major universities, have
licensed our products. Twenty-one of the 25 largest commercial banks in the
United States, as ranked by Fortune Magazine, also have licensed our products.
 
     Our principal executive offices are located at 6600 Peachtree-Dunwoody
Road, 300 Embassy Row, Suite 500, Atlanta, Georgia 30328, and our telephone
number is (678) 443-6000. Our address on the World Wide Web is "www.iss.net".
This prospectus does not incorporate by reference the information on our Web
site.
 
                                        1
<PAGE>   6
 
                                  THE OFFERING
 
     The following information assumes that the underwriters do not exercise
their options to purchase additional shares in the offering from us or the
selling stockholders. This information is based on shares of common stock
outstanding as of December 31, 1998, and excludes 2,379,670 shares of common
stock issuable upon the exercise of stock options outstanding as of December 31,
1998.
 
<TABLE>
<S>                                                         <C>
Common stock offered by ISS Group.........................  1,200,000 shares
Common stock offered by selling stockholders..............  1,200,000 shares
Common stock to be outstanding after the offering.........  18,512,462 shares
Nasdaq National Market symbol.............................  ISSX
Use of proceeds...........................................  For general corporate purposes,
                                                            including working capital and
                                                            possible acquisitions. See "Use
                                                            of Proceeds".
</TABLE>
 
                      SUMMARY CONSOLIDATED FINANCIAL DATA
                     (IN THOUSANDS, EXCEPT PER SHARE DATA)
 
<TABLE>
<CAPTION>
                                                     APRIL 19, 1994
                                                      (INCEPTION)
                                                        THROUGH              YEAR ENDED DECEMBER 31,
                                                      DECEMBER 31,    -------------------------------------
                                                          1994         1995      1996      1997      1998
                                                     --------------   -------   -------   -------   -------
<S>                                                  <C>              <C>       <C>       <C>       <C>
CONSOLIDATED STATEMENT OF OPERATIONS DATA:
Revenues...........................................      $   38       $   257   $ 4,462   $13,467   $35,929
Operating income (loss)............................          20          (140)   (1,205)   (4,147)   (6,406)
Net income (loss)..................................          20          (140)   (1,131)   (3,919)   (4,102)
Basic and diluted net loss per share...............      $   --       $ (0.03)  $ (0.14)  $ (0.50)  $ (0.28)
Weighted average shares used in basic and diluted
  net loss per share calculation...................       4,586         5,001     7,916     7,907    14,883
</TABLE>
 
<TABLE>
<CAPTION>
                                                                   DECEMBER 31, 1998
                                                              ---------------------------
                                                                ACTUAL     AS ADJUSTED(1)
                                                              ----------   --------------
<S>                                                           <C>          <C>
CONSOLIDATED BALANCE SHEET DATA:
Cash and cash equivalents...................................   $52,632        $123,972
Working capital.............................................    54,389         125,729
Total assets................................................    78,021         149,361
Stockholders' equity........................................    66,315         137,655
</TABLE>
 
- ---------------
 
(1) As adjusted to reflect the application of the net proceeds from the sale of
    the common stock in this offering at an assumed public offering price of
    $62.94 per share and after deducting the underwriting discount and estimated
    offering expenses. See "Use of Proceeds".
 
                                        2
<PAGE>   7
 
                                  RISK FACTORS
 
     You should carefully consider the risks described below before you decide
to buy our common stock. The risks and uncertainties described below are not the
only ones facing our company. Additional risks and uncertainties may also
adversely impair our business operations. If any of the following risks actually
occur, our business, financial condition or results of operations would likely
suffer. In such case, the trading price of our common stock could decline, and
you may lose all or part of your investment.
 
     This prospectus contains forward-looking statements based on our current
expectations, assumptions, estimates and projections about ISS and our industry.
These forward-looking statements involve risks and uncertainties. Our actual
results could differ materially from those anticipated in such forward-looking
statements as a result of certain factors, as more fully described in this
section and elsewhere in this prospectus. We undertake no obligation to update
publicly any forward-looking statements for any reason, even if new information
becomes available or other events occur in the future.
 
                          WE ARE A YOUNG COMPANY THAT
                           HAS NEVER BEEN PROFITABLE
 
     We were incorporated in April 1994 and have never achieved profitability.
Although our losses have narrowed recently, we cannot be certain that we will
become profitable in the future. Even if we become profitable at some point in
the future, we cannot be certain that we can sustain such profitability. You
should be aware that we have only a limited operating history upon which to
evaluate our business and prospects. In deciding to purchase our shares, you
must consider the risks, expenses and difficulties frequently encountered by
companies that are, like us, in their early stage of development and that depend
upon new and rapidly evolving markets. In order to address these risks, we must,
among other things:
 
- - respond to competitive developments;
 
- - continue to upgrade and expand our product and services offerings; and
 
- - continue to attract, retain and motivate our employees.
 
We cannot be certain that we will successfully address these risks.
 
                          OUR FUTURE OPERATING RESULTS
                          WILL FLUCTUATE SIGNIFICANTLY
 
     As a result of our limited operating history, we cannot predict our future
revenues and operating results. However, we do expect our future revenues and
operating results to fluctuate due to a combination of factors, including:
 
- - the growth of private Internet-based networks (often referred to as
  intranets);
 
- - the extent to which the public perceives that unauthorized access to and use
  of online information is a threat to network security;
 
- - the volume and timing of orders, including seasonal trends in customer
  purchasing;
 
- - our ability to develop new and enhanced products and expand our professional
  services;
 
- - the growth in the acceptance of, and activity on, the Internet and the World
  Wide Web, particularly by corporate, institutional and government users;
 
- - customer budgets which may limit their ability to purchase our products;
 
- - foreign currency exchange rates that affect our international operations;
 
- - the mix of distribution channels through which we sell our products;
 
- - product and price competition in our markets; and
 
- - general economic conditions, both domestically and in our foreign markets.
 
     We increasingly focus our efforts on sales of enterprise-wide security
solutions, which consist of our entire product suite and related professional
services, rather than on
 
                                        3
<PAGE>   8
 
the sale of component products. As a result, we expect that each sale may
require additional time and effort from our sales staff. In addition, the
revenues associated with particular sales vary significantly depending on the
number of products licensed by a customer, the number of devices used by the
customer and the customer's relative need for our professional services. Large
individual sales, or even small delays in customer orders, can cause significant
variation in our license revenues and results of operations for a particular
period. The timing of large orders is usually difficult to predict and, like
many software companies, our customers typically license most of our products in
the last month of a quarter.
 
     Our future operating expenses are expected to increase in future periods as
we intend to:
 
- - expand our domestic and international sales and marketing operations;
 
- - increase our investments in product development and our proprietary threat and
  vulnerability database;
 
- - expand our professional services capabilities;
 
- - seek acquisition candidates that will enhance our products and market share;
  and
 
- - improve our internal operating and financial systems.
 
     We cannot predict our operating expenses based on our past results.
Instead, we establish our spending levels based in large part on our expected
future revenues. As a result, if our actual revenues in any future period fall
below our expectations, our operating results likely will be adversely affected
because very few of our expenses vary with our revenues. Because of the factors
listed above, we believe that our quarterly and annual revenues, expenses and
operating results likely will vary significantly in the future. Accordingly,
period-to-period comparisons of our results of operations are not necessarily
meaningful, and investors in our common stock should not rely upon them as
indications of our future performance. For these and other reasons, our
operating results may fall below market analysts' expectations, which, in turn,
could cause the market price of our common stock to decline, and perhaps decline
significantly.
 
                   WE FACE INTENSE COMPETITION IN OUR MARKET
 
     The market for network security monitoring, detection and response
solutions is intensely competitive, and we expect competition to increase in the
future. We cannot guarantee that we will compete successfully against our
current or potential competitors, especially those with significantly greater
financial resources or brand name recognition. Our chief competitors generally
fall within one of four categories:
 
- - internal information technology departments of our customers and the
  consulting firms that assist them in formulating security systems;
 
- - relatively smaller software companies offering relatively limited applications
  for network and Internet security;
 
- - large companies, including Axent Technologies, Cisco Systems and Network
  Associates, that sell competitive products, as well as other large software
  companies that have the technical capability and resources to develop
  competitive products; and
 
- - software or hardware companies that could integrate features that are similar
  to our products into their own products.
 
     Mergers or consolidations among these competitors, or acquisitions of small
competitors by larger companies, would make such combined entities more
formidable competitors to us. In the last 18 months, both Cisco Systems and
Network Associates have acquired privately-held companies with products
competitive to ours. Large companies may have advantages over us because of
their longer operating histories, greater name recognition, larger customer
bases or greater financial, technical and marketing resources. As a result, they
may be able to adapt more quickly to new or emerging technologies and changes in
customer requirements. They can also devote
 
                                        4
<PAGE>   9
 
greater resources to the promotion and sale of their products than we can. In
addition, these companies have reduced, and could continue to reduce, the price
of their security monitoring, detection and response products, which increases
pricing pressures within our market. In addition, large companies with broad
product offerings, such as Network Associates, have bundled their security
products with their other products, and we expect them to continue to do so in
the future, which makes it more difficult for us to compete with them. These
companies may develop security monitoring, detection and response products that
are better than our current or future products and this may render our products
obsolete.
 
     Several companies currently sell software products (such as encryption,
firewall, operating system security and virus detection software) that our
customers and potential customers have broadly adopted. Some of these companies
sell products which perform the same functions as some of our products. In
addition, vendors of operating system software or networking hardware may
enhance their products to include the same kinds of functions that our products
currently provide. The widespread inclusion of comparable features to our
software in operating system software or networking hardware could render our
products obsolete, particularly if such features are of a high quality. Even if
security functions integrated into operating system software or networking
hardware are more limited than those of our software, a significant number of
customers may accept more limited functionality to avoid purchasing additional
software.
 
     For the above reasons, we may not be able to compete successfully against
our current and future competitors. Increased competition may result in price
reductions, reduced gross margins and loss of market share, any one of which
could materially and adversely affect our business, operating results and
financial condition. See "Business -- Competition" for detailed information
about our competition.
 
WE FACE RAPID TECHNOLOGICAL CHANGE IN OUR INDUSTRY AND FREQUENT INTRODUCTIONS OF
                                  NEW PRODUCTS
 
     Rapid changes in technology pose significant risks to us. We do not control
nor can we influence the forces behind these changes, which include:
 
- - the extent to which businesses and others seek to establish more secure
  networks;
 
- - the extent to which hackers and others seek to compromise secure systems;
 
- - evolving computer hardware and software standards;
 
- - changing customer requirements; and
 
- - frequent introductions of new products and product enhancements.
 
     To remain successful, we must continue to change, adapt and improve our
products in response to these and other changes in technology. Our future
success hinges on our ability to both continue to enhance our current line of
products and professional services and to introduce new products that address
and respond to innovations in computer hacking, computer technology and customer
requirements. We cannot be sure that we will successfully develop and market new
products that do this. Any failure by us to timely develop and introduce new
products, to enhance our current products or to expand our professional services
capabilities in response to these changes could adversely affect our business,
operating results and financial condition.
 
     Our products involve very complex technology, and as a consequence, major
new products and product enhancements require a long time to develop and test
before going to market. Because this amount of time is difficult to estimate, we
have had to delay the scheduled introduction of new and enhanced products in the
past and may have to delay the introduction of new products and product
enhancements in the future.
 
     The techniques computer hackers use to gain unauthorized access to or to
sabotage networks and intranets are constantly evolving and increasingly
sophisticated.
 
                                        5
<PAGE>   10
 
Furthermore, because new hacking techniques are usually not recognized until
used against one or more targets, we are unable to anticipate most new hacking
techniques. To the extent that new hacking techniques harm our customers'
computer systems or businesses, affected customers may believe that our products
are ineffective, which may cause them or prospective customers to reduce or
avoid purchases of our products. In such event, we may lose customer goodwill,
which could adversely affect our business.
 
                           WE MUST EFFECTIVELY MANAGE
                                OUR RAPID GROWTH
 
     Our business has grown rapidly in the last three years, with total revenues
increasing from $4.5 million in 1996 to $35.9 million in 1998. During this
period, our workforce has also rapidly expanded, increasing from seven employees
in January 1996 to 328 in December 1998. This growth has strained, and if
continued, will further strain our management resources and systems. We intend
to continue to expand both our business and workforce for the foreseeable future
to pursue existing and potential market opportunities. However, if the market
for our solutions fails to grow or grows more slowly than we currently
anticipate, our business, operating results and financial condition would be
materially and adversely affected.
 
     In addition, our ability to manage future growth will require us to
continually improve our financial and management controls, reporting systems and
procedures, to implement new systems as necessary and to expand, train and
manage our employees. We cannot assure investors in our common stock that we
will be able to manage successfully any future expansion. Our inability to do so
would materially and adversely affect our business, operating results and
financial condition.
 
                  RISKS ASSOCIATED WITH OUR GLOBAL OPERATIONS
 
     We have derived approximately 21% and 19% of our total revenues from sales
to customers outside of North America in 1997 and 1998, respectively. The
expansion of our international operations includes the maintenance of sales
offices in dispersed locations throughout the world, including throughout Europe
and the Asia/Pacific and Latin America regions. Our international presence and
expansion exposes us to risks not present in our U.S. operations, such as:
 
- - the difficulty in managing an organization spread over various countries
  located across the world;
 
- - unexpected changes in regulatory requirements in countries where we do
  business;
 
- - excess taxation due to overlapping tax structures;
 
- - fluctuations in foreign currency exchange rates, which may be aggravated in
  European markets by the recent introduction of the Euro currency;
 
- - import and export licensing requirements;
 
- - trade restrictions;
 
- - changes in tariff and freight rates; and
 
- - depressed regional and economic conditions, such as those currently affecting
  many regions in Asian markets.
 
     Despite these risks, we believe that we must continue to expand our
operations in international markets to support our growth. To this end, we
intend to establish additional foreign sales operations, expand our existing
offices, hire additional personnel, expand our international sales channels and
customize our products for local markets. If we fail to execute this strategy,
our international sales growth will be limited, which, in turn, could materially
and adversely affect our business, operating results and financial condition.
 
     To date, we have primarily denominated our revenues from international
operations in United States dollars; however, we will increasingly denominate
sales in local foreign currencies in the future. An increase in the
 
                                        6
<PAGE>   11
 
value of the United States dollar relative to foreign currencies would make our
products more expensive and, therefore, potentially less competitive in foreign
markets. In addition, even if we successfully expand our international
operations, we may not be able to maintain or increase international market
demand for our products.
 
                            WE INCREASINGLY RELY ON
                         INDIRECT DISTRIBUTION CHANNELS
 
     Although our direct sales have accounted for a majority of our revenues in
1998, we expect to continue to license a significant percentage of our products
to end users through indirect distribution channels in the future. Our indirect
distribution channel partners include:
 
- - original equipment manufacturers that bundle our products with products that
  they sell to their customers;
 
- - managed service providers, such as telecommunications companies and Internet
  service providers, that host networking and Internet operations for business
  customers; and
 
- - consultants and systems integrators that incorporate our products into
  customized solutions that they have implemented for their customers.
 
     We have established our relationships with many of our channel partners
only within the last three years. We cannot predict whether our channel partners
will continue to market and sell our products successfully. We have little or no
control over the manner in which our channel partners sell our products or
integrate our products with their own products or solutions. In addition, many
of our channel partners also market and sell our competitors' products. While no
one channel partner accounted for more than 10% of our consolidated revenues in
1998, a loss of several of our major channel partners without replacement would
adversely affect our business, operating results and financial condition.
 
     Our future performance will also depend, in part, on our ability to attract
new channel partners to market and support our products effectively, especially
in new markets. We cannot assure you that revenue from channel partners that
accounted for significant revenues in past periods will continue or, if
continued, will reach or exceed past performance levels. In addition, we often
depend upon our channel partners to install and support our products for end
users. If our channel partners fail to provide adequate installation and
support, end users of our products could cease using, or improperly implement
and operate, our products. Such a failure could substantially increase our
customer support costs and materially and adversely affect our business,
operating results and financial condition.
 
                  POTENTIAL FUTURE ACQUISITIONS OR INVESTMENTS
 
     As part of our growth strategy, we have acquired, and may continue to
acquire or make investments in, companies with products, technologies or
professional services capabilities complementary to our solutions. In acquiring
companies in the future, we could encounter difficulties in assimilating their
personnel and operations into our company. These difficulties could disrupt our
ongoing business, distract our management and employees, increase our expenses
and adversely affect our results of operations. These difficulties could also
include accounting requirements, such as amortization of goodwill or in-process
research and development expense. We cannot be certain that we will successfully
overcome these risks with respect to any future acquisitions or that we will not
encounter other problems in connection with our prior or any future
acquisitions. In addition, any future acquisitions may require us to incur debt
or issue equity securities. The issuance of equity securities could dilute the
investment of our existing stockholders.
 
                         WE DEPEND ON OUR KEY PERSONNEL
 
     We rely, and will continue to rely, on our senior executive officers and
other key management personnel, especially Thomas E. Noonan (our Chairman of the
Board, President and Chief Executive Officer) and Christopher Klaus (our founder
and Chief Technology Officer). We do not have an
                                        7
<PAGE>   12
 
employment agreement with either Mr. Noonan or Mr. Klaus. A departure by either
of these individuals or any of our other key employees could significantly
diminish our level of management, technical, marketing and sales expertise and
we would need to find replacements who have these skills. We believe that hiring
replacements for key personnel, if necessary, will be difficult.
 
     Our future success also depends on our continuing ability to attract and
retain highly qualified engineers, managers and sales and professional services
personnel. The competition for employees at all levels of the software industry,
especially those with experience in the relatively new discipline of security
software, is increasingly intense. If we do not succeed in attracting new
employees or retaining and motivating our current employees, our business could
suffer significantly.
 
   WE DEPEND ON OUR INTELLECTUAL PROPERTY RIGHTS AND USE LICENSED TECHNOLOGY
 
     We rely primarily on copyright and trademark laws, trade secrets,
confidentiality procedures and contractual provisions to protect our proprietary
rights. We also believe that the technological and creative skills of our
personnel, new product developments, frequent product enhancements, our name
recognition, our professional services capabilities and delivery of reliable
product maintenance are essential to establishing and maintaining our technology
leadership position. We cannot assure you that our competitors will not
independently develop technologies that are similar to ours.
 
     We seek to protect our software, documentation and other written materials
under the trade secret and copyright laws, which afford only limited protection.
We have also submitted two United States patent applications. Patents may not
issue from these applications or, if issued, may not provide any meaningful
competitive advantages to us.
 
     We generally license our products to end users in a machine-readable
format. However, certain customers have required us to place the source code for
our products in an escrow account with a third-party software escrow agent.
Under these escrow arrangements, our insolvency or our failure to perform our
obligations under certain license and maintenance agreements could cause the
release of our source code to such customers. Such an event could significantly
compromise our ability to protect the use of our software by our competitors or
potential competitors.
 
     Despite our efforts to protect our proprietary rights, unauthorized parties
may attempt to copy aspects of our products or to obtain and use information
that we regard as proprietary. Policing unauthorized use of our products is
difficult. While we cannot determine the extent to which piracy of our software
products occurs, we expect software piracy to be a persistent problem. In
addition, the laws of some foreign countries do not protect our proprietary
rights to as great an extent as do the laws of the United States and many
foreign countries do not enforce these laws as diligently as U.S. government
agencies and private parties.
 
     We are not aware that any of our products infringes the proprietary rights
of others, but it is conceivable that our current or future products may
infringe the proprietary rights of others. In fact, in July 1998 Network
Associates, which is one of our competitors, filed a lawsuit against us alleging
that our RealSecure product violates a patent claim for intrusion detection
technology held by Network Associates. We believe that the lawsuit is without
merit and are vigorously defending against Network Associates' claims. However,
should Network Associates prevail in the suit, it could materially and adversely
affect our business, operating results and financial condition.
 
     We expect the number of intellectual property infringement lawsuits against
software companies to increase. Any such claims, with or without merit, could be
time consuming, result in costly litigation, cause product shipment delays or
require us to enter into royalty or licensing agreements. Such royalty or
licensing agreements may not be made available on terms acceptable to us, which
could materially and adversely affect
                                        8
<PAGE>   13
 
our business, operating results and financial condition.
 
                      WE LACK CERTAIN TRADEMARK PROTECTION
 
     We currently cannot obtain trademark protection on the name "Internet
Security Systems" due to its general use in a variety of security-related
applications. We have in the past asserted and intend to continue to assert our
rights to the name "Internet Security Systems". In addition, we have in the past
taken and will continue to take action against any use of that name in a manner
that may create confusion for our products in our current or future markets.
However, we may not be successful in these efforts, which could have a material
adverse effect upon our business, operating results and financial condition.
 
        WE FACE POTENTIAL PRODUCT LIABILITY EXPOSURE AND PRODUCT DEFECTS
 
     Many organizations use our products for critical functions of monitoring
and enhancing network security. As a result, we risk product liability and
related claims for our products if they do not adequately perform this function.
In our licensing agreements, we typically seek to limit our liability for
special, consequential or incidental damages, but these provisions may not in
all cases be enforceable under applicable laws. In addition, we currently have
$2.0 million of product liability insurance coverage that, subject to customary
exclusions, covers claims resulting from failure of our products or services to
perform their intended function or to serve their intended purpose. A product
liability claim, to the extent not covered by our insurance, could materially
and adversely affect our business, operating results and financial condition.
 
     Complex software products such as ours may contain undetected "bugs" that,
despite our testing, are discovered only after installation and use by our
customers. The occurrence of these bugs could result in adverse publicity, loss
of or delay in market acceptance or claims by customers against us, any of which
could have a material adverse effect upon our business, operating results and
financial condition. Customers who deploy or use our products improperly or
incompletely may experience temporary disruptions to their computer networking
systems, which could damage our relationship with them and our reputation. Our
current products may not be error-free and it is extremely doubtful that our
future products will be error-free. Furthermore, computers are manufactured in a
variety of different configurations with different operating systems (such as
Windows, Unix, Macintosh and OS/2) and embedded software. As a result, it is
very difficult to comprehensively test our software products for programming or
compatibility errors. Errors in the performance of our products, whether due to
our design or their compatibility with products of other companies, could hinder
the acceptance of our products, which, in turn, would impair our business,
operating results and financial condition. See "Business -- Products" and
"-- Product Development".
 
                             HACKERS MAY TARGET US
 
     As a producer of leading security software, we may represent an attractive
target for hacker attacks. Should hackers infiltrate our internal network system
and obtain sensitive data and information, or create bugs or viruses in an
attempt to sabotage the functionality of our products, we may receive negative
publicity, or incur direct damage to our systems or liability to our customers.
We cannot guarantee our ability to respond to such attacks in a timely or
effective manner and any failure to do so could materially and adversely affect
our business, operating results and financial condition.
 
                          GOVERNMENT MAY REGULATE OUR
                               TECHNOLOGY EXPORTS
 
     Governments, including the United States government, from time to time have
imposed controls, export license requirements and restrictions on the export of
certain technology, especially encryption technology. Certain of our products
incorporate advanced encryption technology and, as a consequence, we have been
required to modify the relative sophistication of the
 
                                        9
<PAGE>   14
 
encryption technology used in these products in order to license them to
customers in certain foreign markets. Our inability to export our domestic
version of these products to such customers may reduce our competitiveness in
such markets, which may adversely affect our sales. Moreover, any further
expansion of export regulations would further restrict our ability to export our
products, which may materially and adversely affect our business, operating
results and financial condition.
 
                                YEAR 2000 RISKS
 
     Many currently installed computer systems and software products accept only
two-digit entries in the date code field. These date code fields will need to
accept four digit entries to distinguish 21st century dates from 20th century
dates. As a result, computer systems and software used by many companies and
governmental agencies may need to be upgraded to comply with such "Year 2000"
requirements. Noncompliant computer systems or software may cause system failure
or result in miscalculations that will cause disruptions of normal business
activities. Although we have designed all of the products that we currently
offer to be Year 2000 compliant, we cannot assure you that our products contain
all necessary date code changes, or that, in the year 2000, our products will be
compatible with third-party software that may be integrated or used in
conjunction with our products. See "Management's Discussion and Analysis -- Year
2000".
 
                          LIMITED PRIOR MARKET FOR OUR
                      COMMON STOCK AND POSSIBLE VOLATILITY
                               OF OUR STOCK PRICE
 
     Our common stock has only been publicly traded since our initial public
offering on March 24, 1998. We cannot guarantee to purchasers of our shares that
the market price of our common stock will be maintained after the offering or
that the volume of trading in our shares will increase.
 
     The risks detailed in this Prospectus may significantly adversely affect
the market price of our common stock after the offering by the risks detailed in
this prospectus. In particular, the stock prices for many high technology
companies, especially those that base their businesses on the Internet, recently
have experienced wide fluctuations and extreme volatility which have often been
unrelated to the operating performance of such companies. Such fluctuations have
adversely affected and may in the future adversely affect the market price of
our common stock.
 
     Furthermore, following periods of volatility in the market price of a
company's securities, securities class action claims frequently are brought
against the subject company. To the extent that the market price of our shares
falls dramatically in any period of time, stockholders likely will bring claims,
with or without merit, against us. Such litigation would be very expensive to
defend and would divert management attention and resources regardless of
outcome.
 
                            ANTI-TAKEOVER PROVISIONS
 
     Our certificate of incorporation and bylaws contain the following
provisions that may deter a takeover, including one on terms that many of our
stockholders might consider favorable:
 
- - authority of our board of directors to issue common stock and preferred stock
  and to determine the price, rights (including voting rights), preferences,
  privileges and restrictions of each series of preferred stock, without any
  vote or action by our stockholders;
 
- - the existence of large amounts of authorized but unissued common stock and
  preferred stock;
 
- - staggered, three-year terms for our board of directors;
 
- - supermajority voting requirements to effect certain amendments to our
  certificate of incorporation and bylaws;
 
- - limitations on who may call special meetings of stockholders;
 
- - prohibition of stockholder action by written consent; and
 
- - advance notice requirements for board of directors nominations and for
  stockholder proposals.
 
                                       10
<PAGE>   15
 
     The rights and preferences of any series of preferred stock could include a
preference over the common stock on the distribution of our assets upon a
liquidation or sale of our company, preferential dividends, redemption rights,
the right to elect one or more directors and other voting rights. The rights of
the holders of any series of preferred stock that may be issued in the future
may adversely affect the rights of the holders of the common stock . We have no
current plans to issue preferred stock. In addition, certain provisions of
Delaware law and our stock option plan may also discourage, delay or prevent a
change in control of our company or unsolicited acquisition proposals.
 
                      SHARES ELIGIBLE FOR FUTURE SALE AND
                              REGISTRATION RIGHTS
 
     If our stockholders sell substantial amounts of common stock (including
shares issued upon the exercise of outstanding stock options) in the public
market following this offering, the market price of our common stock could fall.
Such sales also could make it more difficult for us to sell equity or equity-
related securities in the future at a time and price that we deem appropriate.
Upon completion of this offering, we will have outstanding 18,512,462 shares of
common stock (assuming no exercises of options after the date of this
prospectus). Of these shares, the 3,450,000 shares sold in our initial public
offering in March 1998, the 2,400,000 shares being offered hereby and 5,165,872
shares that have been sold pursuant to Rule 144 under the Securities Act of
1933, as amended, or that are eligible under paragraph (k) of that rule are
freely tradeable. This leaves 7,496,590 shares eligible for sale in the public
market as follows:
 
<TABLE>
<CAPTION>
NUMBER OF SHARES       DATE
- ----------------       ----
<S>                    <C>
  514,192............  At various times after the date of
                       this prospectus pursuant to Rule
                       144
6,982,398............  At various times after 90 days
                       from the date of this prospectus
                       pursuant to Rule 144
</TABLE>
 
     In addition, we have registered for resale the 3,000,000 shares of our
common stock reserved for issuance under our Restated 1995 Stock Incentive Plan,
as well as 100,000 shares of common stock that were subject to options granted
pursuant to written compensation agreements separate from the plan. As of
December 31, 1998, options to purchase 244,643 shares of our common stock were
outstanding and will be eligible for sale in the public market from time to time
subject to vesting and, in the case of certain options, the expiration of 90-day
lock-up agreements with the underwriters of this offering. These stock options
generally have exercise prices significantly below the current price of our
common stock. The possible sale of a significant number of these shares may
cause the price of our common stock to fall.
 
     Certain stockholders, representing approximately 7,189,177 shares of common
stock may have the right, subject to certain conditions, to include their shares
in certain registration statements relating to our securities. By exercising
their registration rights and causing a large number of shares to be registered
and sold in the public market, these holders may cause the price of common stock
to fall. In addition, any demand by holders of registration rights to include
shares of common stock held by them in a registration initiated by us could
adversely affect our ability to raise needed capital. See "Management -- Our
Stock Option Plan", "Principal and Selling Stockholders", "Description of
Securities -- Registration Rights", "Shares Eligible for Future Sale" and
"Underwriting".
 
                      BROAD DISCRETION IN USE OF PROCEEDS
 
     We have not yet decided how we will use the proceeds from this offering.
Therefore, our management will retain broad discretion
to allocate the net proceeds from this offering to uses with which our
stockholders may not agree. We cannot assure you that any use of proceeds can or
will yield a significant return. See "Use of Proceeds".
 
                                       11
<PAGE>   16
 
                                USE OF PROCEEDS
 
     Based on an assumed public offering price of $62.94 per share, we estimate
that the net proceeds from our sale of shares of common stock in this offering
will be approximately $71.3 million (approximately $91.1 million if the
underwriters exercise their over-allotment option in full), after deducting the
underwriting discounts and commissions and estimated offering expenses payable
by us. We will not receive any proceeds from the sale of common stock by the
selling stockholders.
 
     We currently intend to use the net proceeds of this offering for working
capital and general corporate purposes, including financing accounts receivable
and funding capital expenditures made in the ordinary course of our business. We
also may use a portion of the proceeds to fund possible acquisitions of
businesses, products and technologies that are complementary to ours. Although
we have no current agreements with respect to such transactions, we from time to
time evaluate such acquisition opportunities and may engage in negotiations with
respect to them. Pending such uses, we will invest the net proceeds from this
offering in government securities and other short-term, investment-grade,
interest-bearing instruments.
 
                          PRICE RANGE OF COMMON STOCK
 
     The common stock has been quoted on the Nasdaq National Market under the
symbol "ISSX" since our initial public offering on March 24, 1998. Prior to that
offering there had been no public market for the common stock. The following
table sets forth, for the periods indicated, the high and low sale prices per
share of our common stock as reported on the Nasdaq National Market:
 
<TABLE>
<CAPTION>
1998:                                                      HIGH     LOW
- -----                                                     ------   ------
<S>                                                       <C>      <C>
First Quarter (from March 24, 1998).....................  $41.50   $37.00
Second Quarter..........................................   56.63    31.63
Third Quarter...........................................   50.50    25.38
Fourth Quarter..........................................   60.63    17.00
</TABLE>
 
     On January 28, 1999, the last reported sale price of the common stock on
the Nasdaq National Market was $62.94 per share. As of December 31, 1998, there
were 201 holders of record of the common stock.
 
                                DIVIDEND POLICY
 
     We have never declared or paid any cash dividends on our capital stock
other than a $10,000 dividend paid in each of 1994 and 1995, and we do not
intend to pay any cash dividends on our common stock in the foreseeable future.
 
                                       12
<PAGE>   17
 
                                 CAPITALIZATION
 
     The table below sets forth our capitalization as of December 31, 1998 on an
actual basis, and as adjusted to reflect our sale of 1,200,000 shares of common
stock in the offering at an assumed public offering price of $62.94 per share,
after deducting underwriting discounts and commissions and estimated offering
expenses payable by us. This table should be read in conjunction with our
consolidated financial statements and the other financial information included
in this prospectus.
 
<TABLE>
<CAPTION>
                                                                DECEMBER 31, 1998
                                                              ---------------------
                                                              ACTUAL    AS ADJUSTED
                                                              -------   -----------
                                                                 (IN THOUSANDS)
<S>                                                           <C>       <C>
Stockholders' equity:
  Preferred Stock, $0.001 par value, 20,000,000 shares
     authorized and none issued, actual and as adjusted.....  $    --    $     --
  Common Stock, $0.001 par value, 50,000,000 shares
     authorized; 17,292,087 shares issued and outstanding;
     18,492,087 shares issued and outstanding as adjusted
     (1)....................................................       17          18
  Additional paid-in capital................................   76,110     147,449
  Deferred compensation.....................................     (662)       (662)
  Cumulative adjustment for currency revaluation............      142         142
  Accumulated deficit.......................................   (9,292)     (9,292)
                                                              -------    --------
          Total stockholders' equity........................   66,315     137,655
                                                              -------    --------
          Total capitalization..............................  $66,315    $137,655
                                                              =======    ========
</TABLE>
 
- ---------------
(1) Excludes 2,379,670 shares of common stock issuable upon exercise of options
    outstanding as of December 31, 1998, with exercise prices ranging from $0.15
    to $48.12 per share and with a weighted average exercise price of $10.98 per
    share. See "Management -- Our Stock Option Plan" and Note 5 of Notes to
    Consolidated Financial Statements.
 
                                       13
<PAGE>   18
 
                                    DILUTION
 
     Our net tangible book value as of December 31, 1998 was $58.5 million, or
$3.38 per share of common stock. Net tangible book value per share represents
the amount of our total tangible assets less total liabilities, divided by the
number of shares of our common stock outstanding. After giving effect to the
sale of the 1,200,000 shares of common stock offered by us in this offering at
an assumed public offering price of $62.94 per share and the application of the
estimated net proceeds, our net tangible book value as of December 31, 1998
would have been $129.9 million, or $7.02 per share of common stock. This
represents an immediate increase in the net tangible book value of $3.64 per
share to our existing stockholders and an immediate dilution in the net tangible
book value of $55.92 per share to new investors of common stock in this
offering. The following table illustrates this per share dilution:
 
<TABLE>
<S>                                                           <C>        <C>
Assumed public offering price per share.....................             $62.94
                                                                         ------
  Net tangible book value per share as of December 31,
     1998...................................................  $3.38
  Increase per share attributable to new investors..........   3.64
                                                              -----
Net tangible book value per share after this offering.......               7.02
                                                                         ------
Dilution per share to new investors.........................             $55.92
                                                                         ======
</TABLE>
 
                                       14
<PAGE>   19
 
                      SELECTED CONSOLIDATED FINANCIAL DATA
 
     The financial data set forth below for each of the three years in the
period ended December 31, 1998, and as of December 31, 1997 and 1998, has been
derived from the audited consolidated financial statements appearing elsewhere
in this prospectus and should be read in conjunction therewith. The financial
data for the periods from inception (April 19, 1994) through December 31, 1994,
for the year ended December 31, 1995, and as of December 31, 1994, 1995 and
1996, has been derived from audited financial statements not included in this
prospectus. Historical results are not necessarily indicative of the results
that may be expected in the future. See "Management's Discussion and Analysis of
Financial Condition and Results of Operations".
 
<TABLE>
<CAPTION>
                                                   APRIL 19, 1994
                                                     (INCEPTION)
                                                       THROUGH
                                                    DECEMBER 31,                 YEAR ENDED DECEMBER 31,
                                                   ---------------     -------------------------------------------
                                                        1994            1995        1996        1997        1998
                                                   ---------------     -------     -------     -------     -------
                                                                (IN THOUSANDS, EXCEPT PER SHARE DATA)
<S>                                                <C>                 <C>         <C>         <C>         <C>
CONSOLIDATED STATEMENT OF OPERATIONS DATA:
Revenues:
  Perpetual licenses.............................      $   38          $   246     $ 4,233     $10,936     $25,936
  Subscriptions..................................          --               --         219       2,465       7,406
  Professional services..........................          --               11          10          66       2,587
                                                       ------          -------     -------     -------     -------
                                                           38              257       4,462      13,467      35,929
Costs and expenses:
  Cost of revenues...............................          --                4          18         676       4,831
  Research and development.......................           5               97       1,225       3,434       9,321
  Charges for in-process research and
    development..................................          --               --          --          --         802
  Sales and marketing............................          11              252       3,768      11,731      22,762
  General and administrative.....................           2               44         656       1,773       4,389
  Amortization...................................          --               --          --          --         230
                                                       ------          -------     -------     -------     -------
                                                           18              397       5,667      17,614      42,335
                                                       ------          -------     -------     -------     -------
Operating income (loss)..........................          20             (140)     (1,205)     (4,147)     (6,406)
Interest income, net.............................          --               --          74         228       2,366
                                                       ------          -------     -------     -------     -------
Income (loss) before income taxes................          20             (140)     (1,131)     (3,919)     (4,040)
Provision for income taxes.......................          --               --          --          --          62
                                                       ------          -------     -------     -------     -------
Net income (loss)................................      $   20          $  (140)    $(1,131)    $(3,919)    $(4,102)
                                                       ------          -------     -------     -------     -------
Basic and diluted net loss per share(1)..........      $   --          $ (0.03)    $ (0.14)    $ (0.50)    $ (0.28)
                                                       ======          =======     =======     =======     =======
Weighted average shares used in basic and diluted
  net loss per share calculation(2)..............       4,586            5,001       7,916       7,907      14,883
                                                       ======          =======     =======     =======     =======
Unaudited pro forma net loss per share(1)........                                              $ (0.29)    $ (0.25)
                                                                                               =======     =======
Unaudited weighted average shares used in
  unaudited pro forma net loss per share
  calculation(2).................................                                               13,644      16,189
                                                                                               =======     =======
</TABLE>
 
<TABLE>
<CAPTION>
                                                                            DECEMBER 31,
                                                   ---------------------------------------------------------------
                                                        1994            1995        1996        1997        1998
                                                        ----           -------     -------     -------     -------
                                                                           (IN THOUSANDS)
<S>                                                <C>                 <C>         <C>         <C>         <C>
CONSOLIDATED BALANCE SHEET DATA:
Cash and cash equivalents........................      $    9          $     6     $ 2,007     $ 3,929     $52,632
Working capital (working capital deficit)........          10              (26)      2,298       2,272      54,389
Total assets.....................................          10              176       4,380       9,866      78,021
Long-term debt, net of current portion...........          --               --         140          70          --
Redeemable, convertible preferred stock..........          --               --       3,614       8,878          --
Stockholders' equity (deficit)...................          10               (7)     (1,160)     (5,058)     66,315
</TABLE>
 
- ---------------
 
(1) Computed on the basis described in Note 1 of Notes to Consolidated Financial
    Statements.
 
(2) See Note 1 of Notes to Consolidated Financial Statements for the
    determination of shares used in computing basic and diluted net income per
    share.
 
                                       15
<PAGE>   20
 
                    MANAGEMENT'S DISCUSSION AND ANALYSIS OF
                 FINANCIAL CONDITION AND RESULTS OF OPERATIONS
 
     The following discussion should be read in conjunction with the
consolidated financial statements and related notes thereto included elsewhere
in this prospectus. This discussion contains forward-looking statements that
involve risks and uncertainties. Our actual results may differ materially from
those anticipated in these forward-looking statements as a result of certain
factors, including, but not limited to, those set forth under "Risk Factors" and
elsewhere in this prospectus.
 
                                    OVERVIEW
 
     We are the leading provider of network security monitoring, detection and
response software that protects the security and integrity of enterprise
information systems according to market share reports by the Aberdeen Group,
Gartner Group and The Yankee Group. Our SAFEsuite family of products protects
distributed computing environments, such as internal corporate networks,
inter-company networks and the Internet, from attacks, misuse and security
policy violations. Our business is focused on maintaining the latest security
threat and vulnerability checks within our existing products, creating new
products and providing technical and professional services that are consistent
with our goal of providing enterprise solutions to address network security.
     We generate a substantial portion of our revenues from our SAFEsuite family
of products in the form of perpetual licenses and subscriptions. We recognize
perpetual license revenues upon delivery of software or, if the customer has
evaluation software, delivery of the software key and issuance of the related
license, assuming that no significant vendor obligations or customer acceptance
rights exist. Where payment terms are extended over periods greater than 12
months, revenue is recognized as such amounts are billable. Annual renewable
maintenance is a separate component of each perpetual license agreement with
revenue recognized ratably over the maintenance term. Subscription revenues
include maintenance and term licenses. Term licenses allow customers to use the
product and receive maintenance coverage for a specified period, generally 12
months. We recognize revenues from each subscription agreement ratably over the
subscription term.
 
     In 1998, training and implementation services represented an increasing
portion of our revenues. These professional services, which typically are billed
on a time-and-materials basis, assist in the successful deployment of our
products within customer networks, the development of customers' security
policies and the assessment of security policy decisions. We recognize
professional services revenues as such services are performed.
 
     We believe that each of our current products and products in development,
together with maintenance and professional services, will represent important
sources of revenue in the future.
 
     Generally, we base our prices on the number of devices or engines being
managed by the customer, scaled to provide discounts for either larger systems
or the simultaneous license of several SAFEsuite products. We offer annual
maintenance for a separate fee. Our customers virtually always purchase
maintenance when they initially license a product. Maintenance fees generally
equal 20% of the perpetual license fee. Maintenance packages typically include
telephone support, product updates, access to our security advisory notices and
error corrections. We recommend that our customers renew their maintenance
contracts and, to date, most customers have done so. Because of the dynamic
nature of vulnerabilities and threats to computer networks, we expect that a
substantial majority of our customers will continue to renew their maintenance
contracts.
 
     We sell our products and services primarily through our direct sales force
and telephone sales operations, and we also sell through indirect sales
channels, including resellers, security consultants, Internet service
                                       16
<PAGE>   21
 
providers, and other providers of network management services. We generate less
revenue per license from indirect channels than direct sales, as we typically
sell our products to channel partners at a 25% to 50% discount from list price.
In addition, we have entered into several contracts with original equipment
manufacturers, or OEMs, in 1998 that contemplate the incorporation of our
products into their product offerings. We expect this OEM channel to be an
additional important source of revenue for us in the future.
 
     We expense research and development costs as incurred. Although we have not
capitalized any internal development costs under Statement of Financial
Accounting Standards No. 86, we have capitalized core and developed technology
assets in connection with two acquisitions that we completed in 1998. The
primary assets acquired in these acquisitions were security assessment
technologies for Windows NT, Unix and databases. While we expect the expansion
of our product offerings to originate primarily from internal development, our
strategy includes acquiring products and technologies that fit within our
product strategy and that potentially accelerate the timing of the commercial
introduction of such products and technologies as integrated components of our
enterprise network security solutions.
 
     Our business has grown rapidly in the last three years, with total revenues
increasing from $4.5 million in 1996 to $35.9 million in 1998. However, we have
experienced net losses in each of these years and, as of December 31, 1998, had
an accumulated deficit of $9.3 million. These losses resulted from significant
costs incurred in the development and sale of our products and professional
services. During this period, we went from seven employees at January 1, 1996 to
328 employees at December 31, 1998. We expect to expand our domestic and
international sales and marketing operations, increase investment in product
development and our proprietary threat and vulnerability database, seek
acquisition candidates that will enhance our products and market share, and
improve our internal operating and financial infrastructure in support of our
strategic goals and objectives. All of these initiatives will increase operating
expenses. As a result, while operating losses have narrowed over the course of
1998, we cannot be certain that we will become profitable in the future. Even if
we become profitable in the future, we cannot be certain that we can sustain
such profitability.
 
     Due to our fast growth over the past several years in an emerging market,
period-to-period comparisons of our operating results are not meaningful.
Although we recently have experienced significant revenue growth, we cannot
assume that we can sustain such growth and, therefore, investors should not rely
on our past growth as a predictor of future performance. Rather, our prospects
must be considered in light of the risks and difficulties frequently encountered
by companies in new and rapidly evolving markets. There can be no assurance that
we will be successful in addressing such risks and difficulties. See "Risk
Factors -- We Are a Young Company That Has Never Been Profitable", "-- Our
Future Operating Results Will Fluctuate Significantly" and "-- We Must
Effectively Manage Our Rapid Growth".
 
                                       17
<PAGE>   22
 
                             RESULTS OF OPERATIONS
 
     The following table sets forth our consolidated historical operating
information,
as a percentage of total revenues, for the periods indicated.
 
<TABLE>
<CAPTION>
                                                                  YEAR ENDED DECEMBER 31,
                                                                 -------------------------
CONSOLIDATED STATEMENT OF OPERATIONS DATA:                       1996      1997      1998
- ------------------------------------------                       -----     -----     -----
<S>                                                              <C>       <C>       <C>
Revenues:
  Perpetual licenses........................................      94.9%     81.2%     72.2%
  Subscriptions.............................................       4.9      18.3      20.6
  Professional services.....................................       0.2       0.5       7.2
                                                                 -----     -----     -----
                                                                 100.0     100.0     100.0
Costs and expenses:
  Cost of revenues..........................................       0.4       5.0      13.5
  Research and development..................................      27.5      25.5      25.9
  Charges for in-process research and development...........        --        --       2.2
  Sales and marketing.......................................      84.4      87.1      63.4
  General and administrative................................      14.7      13.2      12.2
  Amortization..............................................        --        --       0.6
                                                                 -----     -----     -----
                                                                 127.0     130.8     117.8
                                                                 -----     -----     -----
Operating loss..............................................     (27.0)%   (30.8)%   (17.8)%
                                                                 =====     =====     =====
</TABLE>
 
                                    REVENUES
 
     Our revenues increased from $4.5 million in 1996, to $13.5 million in 1997
and to $35.9 million in 1998. Revenues from perpetual licenses increased during
these periods from $4.2 million in 1996, to $10.9 million in 1997 and to $25.9
million in 1998. Historically, we have generated most of our revenues from
perpetual licenses, but perpetual license revenues have decreased as a
percentage of total revenues from 95% in 1996, to 81% in 1997 and to 72% in
1998. Subscription revenues have increased substantially during these periods,
from $219,000 in 1996, to $2.5 million in 1997 and to $7.4 million in 1998,
representing 5%, 18% and 21%, respectively, of total revenues. We continue to
diversify our mix of sales within the SAFEsuite family of products, especially
due to the significant increases in the sale of licenses for RealSecure, our
intrusion detection product. As a result, sales of licenses for our initial
product, Internet Scanner, continued to grow in absolute dollars but decreased
as a percentage of license revenues from 93% in 1996, to 57% in 1998, and to
less than 45% of license revenues in the fourth quarter of 1998. With the
continued introduction of new product offerings, both from internal development
and acquisitions consummated in 1998, we expect this trend to continue.
 
     A key initiative in 1998 was to address the demand from customers for
implementation, training and consulting services. As a result, professional
services revenues increased from less than 1% of revenues in each of 1996 and
1997 to 7% of total revenues in 1998. Professional services revenues increased
principally in the latter half of 1998 and comprised 12% of our total revenues
in the fourth quarter of 1998.
 
     On a geographic basis, we derived the majority of our revenues from sales
to customers within North America. However, international operations continue to
contribute significantly to revenues. Sales to customers outside of North
America represented 19% of our total revenues in 1998 compared with 21% in 1997
and 4% in 1996. No customer represented more than 10% of total revenues in any
of these periods.
 
                               COSTS AND EXPENSES
 
COST OF REVENUES
 
     Cost of revenues includes packaging and distribution costs for our software
licenses. Since we use the Internet to distribute product updates and keys
necessary to
 
                                       18
<PAGE>   23
 
activate a customer's software, this is a minor cost. Cost of revenues also
includes costs associated with a technical support group that provides
assistance to maintenance customers. Finally, the category includes the costs we
incur to provide professional services to customers. During the first half of
1998, we built up our professional services management team who then developed a
billable consulting staff over the balance of the year. The growth in
professional services has caused gross margin, represented by total revenues
less cost of revenues expressed as a percentage of total revenues, to trend
downward from 99% and 95% in 1996 and 1997, respectively, to 87% in 1998. We
expect gross margin to settle at a few percentage points below the 1998 level.
 
RESEARCH AND DEVELOPMENT
 
     Research and development expenses consist of salary and related costs of
research and development personnel, including costs for employee benefits and
depreciation of related computer equipment. Research and development expenses
include costs associated with maintaining the "X-Force", a team composed of
security experts dedicated to understanding new vulnerabilities and real-time
threats and attacks and developing solutions to address these security issues.
We continue to increase research and development expenditures because we regard
primary research and product development as a requirement for retaining our
leadership position in the market. We also increased the number of our
development personnel as we expanded our suite of products, upgraded our
existing products with enhanced functionality and began development efforts in
connection with OEM arrangements that were executed in the last half of 1998 but
for which no revenues have yet been generated. Accordingly, research and
development expenses increased in absolute dollars from $1.2 million in 1996, to
$3.4 million in 1997 and to $9.3 million in 1998. These costs remained at a
relatively constant percentage of revenues, although we anticipate that this
percentage will trend downward in future periods.
 
     We have reflected a charge of $802,000 in our 1998 statement of operations
for identified in-process research and development in connection with our
October 1998 acquisitions of two companies engaged in Windows NT, Unix and
database security assessment technologies. The charge was based on a valuation
of products under development using estimated future cash flows, reduced for the
core technology component of such products and the percentage of product
development remaining at the time of the acquisition.
 
SALES AND MARKETING
 
     Sales and marketing expenses consist of salaries, travel expenses,
commissions, advertising, maintenance of our Web site, trade show expenses,
personnel recruiting costs and costs of marketing materials. Sales and marketing
expenses were $3.8 million in 1996, $11.7 million in 1997 and $22.8 million in
1998. Sales and marketing expenses increased during these periods primarily from
a significant increase in the number of regional United States sales locations
and personnel, increased commissions commensurate with increased direct sales
revenues and expanded international operations in Europe and the Asia/Pacific
region. Sales and marketing expenses were 84% and 87% of our total revenues in
1996 and 1997, respectively, but decreased to 63% of revenues in 1998. This
decrease occurred because we had employed a larger proportion of our sales force
for a sufficient period of time to enable them to achieve greater levels of
productivity. If we are able to maintain low rates of attrition within our sales
force, we expect this trend to continue.
 
GENERAL AND ADMINISTRATIVE
 
     General and administrative expenses of $656,000 in 1996, $1.8 million in
1997 and $4.4 million in 1998, represented approximately 15%, 13% and 12%,
respectively, of our total revenues. General and administrative expenses consist
of personnel-related costs for executive, administrative, finance and human
resources, information systems and other support services and legal, accounting
and other
 
                                       19
<PAGE>   24
 
professional services fees. During 1998, we upgraded our internal financial
reporting and information systems, and we expect to continue to expend resources
to enhance our management's ability to obtain and analyze information about our
domestic and international operations. In addition, we incurred approximately
$720,000 of amortization of deferred compensation in 1998, the majority of which
is recorded in the general and administrative category. This charge is related
to the valuation of stock options to employees and directors granted around the
time of our initial public offering of our common stock in March 1998.
 
INCOME TAXES
 
     No provision for federal or state income taxes has been recorded because we
have experienced cumulative net losses since inception. We recorded a minor
amount of income tax expense in 1998 related to our European operations. At
December 31, 1998, we had net operating loss carryforwards of approximately
$13.6 million for federal tax purposes which will expire, if not utilized, in
2011 through 2018. These carryforwards include $7.7 million related to exercises
of stock options for which the income tax benefit, if realized, would increase
additional paid-in-capital. We also had approximately $800,000 of net operating
loss carryforwards related to certain foreign operations which will expire, if
not utilized, in 2002 and 2003. We have not recognized any benefit from the
future use of loss carryforwards for these periods or any other periods since
inception because management's evaluation of all the available evidence in
assessing realizability of the tax benefits of such loss carryforwards indicates
that the underlying assumptions of future profitable operations contain risks
that do not provide sufficient assurance to recognize such benefits currently.
 
                                       20
<PAGE>   25
 
                        QUARTERLY RESULTS OF OPERATIONS
 
     The following tables set forth certain unaudited consolidated quarterly
statement of operations data for the eight quarters ended December 31, 1998, as
well as such data expressed as a percentage of our total revenues for the
periods indicated. This data has been derived from unaudited consolidated
financial statements that, in our opinion,
include all adjustments (consisting only of normal recurring adjustments)
necessary for a fair presentation of such information when read in conjunction
with our consolidated financial statements and related notes appearing elsewhere
in this prospectus. The operating results for any quarter are not necessarily
indicative of results for any future period.
 
<TABLE>
<CAPTION>
                                                                     QUARTER ENDED
                            -----------------------------------------------------------------------------------------------
                            MAR. 31,    JUNE 30,    SEPT. 30,    DEC. 31,    MAR. 31,    JUNE 30,    SEPT. 30,    DEC. 31,
                              1997        1997         1997        1997        1998        1998         1998        1998
                            ---------   ---------   ----------   ---------   ---------   ---------   ----------   ---------
                                                                    (IN THOUSANDS)
<S>                         <C>         <C>         <C>          <C>         <C>         <C>         <C>          <C>
CONSOLIDATED STATEMENT OF
  OPERATIONS DATA:
Revenues:
  Perpetual licenses......     $1,872      $2,150      $ 2,767     $ 4,147     $ 4,875     $ 5,559      $ 6,596     $ 8,906
  Subscriptions...........        349         513          691         912       1,169       1,487        2,152       2,598
  Professional services...          4           8           15          39          29         285          682       1,591
                            ---------   ---------   ----------   ---------   ---------   ---------   ----------   ---------
                                2,225       2,671        3,473       5,098       6,073       7,331        9,430      13,095
Costs and expenses:
  Cost of revenues........         87         137          176         276         513         892        1,559       1,867
  Research and
    development...........        493         569          895       1,477       1,636       1,832        2,541       3,312
  Charge for in-process
    research and
    development...........         --          --           --          --          --          --           --         802
  Sales and marketing.....      1,754       2,342        3,051       4,584       4,648       5,431        5,632       7,051
  General and
    administrative........        320         301          443         709         981       1,100        1,046       1,262
  Amortization............         --          --           --          --          --          --           --         230
                            ---------   ---------   ----------   ---------   ---------   ---------   ----------   ---------
                                2,654       3,349        4,565       7,046       7,778       9,255       10,778      14,524
                            ---------   ---------   ----------   ---------   ---------   ---------   ----------   ---------
Operating loss............       (429)       (678)      (1,092)     (1,948)     (1,705)      (1924)      (1,348)     (1,429)
Interest income, net......         35          68           66          59          66         841          765         694
                            ---------   ---------   ----------   ---------   ---------   ---------   ----------   ---------
  Loss before income
    taxes.................       (394)       (610)      (1,026)     (1,889)     (1,639)     (1,083)        (583)       (735)
  Provision for income
    taxes.................         --          --           --          --          --          --           --          62
                            ---------   ---------   ----------   ---------   ---------   ---------   ----------   ---------
Net loss..................     $ (394)     $ (610)     $(1,026)    $(1,889)    $(1,639)    $(1,083)      $ (583)     $ (797)
                            =========   =========   ==========   =========   =========   =========   ==========   =========
</TABLE>
 
<TABLE>
<CAPTION>
                                                                     QUARTER ENDED
                            -----------------------------------------------------------------------------------------------
                            MAR. 31,    JUNE 30,    SEPT. 30,    DEC. 31,    MAR. 31,    JUNE 30,    SEPT. 30,    DEC. 31,
                              1997        1997         1997        1997        1998        1998         1998        1998
                            ---------   ---------   ----------   ---------   ---------   ---------   ----------   ---------
<S>                         <C>         <C>         <C>          <C>         <C>         <C>         <C>          <C>
AS A PERCENTAGE OF TOTAL
  REVENUES:
Revenues:
  Perpetual licenses......       84.1%       80.5%        79.7%       81.3%       80.3%       75.8%        70.0%       68.0%
  Subscriptions...........       15.7        19.2         19.9        17.9        19.2        20.3         22.8        19.8
  Professional services...        0.2         0.3          0.4         0.8         0.5         3.9          7.2        12.2
                            ---------   ---------   ----------   ---------   ---------   ---------   ----------   ---------
                                100.0       100.0        100.0       100.0       100.0       100.0        100.0       100.0
Costs and expenses:
  Cost of revenues........        3.9         5.1          5.1         5.4         8.5        12.2         16.5        14.3
  Research and
    development...........       22.2        21.3         25.8        29.0        26.9        25.0         27.0        25.3
  Charge for in-process
    research and
    development...........         --          --           --          --          --          --           --         6.1
  Sales and marketing.....       78.8        87.7         87.8        89.9        76.5        74.1         59.7        53.8
  General and
    administrative........       14.4        11.3         12.7        13.9        16.2        15.0         11.1         9.6
  Amortization............         --          --           --          --          --          --           --         1.8
                            ---------   ---------   ----------   ---------   ---------   ---------   ----------   ---------
                                119.3       125.4        131.4       138.2       128.1       126.2        114.3       110.9
Operating loss............      (19.3)      (25.4)       (31.4)      (38.2)      (28.1)      (26.2)       (14.3)      (10.9)
Net loss..................      (17.7)%     (22.8)%      (29.5)%     (37.1)%     (27.0)%     (14.8)%       (6.2)%      (6.1)%
                            =========   =========   ==========   =========   =========   =========   ==========   =========
</TABLE>
 
                                       21
<PAGE>   26
 
     As a result of our limited operating history, we are unable to predict our
future revenues and operating results. See "Risk Factors -- Our Future Operating
Results Will Fluctuate Significantly".
 
                        LIQUIDITY AND CAPITAL RESOURCES
 
     We have financed our operations to date primarily through sales of our
equity securities. The net proceeds of $61.5 million from our March 1998 initial
public offering were the primary source of cash provided by financing activities
in 1998. In February 1996 and February 1997, we received aggregate net proceeds
of $8.9 million from the sale of our preferred stock, all of which automatically
converted into common stock when we completed our initial public offering.
 
     Net cash used in operations of approximately $4.3 million in 1998 included
$4.1 million of net loss. This loss, however, included $3.8 million of non-cash
expense for depreciation of equipment, amortization of acquisition related
intangibles and deferred compensation, and a charge for the write-off of
acquired in-process research and development. The other use of cash in
operations was working capital associated with our growth. An increase in
accounts receivable of $8.1 million was only partially offset by an increase in
deferred revenues of $4.5 million. Growth in annual maintenance contracts, the
upfront billing of multi-year maintenance arrangements with certain customers
and an increase in term licenses increased the deferred revenues balance.
 
     Our primary investing activity of 1998 was our acquisition of March
Information Systems Limited and the technology assets of DbSecure. The $5.2
million cash component of these acquisitions included cash consideration and
direct transaction costs. We also invested in equipment totaling $3.6 million in
1998 as we provided existing and new personnel with the computer hardware and
software necessary to perform their job functions. This included engineering lab
equipment, expanded information systems and a telephone switch installed in
connection with our relocation to our new headquarters facilities. We expect a
similar level of equipment investment in 1999, assuming continued growth in our
number of employees.
 
     At December 31, 1998, we had $52.6 million of cash and cash equivalents,
consisting primarily of money market accounts and short-term, commercial paper
carrying the highest investment grade rating. We believe that these investments,
together with the proceeds from this offering, will be sufficient to fund any
operating losses and capital expenditures and meet our working capital needs for
the foreseeable future. We currently intend to use the net proceeds of this
offering for general corporate purposes, including possible acquisitions of or
investments in businesses, products and technologies that are complementary to
ours. Although we have not identified any specific businesses, products or
technologies that we intend to acquire or invest in, and there are not any
current agreements or negotiations with respect to any such transactions, from
time to time we evaluate such opportunities. Pending such uses, we will invest
the net proceeds in government securities and other short-term,
investment-grade, interest-bearing instruments.
 
                                   YEAR 2000
 
     We have reviewed our products and believe that they are designed to
properly function through and beyond the year 2000. Furthermore, we only support
the current and most recent prior version of our products. While we have
conducted tests of our software and have informed our customers that our
products are Year 2000 compliant, we cannot guarantee that our products,
particularly when they incorporate third-party software, will contain all date
code changes necessary to ensure Year 2000 compliance.
 
     In addition, we use several internal management and other information
systems in the operation of our business. Since we have experienced most of our
growth in systems and personnel since January 1, 1997, purchases and upgrades of
systems have occurred principally during 1997 and 1998. Internal systems for
financial, human resources and sales reporting, as well as
 
                                       22
<PAGE>   27
 
telephone, voice mail and other office support systems, have all been purchased
during 1998 and are reflected either on the balance sheet as capital purchases
or expensed under our standard policy. We used our best efforts to ensure that
these new systems are Year 2000 compliant.
 
     We are in the process of contacting providers of various tools used in our
product development process and the providers of desktop systems (primarily
Microsoft) to determine that these recognized systems, such as Windows NT and
Windows 95/98, will be Year 2000 compliant with appropriate fixes. We do not
depend on any suppliers or manufacturers whose failure to be Year 2000 compliant
would have any significant impact on our financial condition or results of
operations. We expect to complete our Year 2000 project for these remaining
items by the middle of 1999. We do not expect to expend any significant funds to
correct Year 2000 issues. Any minor expenses will be funded through cash
provided by operations.
 
     Based on available information, we do not believe we have any material
exposure to significant business interruptions as a result of Year 2000
compliance issues, or that the cost of remedial actions will have a material
adverse effect on our business, financial condition or results of operations.
Accordingly, we have not adopted any formal contingency plan in the event we do
not achieve Year 2000 compliance.
 
                                       23
<PAGE>   28
 
                                    BUSINESS
 
                                    OVERVIEW
 
     We are the leading provider of monitoring, detection and response software
that protects the security and integrity of enterprise information systems,
according to market share reports by Aberdeen Group, Gartner Group and the
Yankee Group. Our SAFEsuite family of products is designed to enforce "best
practice" information risk management automatically across distributed computing
environments. Our products use an innovative Adaptive Network Security, or ANS,
approach that entails continuous security risk monitoring, detection and
response to develop and enforce an active network security policy. In addition,
we offer professional services which enable us to deliver comprehensive network
and Internet security solutions to our customers. We pioneered the technology
for vulnerability and threat detection through a dedicated security research and
development team and we believe that we have the most comprehensive
vulnerability and threat database in existence. We have licensed our network
security solutions to over 3,000 organizations worldwide, including firms in the
Global 2000, U.S. and international government agencies, and major universities.
Twenty-one of the 25 largest commercial banks in the United States, as ranked by
Fortune, have licensed our products. We also have established strategic
relationships with industry leaders, including Check Point, GTE, IBM, MCI
WorldCom, Microsoft and Nortel, to enable worldwide distribution of our core
monitoring technology.
 
                              INDUSTRY BACKGROUND
 
     Network computing has evolved from client/server-based local area networks
to distributed computing environments based on the integration of inter-company
wide area networks via the Internet. The proliferation and growth of corporate
intranets and the increasing importance of electronic commerce have dramatically
increased the openness of computer networks, with the Internet becoming a widely
accepted platform for many business-to-business and direct-to-customer
transactions. International Data Corporation ("IDC") estimates that the number
of Internet users will grow from 97 million in 1998 to 320 million in 2002, and
that the value of electronic commerce transactions will grow from $32 billion to
$426 billion over the same period. Additionally, IDC estimates that the number
of devices accessing the Web will increase from 120 million in 1998 to 515
million in 2002. To capitalize on these trends, organizations are increasingly
connecting their enterprise networks to the Internet to facilitate and support
strategic business objectives, including:
 
- - electronic data interchange (EDI);
 
- - supply chain systems integration;
 
- - Web-based access to account information and delivery schedules; and
 
- - secure messaging and online purchases and payments.
 
     With the increased use of the Internet by businesses and consumers,
organizations increasingly network their key systems in order to reduce costs
and increase revenues. For example, businesses can implement supply chain
management applications through standards enabled by the Internet. To optimize
the supply chain, businesses use the Internet to provide suppliers with access
to sensitive internal information, such as engineering designs, product
development plans, raw material inventories and product schedules. Organizations
also strengthen their ties with customers through "corporate Internet portals"
that provide comprehensive information for purchasing products, checking order
status and managing customer billings. This increased level of access provided
by open systems carries with it the risk of unauthorized access to and use of
sensitive information or malicious disruptions of important information-exchange
systems.
 
                         THE NEED FOR NETWORK SECURITY
 
     Although open computing environments have many business advantages, their
accessibility and the relative anonymity of users make these systems, and the
integrity
                                       24
<PAGE>   29
 
of the information that is stored on them, vulnerable to security threats. Open
systems present inviting opportunities for computer hackers, curious or
disgruntled employees, contractors and competitors to compromise or destroy
sensitive information within the system or to otherwise disrupt the normal
operation of the system. In addition, open computing environments are complex
and typically involve a variety of hardware, operating systems and applications
supplied by a multitude of vendors, making these networks difficult to manage,
monitor and protect from unauthorized access. Each new addition of operating
system software, applications or hardware products to the distributed computing
environment may introduce a vast number of new vulnerabilities and security
risks. To adequately secure a network, information technology, or IT, managers
must have the resources to not only correctly configure the security measures in
each system, but also to understand the risks created by any change to existing
systems on the network. This situation is made worse by the limited supply of
personnel knowledgeable in information security issues.
 
     Executives must understand and manage the risks involved when integrating
their systems with the systems of suppliers and customers to achieve strategic
objectives. According to the annual Information Week/PricewaterhouseCoopers LLP
1998 Global Information Security Survey of IT managers and professionals, 59% of
those surveyed who are associated with sites selling products or services on the
Web reported at least one security breach in the past year. In addition, sites
integrated with supply-chain network or enterprise resource planning
applications reported security violations 10% more often than sites without such
applications. In a separate PricewaterhouseCoopers 1998 survey of chief
executive officers, 84% cited security concerns as a barrier to deployment of IT
initiatives. Despite the convenience and the compelling economic incentives for
the use of Internet-protocol networks, they cannot reach their full potential as
a platform for global communication and commerce until organizations can
implement an effective platform to manage information risk.
 
     Historically, organizations have responded to perceived security threats by
implementing passive point tools, such as encryption, firewall, authentication
and other technologies designed to protect individual components of their
internal networks from unauthorized use or outside attacks. These technologies
address some security concerns, but are often ineffective because:
 
- - encryption protects information during transmission; however, it does not
  typically protect information at either the source or the destination;
 
- - a firewall, which controls the flow of data between an internal network and
  outside networks or the Internet, is necessary for rudimentary access control,
  but must be regularly reconfigured to accommodate new business applications,
  users and business partners on the network. Thus, firewalls can be left
  vulnerable to hackers and others seeking to compromise network integrity and
  fail to protect against improper use by authorized users;
 
- - operating system security mechanisms, such as user authentication, passwords
  and multi-level access rights, can prevent unauthorized access by internal and
  external users. However, deployment issues such as easily guessed passwords or
  default accounts left on newly installed devices diminish the effectiveness of
  these measures.
 
     Passive point tools do not address the fundamental issue that the inherent
utility of open systems is itself the source of their vulnerability. This
conflict between the benefits of open systems and the risks of their
unauthorized use or disruption has not been widely recognized or addressed by
passive security tools.
 
     Many organizations have developed security policies that define the
appropriate use of network resources, establish the proper configuration of
network services, operating systems and applications and describe the actions to
be taken if there is an attack on the network. These security policies
 
                                       25
<PAGE>   30
 
attempt to define the organization's acceptable level of risk. Organizations,
however, have not had the systems to automatically enforce and implement such
policies across their entire IT infrastructure. Without such systems, the
dynamic nature of enterprise networks causes the organization's actual security
practice to diverge from the stated security policy, potentially exposing the
organization to additional unanticipated risks.
 
     To be effective, passive point tools need to be coordinated through
enterprise-wide systems that automatically evaluate and eliminate the
vulnerabilities and threats. Direct observation of vulnerabilities and threats
can allow an organization to define and automatically enforce an integrated,
enterprise-wide information risk management process that can be managed
centrally and implemented on a distributed basis. Any security solution must be:
 
- - easy to use by both management and the organization's existing IT personnel;
 
- - compatible with existing security technologies as well as be flexible enough
  to incorporate new technologies; and
 
- - able to provide a comprehensive and accurate picture of security issues across
  the organization's entire distributed network such that the managers of the
  system trust the objectivity of the security system in monitoring, detecting
  and responding to vulnerabilities and threats.
 
                                THE ISS SOLUTION
 
     Our dynamic, process-driven Adaptive Network Security approach to
enterprise-wide information risk management relies on the principles of
monitoring, detection and response to the ever-changing vulnerabilities in and
threats to the hardware products, operating systems and applications that
comprise every network system. We designed our SAFEsuite family of products to
enable an organization to centrally define and manage an information risk policy
for its existing network system infrastructure, including all Internet
protocol-enabled devices. Our solutions provide the ability to visualize,
measure and analyze real-time security vulnerabilities and control threats
across the entire enterprise computing infrastructure, keeping the
organization's IT personnel informed of changing risk conditions and
automatically making adjustments as necessary. Through custom policies or by
using our "best practice" templates, our customers can minimize security risks
without closing off their networks to the benefits of open computing
environments and the Internet.
 
     Our solutions reach beyond the traditional approaches to network security
in the following respects:
 
ADAPTIVE NETWORK SECURITY
 
     ANS is a proactive, risk management-based approach to enterprise security
that links security practice and security policy through a continuous
improvement process. ANS achieves this objective through four critical
processes:
 
- - continuously monitoring network, system and user activity and configuring
  devices, systems and applications on the network;
 
- - detecting security risks in network traffic and within systems;
 
- - responding to security threats to minimize risks; and
 
- - analyzing and reporting dynamic risk conditions and response actions and
  updating security policies.
 
COMPREHENSIVE ENTERPRISE SECURITY SOLUTION
 
     We combine ANS principles with our extensive knowledge of network, system
and application vulnerabilities and threats to provide scalable security
solutions. Our SAFEsuite family of products provides a comprehensive network and
system security framework. In addition, we sell our products individually as
solutions for a particular function. We also offer a broad range of professional
services to assist in the development and enforcement of an effective security
policy and to facilitate the deployment and use of our software. Our solutions
are interoperable with a broad range of platforms and complement the products of
leading security and network management vendors.
 
                                       26
<PAGE>   31
 
They provide a single point of management and control for an enterprise-wide
security policy. In this manner, our SAFEsuite family of products serves as a
critical enhancement to traditional passive point tools, such as encryption,
firewalls and authentication. We have designed our products to be easily
installed, configured, managed and updated by a system administrator through an
intuitive graphical user interface without interrupting or affecting network
operation. The software automatically identifies systems and activities that do
not comply with a customer's policies, and provides a critical feedback
mechanism for adjusting the security levels of networked systems based upon its
findings. Our products generate easy-to-understand reports ranging from
executive-level trend analysis to detailed step-by-step instructions for
eliminating security risks.
 
THE X-FORCE
 
     Because there are few IT professionals specifically trained in network and
system security issues, we have assembled a senior research and development team
composed of security experts who are dedicated to understanding new
vulnerabilities and real-time threats and attacks, and developing solutions to
address these security issues. The team is known in the industry as the "X-
Force" and represents one of our competitive advantages. Because of the
collective knowledge and experience of the members of the X-Force, we believe
that they comprise one of the largest and most sophisticated groups of IT
security experts currently researching vulnerability and threat science.
Organizations such as CERT (Computer Emergency Response Team), the FBI and
leading technology companies routinely consult the X-Force on network security
issues. Through the X-Force, we maintain a proprietary and comprehensive
knowledge base of computer exploits and attack methods, including what we
believe is the most extensive publicly-available collection of Windows NT
vulnerabilities and threats in existence. To respond to an ever-changing risk
profile, the X-Force continually updates this knowledge base with the latest
network vulnerability information, which aids in the design of new products and
product enhancements.
 
                                    STRATEGY
 
     Our objective is to be the leading provider of information risk management
systems that, through our ANS approach, proactively protect the integrity and
security of enterprise-wide information systems from vulnerabilities, misuse,
attacks and other information risks. We focus on developing innovative and
automated software solutions to provide customers with a comprehensive framework
for protecting their networks and systems by monitoring for vulnerabilities and
real-time threats. Our solutions allow customers to enforce "best practice"
network and system security policies. Key elements of our strategy include:
 
CONTINUE OUR LEADERSHIP POSITION IN SECURITY TECHNOLOGY
 
     We intend to maintain and enhance our technological leadership in the
enterprise security market by hiring additional network and Internet security
experts, broadening our proprietary knowledge base, continuing to invest in
product development and product enhancements and acquiring innovative companies
and technologies that complement our solutions. By remaining independent of
other providers of system software, applications and hardware and by solidifying
our position as a best-of-breed provider of monitoring, detection and response
software, we believe that customers and potential customers will view us as the
firm of choice for establishing and maintaining effective security practices and
policies.
 
EXPAND DOMESTIC SALES CHANNELS
 
     We intend to increase the distribution and visibility of our products by
expanding our regional direct sales program and increasing our market coverage
through the establishment of additional indirect channels with key managed
service providers, Internet service providers, systems integrators, resellers,
OEMs and other channel partners. We believe that a multi-channel sales approach
will build customer awareness of
 
                                       27
<PAGE>   32
 
the need for our products and enable us to more rapidly build market share
across a wide variety of industries.
 
ENHANCE AND PROMOTE PROFESSIONAL SERVICES CAPABILITIES
 
     We are establishing long-term relationships with our customers by serving
as a "trusted advisor" in addressing network security issues. To continue to
fulfill this responsibility to our customers, we are expanding our professional
services capabilities. These capabilities will allow us to provide our customers
with additional security system design, planning, installation, testing and
consulting services to assist in developing and maintaining effective
information risk management solutions. By providing professional services, we
also can heighten customer awareness about network security issues, which
creates opportunities for us to sell new products or product enhancements to our
existing customers.
 
EXPAND INTERNATIONAL OPERATIONS
 
     We plan to continue to aggressively expand our international operations to
address the rapid global adoption of distributed computing environments. Many
foreign countries do not have laws recognizing network intrusion or misuse as a
crime or the resources to enforce such laws if they do exist. As a consequence,
we believe that organizations in such countries will have greater need for
effective security solutions. We currently maintain international offices in
Australia, Belgium, Brazil, Canada, England, France, Germany, Japan and Mexico
and plan to expand in those regions where businesses, governments and other
institutional users are using distributed networks and the Internet for their
mission-critical needs.
 
BROADEN ANS CATEGORY AWARENESS
 
     We intend to increase and broaden awareness of the need for ANS and our
information risk management solutions. In 1998, we led the formation of the
Adaptive Network Security Alliance, or ANSA, as a means to offer Adaptive
Network Security to support a wide range of network management and security
products. In addition, by increasing our level of public relations, educational
events, seminars, advertising, direct marketing and trade show participation, we
intend to increase the public's recognition of the risks and dangers associated
with the adoption of open computing systems and commerce initiatives, as well as
the ability to manage such risks through an effective ANS-based solution.
 
                              PRODUCT ARCHITECTURE
 
     The SAFEsuite family of products delivers our ANS approach to network
security through a flexible architecture designed to be integrated with existing
security and network system infrastructures. Our SAFEsuite products enhance the
effectiveness of passive point tools by monitoring them for threats and
vulnerabilities and responding with actions that align customers' security
practices with their security policies. SAFEsuite complements network and
security management frameworks by providing information required for informed
decisions to minimize security risks while maintaining the desired level of
network functionality. Thus, our products provide a risk management-based
approach to security with scalable deployment of best-of-breed products and
integrated enterprise-wide implementations.
 
                                       28
<PAGE>   33
 
     The following depicts the SAFEsuite product architecture:
 
                     [SAFESUITE PRODUCT ARCHITECTURE LOGO]
 

     Picture headed "SAFEsuite Architecture" depicts a rectangle segmented into
12 parts: One segment spans the top of the top of the rectangle and is titled
"Information Risk Management". Immediately below that segment is another segment
spanning the top of the rectangle entitled "SAFEsuite Decisions" and includes
that product's square logo. Immediately below that segment are two segments of
half the length of the rectangle. The left segment is entitled "Vulnerability
Management" and the right segment is entitled "Threat Management". Below the
Vulnerability Management segment are three segments, entitled (from left to
right) "Internet Scanner", "Database Scanner" and "System Scanner", each with a
circular product logo. Below the "Threat Management" segment are two segments
(on a level even with the three segments below "Vulnerability Management")
entitled "RealSecure Engine" and "RealSecure Agent", both with a circular
product logo. Below these five segments is a segment spanning the length of the
rectangle entitled "Security Knowledge Base". Below that segment is another
segment spanning the width of the rectangle with 4 rectangular "X-Force" logos.
Along the right edge of the rectangle is a segment entitled "Professional
Services" with the words "Implementation" "Consulting" "Training" and "Advisory
Service" underneath the title.

     The SAFEsuite policy management interface lets customers choose among "best
practice" templates or policies that establish the acceptable level of risk
appropriate for their networks. Our individual products then automatically
verify compliance with the chosen policy in terms of actual system configuration
and network activity. Graphical reports describe the deviations from the
established policy, including the measures required to reduce the risk.
 
     This product architecture allows all the SAFEsuite technologies to connect
directly into common standards, providing comprehensive security reports for the
entire enterprise. To ensure communication confidentiality between individual
SAFEsuite components and to prevent their misuse, SAFEsuite uses RSA encryption
algorithms, which have become de facto encryption standards. The SAFEsuite
Security Knowledge Base, a database containing information about the devices and
security risks on a customer's network, utilizes an open database connectivity,
or ODBC, interface and allows customers to select their preferred database such
as Informix, Microsoft SQL Server, Oracle, Sybase or any ODBC-compliant database
for data storage. The various SAFEsuite products consolidate security data,
enabling users to quickly determine their risk profiles and respond. In
addition, SAFEsuite products provide automated decision support by assessing
priorities and providing a graphical representation of important security risk
data sets. This feature allows key decision-makers to prioritize their program
strategies for effective deployment of resources to minimize security risks.
 
     Each SAFEsuite product can be deployed as a stand-alone, best-of-breed
solution to meet the needs of the local administrator or departmental user.
Through support for remote, multi-level management consoles and the SAFEsuite
Security Knowledge Base, enterprise-level users can analyze security risk
conditions for the entire network. The SAFEsuite Security Knowledge Base allows
the customer to address both vulnerabilities
 
                                       29
<PAGE>   34
 
and threats, thereby minimizing network
security risk and associated costs. SAFEsuite's frequent updates integrate the
latest identified security vulnerabilities and threats into the operations of an
existing product installation.
 
                                    PRODUCTS
     The following table lists our current offering of SAFEsuite products, and
includes a brief description of each product's functionality and current list
prices (dollar amounts are for the indicated scope of use, with prices
discounted for larger networks):
 
<TABLE>
<CAPTION>
 
                                                                                           INTRODUCTION
                              DESCRIPTION                SCOPE         U.S. LIST PRICE         DATE
<S>                   <C>                          <C>                 <C>               <C>
- ----------------------------------------------------------------------------------------------------------
   NETWORK SECURITY VULNERABILITY DETECTION, ANALYSIS AND REPORTING
- ----------------------------------------------------------------------------------------------------------
 Internet Scanner     Comprehensive security              50 devices      $  3,495       October 1992
                      assessment for all                1000 devices        19,945
                      devices on an enterprise          3000 devices        39,500
                      network
- ----------------------------------------------------------------------------------------------------------
 
   INTERNAL SYSTEM SECURITY VULNERABILITY DETECTION, ANALYSIS AND REPORTING
- ----------------------------------------------------------------------------------------------------------
 System Scanner --    Internal security                 50 computers      $  1,950       December 1998
                      assessment
  desktop version     for desktop operating            400 computers        11,950
                      systems                         1000 computers        25,500
- ----------------------------------------------------------------------------------------------------------
 System Scanner --    Internal security                  5 computers      $  3,250       January 1997
                      assessment
  server version      for server operating              30 computers        17,500
                      systems
                                                       100 computers        50,000
- ----------------------------------------------------------------------------------------------------------
 
   DATABASE SECURITY VULNERABILITY DETECTION, ANALYSIS AND RESPONSE
- ----------------------------------------------------------------------------------------------------------
 Database Scanner     Comprehensive security               5 servers      $  4,475       December 1998
                      assessment for SQL                  10 servers         8,500
                      databases                           50 servers        41,250
- ----------------------------------------------------------------------------------------------------------
 
   NETWORK SECURITY THREAT AND MISUSE DETECTION, ANALYSIS AND RESPONSE
- ----------------------------------------------------------------------------------------------------------
 RealSecure Engine    Real-time attack                      1 engine      $  8,995       December 1996
                      recognition,
                      misuse detection and                10 engines        69,900
                      response for network                25 engines       149,900
                      traffic
- ----------------------------------------------------------------------------------------------------------
 
   INTERNAL SYSTEM SECURITY THREAT AND MISUSE DETECTION, ANALYSIS AND RESPONSE
- ----------------------------------------------------------------------------------------------------------
 RealSecure Agent     Real-time attack                   5 computers      $  3,750       December 1998
                      recognition,
                      misuse detection and              25 computers        15,000
                      response for activities          100 computers        50,000
                      within systems
- ----------------------------------------------------------------------------------------------------------
 
   ENTERPRISE INFORMATION RISK MANAGEMENT
- ----------------------------------------------------------------------------------------------------------
 SAFEsuite Decisions  Decision support system      Small enterprise       $ 25,000       December 1998
                      for information risk         Medium enterprise       100,000
                      management                   Large enterprise        250,000
- ----------------------------------------------------------------------------------------------------------
</TABLE>
 
                                       30
<PAGE>   35
 
INTERNET SCANNER
 
     Internet Scanner quickly finds and fixes security holes through automated
and comprehensive network security vulnerability detection and analysis.
Internet Scanner scans and detects vulnerabilities, prioritizes security risks
and generates an array of meaningful reports ranging from executive-level trend
analysis to detailed step-by-step instructions for eliminating security risks.
Internet Scanner initiates a scan from a workstation placed inside or outside a
corporate firewall. These scans measure the actual implementation of an
organization's security policies. Scans may be as simple as determining the
basic computing services available on the network or as comprehensive as a
thorough testing using Internet Scanner's vulnerability database -- the most
comprehensive in the industry. Internet Scanner's intranet module methodically
examines intranet servers, routers, operating systems and key applications for
potential violations in security policy. The firewall module works through the
network to find firewalls and provide an accurate assessment of their
configuration and degree of protection. Finally, the Web security module locates
intranet, extranet and Internet Web servers, checking them for possible
misconfigurations and security weaknesses. After completing their scans, the
Internet Scanner modules return lists of discovered vulnerabilities and prepare
in-depth reports to assist administrators with follow-up and review.
 
SYSTEM SCANNER
 
     System Scanner serves as a security assessment system that helps manage
security risks through comprehensive detection and analysis of operating system,
application and user-controlled security weaknesses. System Scanner identifies
potential security risks by comparing security policy with actual host computer
configurations. Potential vulnerabilities include missing security patches,
dictionary-crackable passwords, inappropriate user privileges, incorrect file
system access rights, unsecure service configurations and suspicious log
activity that might indicate an intrusion. System Scanner stores scanned
operating system configurations, placing an electronic "fingerprint" on
individual hosts. Routine reviews of these records help identify damaged or
maliciously altered systems before they become a security or performance
liability. Furthermore, System Scanner helps restore suspicious or damaged Unix
systems, generating automated fix scripts for file ownerships and permissions.
System Scanner augments its automated policy compliance testing with a database
of over 600 vendor patches and other system enhancements. This powerful built-in
knowledge base quickly pinpoints high risk activity, such as password sniffing,
remote access programs or unauthorized dial-up modems and remote control
software. System Scanner returns a list of discovered vulnerabilities and
prepares in-depth reports to assist administrators with follow-up and review.
 
DATABASE SCANNER
 
     Database Scanner provides security risk assessment for database management
systems. Database Scanner allows a user to establish a database security policy,
audit a database and present a database's security risks and exposures in
easy-to-read reports. Most database security violations occur not because
databases have inherently weak security, but rather because systems are not set
up correctly and security policies are not established and enforced. Even in a
properly configured system, settings can be changed -- either accidentally or
maliciously -- leaving sensitive information at risk. Database Scanner develops,
implements and maintains appropriate database system security strategies,
policies and procedures. It examines database systems for adherence to accepted
operational standards for account creation, access control, account suspensions
and renewals along with software upgrades, patches and hot fixes. The security
risks in internal applications utilizing database management systems can be
measured and managed with Database Scanner. The easy to read reports provide
detailed graphical analysis with recommended fixes and promote effective
communication of security
                                       31
<PAGE>   36
 
risks across departments and levels of management.
 
REALSECURE
 
     RealSecure is an integrated network- and host-based intrusion detection and
response system. RealSecure's around-the-clock surveillance extends
unobtrusively across the enterprise, allowing administrators to automatically
monitor network traffic and host logs, detect and respond to suspicious activity
and intercept and respond to internal or external host and network abuse before
system security is compromised. RealSecure's multi-point management architecture
allows for rapid enterprise-wide deployment and operation across geographic and
organizational boundaries in both Unix and Windows NT environments. RealSecure's
innovative Manager-Engine-Agent architecture provides flexible deployments to
meet the requirements of diverse corporate networks.
 
     REALSECURE ENGINE.  The RealSecure Engine runs on dedicated workstations to
provide network intrusion detection and response. Each RealSecure Engine
monitors the packet traffic on a specific network segment for attack
signatures -- telltale evidence that an intrusion attempt is taking place.
Recognition occurs in real time and triggers user-definable alarms and responses
as soon as the attack is detected. RealSecure utilizes our Digital
FingerPrinting technology to recognize a large number of attack patterns on
high-speed networks. Additionally, our Adaptive Filtering Algorithm tunes the
packet filter rules in response to network load, allowing the engine to
effectively function during bursts in network traffic. When a RealSecure Engine
detects an attack or misuse, it transmits an alarm to the RealSecure Manager or
a third-party network management console for administrative follow-up and
review. In addition, RealSecure responds immediately by terminating the
connection, sending email or pager alerts, recording the session, reconfiguring
select firewalls or taking other user-definable actions.
 
     REALSECURE AGENT.  RealSecure Agent is a host-based complement to
RealSecure Engine. RealSecure Agent analyzes host logs to recognize attacks,
determine whether an attack was successful and provide other forensic
information not available in real time. Based on what is discovered, RealSecure
Agent reacts to prevent further incursions by terminating user processes and
suspending user accounts. It also logs events, sends, alarms and emails and
executes user-defined actions. Each RealSecure Agent installs on a workstation
or host, thoroughly examining that system's logs for telltale patterns of
network misuse and breaches of security. Like RealSecure Engine, RealSecure
Agent sends an alarm to the RealSecure Manager or third-party network management
console when it detects evidence of improper usage. Based on what it discovers,
RealSecure Agent also automatically reconfigures RealSecure Engines and select
firewalls to prevent future incursions.
 
SAFESUITE DECISIONS
 
     SAFEsuite Decisions is the initial product in our new SAFEsuite Enterprise
family of enterprise security management solutions. SAFEsuite Decisions delivers
continuous security improvement across the enterprise from a single application.
SAFEsuite Decisions leverages the value of our SAFEsuite products to provide an
adaptive enterprise network security system for ongoing, active information risk
management. SAFEsuite Decisions integrates critical security data generated by
our Internet Scanner, System Scanner, RealSecure and third-party firewalls, into
a closed, automated feedback loop. This information is condensed into a
comprehensive reporting system, enabling timely, focused and informed decisions
for effective information risk management. SAFEsuite Decisions enables managers
and administrators to take immediate action to protect online resources.
SAFEsuite Decisions facilitates efficient management of enterprise security risk
and maximizes the security of large-scale networking and Internet-based
commerce.
 
                                       32
<PAGE>   37
 
                             PROFESSIONAL SERVICES
 
     We enhance the value of our products by offering professional consulting
services to assure customers' success in the use of our products. We have
network security professionals ready to assist customers with their particular
security policy development and enforcement needs. Our professional services can
range from providing network security resources for overburdened IT departments
to conducting investigations of serious breaches in security. Our professional
services offerings include:
 
- - Quick Assist -- Customer assistance for determining a client's risk condition
  and development of an Adaptive Network Security business case;
 
- - JumpStart -- High-value, customized on-the-job training and quick-start
  implementation programs;
 
- - Incident Response & Post-Attack Support -- Data recovery and business
  resumption planning services, investigation and forensics, litigation and
  expert witness support;
 
- - Triage -- High-impact, rapid turnaround network emergency support services
  including vulnerability assessment and corrective action support;
 
- - Security Architecture Design & Engineering -- Adaptive Network Security
  architecture and design services;
 
- - Enterprise Threat & Vulnerability Battle Planning -- Logical, systematic
  approach for project and budget planning, acquisition and technology strategy
  and security program development and implementation; and
 
- - Network Operations Support -- On-site and remote network monitoring and
  response, coupled with standard network security operations services.
 
     We complement our service offerings with a full range of training and
certification programs. Our Certified User courses are available at our
education center in Atlanta, Georgia, and at approved training centers around
the world. These classes address planning, installation and basic operation of
our products in a hands-on, interactive environment. For more advanced needs,
our ISS Certified Engineer training courses cover advanced topics specific to
each SAFEsuite or SAFEsuite Enterprise product. Our training goes beyond simple
"how to" exercises. Upon completion of instructor-led discussions and exercises,
students respond to actual, on-the-job scenarios. These simulations allow
students to apply their new skills to real-world situations, reinforcing both
basic and advanced skills. Our training courses encompass the complete life
cycle of our SAFEsuite products, from installation and operations to advanced
troubleshooting.
 
                                PRODUCT PRICING
 
     We use a range of fee structures to license our products, depending on the
type of product and the intended use. We license our vulnerability detection
products, Internet Scanner, System Scanner and Database Scanner, based on the
number of devices being scanned. The pricing scheme is scalable, providing low
entry points for departmental users without limiting our revenue potential from
customers with large networks. Pricing for our threat detection products,
RealSecure Engine and RealSecure Agent, is based on the number of engines
deployed on the network. Thus, licensing fees for our products are ultimately
determined by the size of the customer's network, as size dictates the number of
devices to be scanned or the number of engines to be deployed. In addition to
license fees, customers virtually always purchase maintenance agreements in
conjunction with their initial purchase of a software license, with annual
maintenance fees typically equal to 20% of the product's license fee.
Maintenance agreements include annually renewable telephone support, product
updates, access to our X-Force Security Alerts and error corrections. Our
continuing research into new security risks and resulting product updates
provide significant ongoing value. As a result, a substantial majority of our
customers renew their maintenance agreements. Customers who use our products to
provide IT consulting services have license agreements that are
 
                                       33
<PAGE>   38
 
based on a revenue sharing model. We have historically sold fully-paid perpetual
licenses with a renewable annual maintenance fee and, more recently, have
licensed our products on a subscription basis (which includes maintenance) for
one or two year periods and are exploring other alternatives for customers
desiring longer term arrangements or multi-year commitments.
 
                              PRODUCT DEVELOPMENT
 
     We developed our SAFEsuite products to operate in heterogeneous computing
environments. Products are compatible with other vendors' products across a
broad range of platforms, including HP-UX, IBM AIX, Linux, SGI IRIX, SunOS, Sun
Solaris, Windows 95/98 and Windows NT. We have incorporated a modular design in
our products to permit plug-and-play capabilities, although customers often use
our professional services or our strategic partners to install and configure
products for use in larger or more complex network systems.
 
     We employ a two-pronged product development strategy to achieve our goal of
providing the most comprehensive security coverage within the monitoring,
detection and response market. First, we continue to develop best-of-breed
security products to address particular network configurations. Such new
products, and our existing products like Internet Scanner, System Scanner and
RealSecure, are updated approximately every four to six months to add new
features, improve functionality and incorporate timely responses to
vulnerabilities and threats that have been added to our vulnerability and threat
database. These updates are usually provided as part of separate maintenance
agreements sold with the product license.
 
     Second, to complement our existing products and provide more comprehensive
network security coverage, we are expanding our existing SAFEsuite products by
developing additional enterprise-level products that incorporate ANS principles.
These products will allow customers to protect their networks by continuously
measuring and analyzing the status of their network's security, and by
monitoring and controlling the security risks in real time across the enterprise
network. These SAFEsuite enterprise products are interoperable with our existing
products, allowing modular implementation.
 
     Expenses for product development were $1.2 million, $3.4 million and $9.3
million in 1996, 1997 and 1998, respectively. All product development activities
are conducted at our principal offices in Atlanta, and at our research and
development facilities in Mountain View, California and Reading, England, where,
as of December 31, 1998, an aggregate of 108 personnel were employed in product
development teams. In addition, our personnel include members of the Computer
Security Institute, Forum for Incident Response and Security Technicians
(FIRST), Georgia Tech Industrial Partners Association, Georgia Tech Information
Security Center and the International Computer Security Association (ICSA),
enabling us to actively participate in the development of industry standards in
the emerging market for network and Internet security systems and products.
 
                                   CUSTOMERS
 
     As of December 31, 1998, we had licensed versions of our SAFEsuite family
of products to over 3,000 customers. No customer accounted for more than 10% of
our consolidated revenues in 1996, 1997 or 1998. Our target customers include
both public and private sector organizations that utilize Internet
protocol-enabled information systems to facilitate mission-critical processes in
their operations. Our customers represent a broad spectrum of organizations
within diverse sectors, including financial services, technology,
telecommunications, government and information technology services.
 
                                       34
<PAGE>   39
 
     The following is a list of certain of our customers that have purchased
licenses and services from us with an aggregate price of at least $15,000 and
which we believe are representative of our overall customer base:
 
<TABLE>
<S>                                 <C>                                 <C>
FINANCIAL SERVICES                  IT SERVICES                         GOVERNMENT
  Charles Schwab                    EDS                                 NASA
  First Union                       KPMG Peat Marwick                   Salt River Project
  KeyCorp                           Perot Systems                       U.S. Department of the
  Merrill Lynch                     PricewaterhouseCoopers              Air Force
  PNC Bank                          SAIC                                U.S. Department of the
                                    SITA                                Army
TELECOMMUNICATIONS                                                      U.S. Department of
  America Online                    TECHNOLOGY                          Defense
  Bell Atlantic                     Hewlett-Packard                     U.S. State Department
  BellSouth                         IBM
  GTE Internetworking               Intel                               OTHER
  NETCOM On-Line                    Lucent Technologies                 Lockheed Martin
     Communications                 Microsoft                           Merck
  Nippon Telephone &                NCR                                 REI
     Telegraph                      Siemens
                                    VeriSign
                                    Xerox
</TABLE>
 
                              SALES AND MARKETING
 
SALES ORGANIZATION
 
     Our sales organization is divided regionally among the Americas, Europe and
the Asia/Pacific region. In the Americas, we market our products primarily
through our direct sales organization augmented by our indirect channels,
including security consultants, resellers, OEMs and systems consulting and
integration firms. The direct sales organization for the Americas consists of
regionally-based sales representatives and sales engineers and a tele-sales
organization located in Atlanta. As of December 31, 1998, we maintained sales
offices in the Atlanta, Austin, Boston, Chicago, Cincinnati, Dallas, Denver, Los
Angeles, Minneapolis, Monterrey (Mexico), New York, Palo Alto, Philadelphia,
Portland, San Francisco, Sao Paulo (Brazil), Seattle, Toronto (Canada) and
Washington, D.C. metropolitan areas. A dedicated group of professionals in our
Atlanta headquarters covers Latin America. As of December 31, 1998, we employed
92 people in the Americas direct sales and professional services organization.
The regionally-based direct sales representatives focus on opportunities where
we believe we can realize more than $200,000 in revenues per year.
 
     In Europe and the Asia/Pacific region, substantially all of our sales occur
through authorized resellers. Internationally, we have established regional
sales offices in Brussels, London, Munich, Paris, Reading (England), Stuttgart,
Sydney and Tokyo. Personnel in these offices are responsible for market
development, including managing our relationships with resellers, assisting them
in winning and supporting key customer accounts and acting as a liaison between
the end user and our marketing and product development organizations. As of
December 31, 1998, 50 employees were located in our European and Asia/Pacific
regional offices. We expect to continue to expand our field organization into
additional countries in these regions.
 
SECURITY PARTNERS PROGRAM
 
     We have established a Security Partners Program to train and organize
security consulting practices, Internet service providers, systems integrators
and resellers to match our products with their own complementary products and
services. By reselling SAFEsuite products, Security Partners provide additional
value for specific market and industry segments, while maintaining our ongoing
commitment to quality software and guaranteed customer
 
                                       35
<PAGE>   40
 
satisfaction. We have established three different levels of partnership
opportunities:
 
- - PREMIER PARTNERS.  Premier Partners are value-added resellers and systems
  integrators with focused security practices. Many Premier Partners are
  experienced in the sales and implementation of leading firewall technology, as
  well as authentication and encryption technologies. These partners leverage
  their expertise with our vulnerability assessment and intrusion detection
  products. Premier Partners receive direct distribution of our products, sales
  training, financial incentives, access to our Web site for placing orders and
  partner-only communications, including a link to the ISS Partner Web site.
 
- - AUTHORIZED PARTNERS.  Authorized Partners generally consist of organizations
  that provide security-focused consulting services, but elect not to commit to
  the minimum annual purchase commitments and entry fees applicable to Premier
  Partners. Authorized Partners may purchase products directly from us and may
  access our Web site to place orders and receive partner-only communications.
 
- - REGISTERED PARTNERS.  Unlike Premier Partners and Authorized Partners,
  Registered Partners are not required to maintain an ISS Certified Engineer on
  their staffs. Registered Partners receive partner-only communications and may
  purchase products directly from us, including through our online Web order
  system.
 
ADAPTIVE NETWORK SECURITY ALLIANCE
 
     In 1998, we formed the Adaptive Network Security Alliance, or ANSA, as a
means to offer Adaptive Network Security to support a wide range of network
management and security products. ANSA currently has 53 members, including
leading security software vendors. ANSA delivers the flexibility of best-
of-breed products, enhanced enterprise security, accelerated implementation of
enterprise management and security solutions and additional value for existing
products and services. ANSA provides Adaptive Network Security modules for
firewalls, virtual private networks (VPNs), antivirus/malicious code software,
public key infrastructure (PKI) and enterprise systems management products.
Through ANSA, we, together with our technology partners, deliver self-correcting
security and management systems that provide maximum value for organizations
with limited IT security resources.
 
     ANSA provides functionality in the following four key areas:
 
- - ACTIVE RESPONSE.  Security breaches require rapid response to identify and
  stop threats before they place critical online assets at risk. Through ANSA,
  firewalls, routers, switches, virtual private networks and other technologies
  are reconfigured automatically and in real time to break off the attack and
  prevent future penetrations.
 
- - LOCK DOWN.  Improper configurations can make any technology vulnerable to
  attack and misuse. We work with ANSA partners to develop customized templates
  that enable the secure configuration of network devices. With this "lock down"
  functionality, customers can be assured that the ANSA partner's product will
  function as designed and will be securely configured.
 
- - DECISION SUPPORT.  Effective security decision-making and planning requires
  timely analysis of enormous amounts of data across disparate systems and
  network devices. ANSA enables fast and informed enterprise-wide security
  decisions by collecting, integrating and analyzing data from security and
  network infrastructure products of ANSA partners. Resulting high value
  information is routed to network and systems management consoles for immediate
  action.
 
- - ADAPTIVE NETWORK SECURITY MANAGEMENT. ANSA integrates Adaptive Network
  Security management with enterprise system management platforms. This
  integration simplifies the enforcement and implementation of security policies
  across the enterprise leveraging existing IT resources.
 
     ANSA is an open initiative and membership is offered free of charge to
vendors providing security, and enterprise and network infrastructure products
and
                                       36
<PAGE>   41
 
services with a commitment to interoperability.
 
MARKETING PROGRAMS
 
     We conduct a number of marketing programs to support the sale and
distribution of our products. These programs are designed to inform existing and
potential end-user customers, OEMs and resellers about the capabilities and
benefits of our products. Marketing activities include:
 
- - press relations and education;
 
- - publication of technical and educational articles in industry journals and our
  on-line magazine, ISS Alert;
 
- - participation in industry tradeshows;
 
- - product/technology conferences and seminars;
 
- - competitive analysis;
 
- - sales training;
 
- - advertising and development and distribution of marketing literature; and
 
- - maintenance of our Web site.
 
     A key element of our marketing strategy is to establish our products and
our ANS model as the leading approach for enterprise-wide security management.
We have implemented a multi-faceted program to leverage the use of our SAFEsuite
product family and increase its acceptance through relationships with various
channel partners:
 
- - STRATEGIC RESELLERS.  Although we have numerous resellers, certain of these
  relationships have generated significant leverage for us in targeted markets.
  Our strategic resellers, which include EDS, IBM, Lucent, Siemens and Softbank,
  provide broad awareness of our brand through enhanced marketing activity,
  access to large sales forces, competitive control points and access to larger
  strategic customer opportunities.
 
- - CONSULTANTS.  The use of our products by security consultants not only
  generates revenue from the license sold to the consultant, but also provides
  us with leads to potential end users with a concern for network security.
  Consultants who have generated substantial leads for our sales organization
  include Andersen Consulting, Arthur Andersen, Deloitte Touche Tohmatsu
  International, Ernst & Young, IBM, KPMG Peat Marwick, PricewaterhouseCoopers
  and SAIC Global Integrity.
 
- - MANAGED SERVICE PROVIDERS AND INTERNET SERVICE PROVIDERS.  We license our
  products to certain managed service providers and Internet service providers
  to be used as part of their value-added services for their customers, With our
  products, Internet service providers can offer their users perimeter
  vulnerability scanning and assessment, and intrusion detection for Web
  services and applications that typically reside outside the firewalled
  perimeter. We license our products to GTE, Intermedia Communications (Digex),
  IRE, MCI Worldcom and PSINet and other Internet service providers for these
  purposes and receive a percentage of the value-added revenue stream.
 
- - OEMS.  A number of vendors of security products, including Check Point,
  Entrust, Lucent, NCR, Nortel and ODS Networks, have signed OEM agreements with
  us. These agreements enable OEMs to incorporate our products into their own
  product offerings to enhance their security features and functionality. We
  receive royalties from OEM vendors and increased acceptance of our products
  under these arrangements, which, in turn, promotes sales of our other products
  to the OEM's customers.
 
We typically enter into written agreements with our strategic resellers,
consultants, managed service providers, Internet service providers and OEMs.
These agreements generally do not provide for firm dollar commitments from the
strategic parties, but are intended to establish the basis upon which the
parties will work together to achieve mutually beneficial objectives.
 
                                       37
<PAGE>   42
 
                                 ADVISORY BOARD
 
     We established an Advisory Board in February 1998 to further our sales and
recruiting efforts. Members of the Advisory Board currently consist of the
following:
 
          SAM NUNN.  Mr. Nunn has been a partner in the Atlanta law firm of King
     & Spalding since January 1997. Previously, he served in the United States
     Senate for four terms starting in 1972. Mr. Nunn is a director of The
     Coca-Cola Company, General Electric Company, National Service Industries,
     Scientific-Atlanta, Texaco and Total System Services. He also serves as
     Chairman of the Board of the Center for Strategic and International Studies
     (CSIS), a Washington, D.C. think tank.
 
          JOHN P. IMLAY, JR.  Mr. Imlay is Chairman of Imlay Investments, and
     serves on the board of directors of the Atlanta Falcons, Gartner Group,
     Metromedia International Group, and several other organizations. He was
     Chairman of Dun & Bradstreet Software Services from March 1990 until
     November 1996. Prior to that, Mr. Imlay served as Chairman and Chief
     Executive Officer of Management Science America, a company that was
     acquired by Dun & Bradstreet Software Services.
 
     The Advisory Board members advise us on long-term strategic growth,
including strategies for selling to key industries, recruitment of board members
and other key personnel, and trends in national and international policy
influencing our products and services. We also anticipate that Advisory Board
members will provide high visibility for us at industry events and will play key
roles in leading customer user groups to support our growth and industry
prominence. Members of the Advisory Board meet individually or as a group with
our management from time to time and are compensated through issuances of common
stock or options to acquire common stock.
 
                          CUSTOMER SERVICE AND SUPPORT
 
     We provide ongoing product support services under license agreements.
Maintenance contracts are typically sold to customers for a one-year term at the
time of the initial product license and may be renewed for additional periods.
Under our maintenance agreements with our customers, we provide, without
additional charge, telephone support, documentation and software updates and
error corrections. Customers that do not renew their maintenance agreements but
wish to obtain product updates and new version releases are generally required
to purchase such items from us at market prices. In general, major new product
releases come out annually, minor updates come out every four to six months and
new vulnerability and threat checks come out every two to four weeks. Customers
with current maintenance agreements may download product updates from our Web
site.
 
     We believe that providing a high level of customer service and technical
support is necessary to achieve rapid product implementation which, in turn, is
essential to customer satisfaction and continued license sales and revenue
growth. Accordingly, we are committed to continued recruiting and maintenance of
a high-quality technical support team. We provide telephone support to customers
who purchase maintenance agreements along with their product license. A team of
dedicated engineers trained to answer questions on the installation and usage of
the SAFEsuite products provides telephone support from 8:00 a.m. to 6:00 p.m.,
Eastern time, Monday through Friday, from our corporate office in Atlanta. We
provide telephone support 24 hours a day, seven days a week through a call-back
procedure to certain customers who pay an additional fee for the service. In the
United States and internationally, our resellers provide telephone support to
their customers with technical assistance from us.
 
                                  COMPETITION
 
     The market for network security monitoring, detection and response
solutions
 
                                       38
<PAGE>   43
 
is intensely competitive, and we expect competition to increase in the future.
We believe that the principal competitive factors affecting the market for
network security products include security effectiveness, manageability,
technical features, performance, ease of use, price, scope of product offerings,
professional services capabilities, distribution relationships and customer
service and support. Although we believe that our solutions generally compete
favorably with respect to such factors, there can be no assurance that we can
maintain our competitive position against current and potential competitors,
especially those with significantly greater financial, marketing, service,
support, technical and other competitive resources. Our chief competitors
generally fall within one of four categories:
 
- - internal IT departments of our customers and the consulting firms that assist
  them in formulating security systems;
 
- - relatively smaller software companies offering relatively limited applications
  for network and Internet security;
 
- - large companies, including Axent Technologies, Cisco Systems and Network
  Associates, that sell competitive products, as well as other large software
  companies that have the technical capability and resources to develop
  competitive products; and
 
- - software or hardware companies that could integrate features that are similar
  to our products into their own products.
 
     Due to a lack of appreciation of the complexity involved in the development
of automated systems to establish and maintain comprehensive and effective
security within a distributed computing environment, potential customers often
rely on their IT departments to internally formulate security systems or retain
consultants to undertake such a project. However, because experts in security
issues are in extremely short supply, such in-house solutions typically fail to
provide a comprehensive and sophisticated approach to security, are not designed
to adapt to changing security risks and are extremely expensive to develop. As
IT departments learn of our products and their relative cost, we believe that
these departments will be less inclined to independently develop systems with
functionalities similar to our products.
 
     In addition, a number of smaller companies currently market or have under
development software applications to provide network and Internet security. We
believe that, to date, none of these companies offers products that are as
robust in features or as comprehensive in scope as the SAFEsuite family of
products. Although it is likely that the product development efforts of these
companies will eventually enable them to offer a line of products to compete
with our current product line, we intend to continue to dedicate significant
resources for product development and recruiting in order to expand our product
capabilities ahead of these competitors. Notwithstanding, we expect additional
competition from these established competitors and from other emerging
companies.
 
     Mergers or consolidations among our competitors, or acquisitions of small
competitors by larger companies, would make such combined entities more
formidable competitors to us. In the last 18 months, both Cisco Systems and
Network Associates have acquired privately-held companies with products
competitive to ours. Although we believe that Cisco Systems and Network
Associates will continue to integrate these security products with their other
product offerings, we believe that our products will compete favorably based on
our product and platform functionality and Adaptive Network Security approach.
Notwithstanding, large companies may have advantages over us because of their
longer operating histories, greater name recognition, larger customer bases or
greater financial, technical and marketing resources. We believe that the entry
of larger, more established companies into our market will require them to
undertake operations that are currently not within their core areas of
expertise, thus exposing them to significant uncertainties in the product
development process. In addition, if larger companies were to enter our market,
they could have a greater ability to adapt more quickly to new or emerging
technologies and
 
                                       39
<PAGE>   44
 
changes in customer requirements. They also could devote greater resources to
the promotion and sale of their products than we can. In addition, these
companies have reduced, and could continue to reduce, the price of their
security monitoring, detection and response products, which increases pricing
pressures within our market. In addition, large companies with broad product
offerings, such as Network Associates, have bundled their security products with
their other products, and we expect them to continue to do so in the future,
which makes it more difficult for us to compete with them. These companies may
develop security monitoring, detection and response products that are better
than our current or future products and this may render our products obsolete.
 
     Several companies currently sell software products (such as encryption,
firewall, operating system security and virus detection software) that our
customers and potential customers have broadly adopted. Some of these companies
sell products which perform the same functions as some of our products. In
addition, vendors of operating system software or networking hardware may
enhance their products to include the same kinds of functions that our products
currently provide. The widespread inclusion in operating system software or
networking hardware of features comparable to our software could render our
products obsolete, particularly if such features are of a high quality. Even if
security functions integrated into operating system software or networking
hardware are more limited than those of our software, a significant number of
customers may accept more limited functionality to avoid purchasing additional
software.
 
     For the above reasons, we may not be able to compete successfully against
our current and future competitors. Increased competition may result in price
reductions, reduced gross margins and loss of market share, any one of which
could materially and adversely affect our business, operating results and
financial condition.
 
                    PROPRIETARY RIGHTS AND TRADEMARK ISSUES
 
     We rely primarily on a combination of copyright and trademark laws, trade
secrets, confidentiality procedures and contractual provisions to protect our
proprietary rights. Furthermore, we believe that factors such as the
technological and creative skills of our personnel, new product developments,
frequent product enhancements, name recognition and reliable product maintenance
are essential to establishing and maintaining a technology leadership position.
We seek to protect our software, documentation and other written materials under
the trade secret and copyright laws, which afford only limited protection. We
also have submitted two United States patent applications. There can be no
assurance that any patents will issue from these applications or, if issued,
that any such patent would provide meaningful competitive advantages to us. We
generally license our SAFEsuite products to end users in object code
(machine-readable) format. Certain customers have required us to maintain a
source-code escrow account with a third-party software escrow agent, and a
failure by us to perform our obligations under any of the related license and
maintenance agreements, or our insolvency, could conceivably cause the release
of our product source code to such customers. The standard form agreement allows
the end user to use our SAFEsuite products solely on the end user's computer
equipment for the end user's internal purposes, and the end user is generally
prohibited from sublicensing or transferring the products.
 
     Despite our efforts to protect our proprietary rights, unauthorized parties
may attempt to copy aspects of our products or to obtain and use information
that we regard as proprietary. Policing unauthorized use of our products is
difficult, and while we are unable to determine the extent to which piracy of
our software products exists, software piracy can be expected to be a persistent
problem. In addition, the laws of some foreign countries do not protect our
proprietary rights to as great an extent as do the laws of the United States.
There can be no assurance that our competitors will not independently develop
similar technologies.
 
                                       40
<PAGE>   45
 
     We are not aware that any of our products infringes the proprietary rights
of others, but it is possible that our current or future products may infringe
proprietary rights of others. In fact, in July 1998, Network Associates, which
is one of our competitors, filed a lawsuit against us alleging that our
RealSecure product violates a patent claim for intrusion detection technology
held by Network Associates. Although we believe that the lawsuit is without
merit and are vigorously defending against Network Associates' claims, should
Network Associates prevail in the suit, it could result in us having to pay
significant damages and cease the licensing of our RealSecure product. Such a
result would materially and adversely affect our business, operating results and
financial condition.
 
     It is conceivable that other third parties, in addition to Network
Associates, could claim infringement by us with respect to our current or future
products. We expect that software product developers will increasingly be
subject to infringement claims as the number of products and competitors in our
industry segment grows and the functionality of products in different industry
segments overlaps. Any such claims, with or without merit, could be time
consuming, result in costly litigation, cause product shipment delays or require
us to enter into royalty or licensing agreements. Such royalty or licensing
agreements, if required, may not be available on terms acceptable to us or at
all, which could have a material adverse effect upon our business, operating
results and financial condition.
 
     The name "Internet Security Systems" is not currently subject to trademark
registration in the United States, and may not be a name for which a trademark
is registrable due to its general use in a variety of security-related
applications. Although we have in the past asserted and intend to continue to
assert our rights with respect to the name "Internet Security Systems" and we
have taken and will take action against any use of such name in a manner that
may create confusion with our products in relevant markets, there can be no
assurance that we will be successful in such efforts, which could have a
material adverse effect upon our business, operating results and financial
condition.
 
                                   EMPLOYEES
 
     As of December 31, 1998, we had 328 employees, of whom 108 were engaged in
product research and development, 103 were engaged in sales, 16 were engaged in
customer service and support, 46 were engaged in professional services, 35 were
engaged in marketing and business development and 20 were engaged in
administrative functions. We believe that we have good relations with our
employees.
 
                                   FACILITIES
 
     Our Atlanta headquarters and research and development facilities consist of
approximately 72,000 square feet of office space occupied pursuant to a lease
and a sublease expiring in June 2002, which provide for minimum annual lease
obligations of approximately $1,240,000. We also lease office space in Mountain
View, California, New York City, Washington, D.C., Brussels, London, Paris,
Reading (England), Stuttgart and Tokyo, as well as small executive suites in
several United States cities. We believe that our existing facilities are
adequate for our current needs and that additional space will be available as
needed.
 
                               LEGAL PROCEEDINGS
 
     On June 25, 1998, Network Associates filed a lawsuit against us in the U.
S. District Court for the Northern District of California (the "Court") which
alleges that our RealSecure product infringes a patent claim for intrusion
detection technology held by Network Associates. Network Associates claims that
this alleged infringement is deliberate and willful and is seeking treble
damages in an unspecified amount and attorneys' fees, in addition to an
injunction prohibiting the alleged infringement. The Court conditionally
dismissed the original complaint based on the parties' representation to the
Court that they would attempt to reach a settlement. However, on January 13,
1999, Network Associates notified the Court that no settlement had been
                                       41
<PAGE>   46
 
reached and requested that the Court place the case on the Court's calendar. On
January 25, 1999, we filed our answer to the complaint with the Court. In our
answer, we asserted several affirmative defenses and made counterclaims against
Network Associates for unfair competition and antitrust violations under federal
and state laws. We believe that Network Associates' lawsuit is without merit and
we will continue to vigorously defend against it. However, should Network
Associates prevail in the suit, it could materially and adversely affect our
business, operating results and financial condition.
 
     Except as noted above, we are not a party to any material legal
proceedings.
 
                                       42
<PAGE>   47
 
                                   MANAGEMENT
                        DIRECTORS AND EXECUTIVE OFFICERS
 
     Set forth below is certain information concerning our directors and
executive officers.
 
<TABLE>
<CAPTION>
NAME                                                     AGE                              POSITION(S)
- ---------------------------------------------------    -------    -----------------------------------------------------------
<S>                                                    <C>        <C>
Thomas E. Noonan...................................      38       President, Chief Executive Officer and Chairman of
                                                                    the Board of Directors
Christopher W. Klaus...............................      25       Chief Technology Officer, Secretary and Director
Richard Macchia....................................      47       Vice President and Chief Financial Officer
H. Keith Cooley....................................      45       Vice President (Engineering)
M. Thomas McNeight.................................      54       Vice President (Americas Sales)
Alex Bogaerts......................................      49       Vice President (Europe)
Lin Ja Hong........................................      40       Vice President (Asia/Pacific)
Richard S. Bodman..................................      60       Director
Robert E. Davoli...................................      50       Director
Kevin J. O'Connor..................................      37       Director
David N. Strohm....................................      50       Director
</TABLE>
 
     MR. NOONAN has served as our President and as a director since August 1995,
and as our Chief Executive Officer and Chairman of the Board of Directors since
November 1996. Prior to joining our company, Mr. Noonan served as Vice
President, Sales and Business Development with TSI International, an electronic
commerce company then owned by Warburg Pincus and Dun & Bradstreet, from October
1994 until August 1995. From November 1989 until October 1994, Mr. Noonan held
high-level sales and marketing positions at Dun & Bradstreet Software, a
developer of enterprise business software. Prior to 1989, Mr. Noonan co-founded
Actuation Electronics, a motion control company for precision applications, and
founded Leapfrog Technologies, an object-oriented software development tools
company for networked applications. Mr. Noonan holds a B.S. in mechanical
engineering from the Georgia Institute of Technology and a C.S.S. in business
administration and management from Harvard University.
 
     MR. KLAUS founded ISS in April 1994 and served as our President until
August 1995 and as our Chief Executive Officer until November 1996. Mr. Klaus
continues to serve as our Chief Technology Officer and as a director. Prior to
founding our company, Mr. Klaus developed a shareware version of Internet
Scanner while attending the Georgia Institute of Technology.
 
     MR. MACCHIA has been our Vice President and Chief Financial Officer since
December 1997. From December 1989 until December 1997, Mr. Macchia was employed
by First Financial Management Corporation as its Executive Vice President
(Finance), and by First Data Corporation as its Senior Vice President (Finance)
following its merger with First Financial Management Corporation. Mr. Macchia
received a B.B.A. in accounting from the University of Notre Dame.
 
     MR. COOLEY has served as our Vice President (Engineering) since January
1996. Mr. Cooley has over 20 years of executive-level experience in software
development and customer support, most recently as a founding partner for Value
Sourcing Group, an Atlanta-based management consultancy specializing in
information technology, from 1995 to 1996. Prior to that, Mr. Cooley was
employed by Dun & Bradstreet Software for over 16 years where he held various
management and executive-level positions in marketing, development and support,
and ended his tenure as Chief Information Officer. Mr. Cooley holds a B.S. in
industrial engineering from the Georgia Institute of Technology.
 
     MR. MCNEIGHT has served as our Vice President (Americas Sales) since August
1996. Prior to joining our company, Mr. McNeight was employed for more than 20
years in various sales, sales management and
 
                                       43
<PAGE>   48
 
executive management positions with technology and service companies, having
most recently been a principal in The Complex Sale, a strategic sales consulting
and training firm, from December 1995 to August 1996. In 1995, Mr. McNeight was
Senior Vice President, Americas Operations, for TSW International, Inc., a
supplier of plant performance and maintenance management software. Additionally,
Mr. McNeight was Chief Executive Officer of Aurum Software Inc., a provider of
sales, marketing and customer service software that was subsequently acquired by
Baan Company, from 1993 to 1994 and, prior to that, spent 13 years at Dun &
Bradstreet, ending his tenure there as Executive Vice President for the
Americas. Mr. McNeight serves on the board of directors of Firstwave
Technologies, Inc. Mr. McNeight has a B.S. in chemistry from Oklahoma State
University and an M.S. in management information sciences from Texas Christian
University.
 
     MR. BOGAERTS joined us as our Vice President (Europe) in February 1996.
Before joining us, Mr. Bogaerts was an independent technology consultant from
September 1995 to February 1996, and prior to that held sales, marketing and
strategic marketing, and general management positions with Dun & Bradstreet
Software from 1992 to September 1995, and with Ethica N.V., an enterprise IT
management and consulting firm, from 1989 to 1992. Mr. Bogaerts received a
degree in applied economics and management sciences from the University of
Leuven, Belgium, and an M.B.A. through a joint program of the University of
Leuven, the University of Chicago and Cornell University Business Schools.
 
     MR. LIN has served as our Vice President (Asia/Pacific) since January 1997
and manages the Company's Asia/Pacific operations from the Company's office in
Tokyo. Mr. Lin has over 20 years of sales and marketing experience in the
Asia/Pacific software market. From 1984 to December 1996, he held a number of
sales, marketing and development positions with Dun & Bradstreet Technology Asia
(formerly known as Ashisuto KK), most recently as its Vice President and General
Manager of Sales and Operations. Mr. Lin holds a B.A. in business administration
from Aoyama Gakuin University in Tokyo.
 
     MR. BODMAN joined our Board in July 1997. Since May 1996, Mr. Bodman has
served as the Managing General Partner of AT&T Ventures, LLC, which manages
numerous venture capital investments. Before joining AT&T Ventures, LLC, Mr.
Bodman served AT&T Corporation in various senior management positions. Mr.
Bodman serves on the board of directors of several public companies, including
Tyco International, Inc., LIN Television, Inc., NHP, Inc., Reed Elsevier plc.
and Young & Rubicam, and several private companies. Mr. Bodman holds a B.S. in
engineering from Princeton University and an M.S. in industrial management from
the Massachusetts Institute of Technology.
 
     MR. DAVOLI has been a director since February 1996. Mr. Davoli has been a
general partner of or an advisor to Sigma Partners, a venture capital firm,
since January 1995. Mr. Davoli was President and Chief Executive Officer of
Epoch Systems, Inc., a client/server storage management provider, from February
1993 to September 1994. From May 1986 through June 1992, Mr. Davoli was the
President and Chief Executive Officer of SQL Solutions, a relational database
management systems consulting and tools company that he founded and sold to
Sybase, Inc. in January 1990. Mr. Davoli serves as a director of several
privately held companies. Mr. Davoli received a B.A. in history from Ricker
College.
 
     MR. O'CONNOR has served as a director since October 1995. Mr. O'Connor has
been the Chief Executive Officer and Chairman of DoubleClick Inc., a provider of
Internet advertising services, since January 1996. From September 1994 to
December 1995, Mr. O'Connor served as Director of Research for Digital
Communications Associates, a data communications company (now Attachmate
Corporation), and from April 1992 to September 1994, as its Chief Technical
Officer and Vice President, Research. From its inception in May 1983 until its
sale in April 1992, Mr. O'Connor served as Vice President, Research of
Intercomputer Communications
                                       44
<PAGE>   49
 
Corp., a software development company. Mr. O'Connor received his B.S. in
electrical engineering from the University of Michigan.
 
     MR. STROHM has served as a director since January 1996. Since 1980, Mr.
Strohm has been an employee of Greylock Management Corporation, a venture
capital group and has been a general partner of several venture capital funds
affiliated with Greylock. Mr. Strohm currently serves as a director of
DoubleClick, Banyan Systems, Inc., an enterprise networking software company,
and Legato Systems, Inc., a data storage management software company. Mr. Strohm
received his B.A. from Dartmouth College and his M.B.A. from Harvard Business
School.
 
                              CLASSES OF DIRECTORS
 
     Our charter and bylaws provide that the size of the board shall be
determined by resolution of the board. The board is currently composed of six
members. Each director holds office until their next election at an annual
meeting of stockholders or until his or her successor is duly elected and
qualified. Our charter and bylaws also provide that, beginning with our 1999
annual meeting of stockholders, the board will be divided into three classes
serving staggered three-year terms as follows:
 
<TABLE>
<CAPTION>
CLASS    CURRENT DIRECTORS      NEXT ELECTION
- -----    -----------------      -------------
<C>      <S>                  <C>
  I      Messrs. Bodman       1999 Annual
         and O'Connor         Meeting
 II      Messrs. Noonan       2000 Annual
         and Strohm           Meeting
 III     Messrs. Davoli       2001 Annual
         and Klaus            Meeting
</TABLE>
 
                                BOARD COMMITTEES
 
     The board established an audit committee in January 1998. The members of
the audit committee are Messrs. Bodman, Davoli and Noonan. The audit committee
reviews, acts on and reports to the board with respect to various auditing and
accounting matters, including the selection of the auditors, the scope of the
annual audits, fees to be paid to the auditors, the performance of the
independent auditors and our accounting practices.
 
     The board established a compensation committee in February 1996 and
re-authorized it in January 1998. The members of the compensation committee are
Messrs. Davoli, O'Connor and Strohm. The compensation committee determines the
salaries and incentive compensation of our officers and provides recommendations
for the salaries and incentive compensation of our other employees. The
compensation committee also administers our various incentive compensation,
stock and benefit plans.
 
          COMPENSATION COMMITTEE INTERLOCKS AND INSIDER PARTICIPATION
 
     The board established a compensation committee in February 1996. During
1997, Messrs. Davoli, O'Connor and Strohm served as members of the compensation
committee. None of these individuals has served at any time as one of our
officers or employees. Prior to the establishment of the compensation committee,
all decisions relating to executive compensation were made by the board. For a
description of the transactions between us and members of the compensation
committee and entities affiliated with such members, see "Certain Transactions".
None of our executive officers serve as a member of the board of directors or
compensation committee of any entity which has one or more executive officers
serving as a member of the board or compensation committee.
 
                           COMPENSATION OF DIRECTORS
 
     Except for grants of stock options, directors generally do not receive
compensation for services rendered as a director. We also do not pay
compensation for committee participation or special assignments of the board. We
reimburse each director for all out-of-pocket expenses incurred in attending
meetings of the board and committees thereof. Non-employee board members receive
option grants at periodic intervals under the automatic option grant program of
our stock option plan and also are eligible to receive discretionary option
grants under the discretionary option grant program of such plan. See "-- Our
Stock Option Plan".
 
                                       45
<PAGE>   50
 
     On December 8, 1997, we granted to each of Messrs. Bodman, Davoli, O'Connor
and Strohm an option to purchase 20,000 shares of common stock at an exercise
price of $7.00 per share. These options are immediately exercisable for all of
the option shares. However, the shares purchasable upon exercise of the options
are unvested, and subject to repurchase at the option exercise price paid per
share, upon an early termination of the optionee's board service. The shares
subject to each option grant will vest as to 25% of the option shares upon the
optionee's completion of each year of board service after the grant date. These
options expire 10 years from the grant date, subject to earlier termination
following the cessation of the optionee's board service. These options will
immediately vest in the event of either certain changes in the ownership or
control of our company (except upon assumption of such options by the
successor), or the death or disability of the optionee while serving as a board
member.
 
                                INDEMNIFICATION
 
     The bylaws provide for indemnification of directors and officers to the
fullest extent permitted by Delaware law, except if limited by contract. We have
indemnification agreements with all of our directors and have purchased
directors' and officers' liability insurance. In addition, our charter limits
the personal liability of board members to our company or our stockholders for
breaches of the directors' fiduciary duties to the fullest extent permitted by
Delaware law. See "Description of Securities -- Certain Anti-Takeover, Limited
Liability and Indemnification Provisions".
 
            EMPLOYMENT CONTRACTS AND CHANGE IN CONTROL ARRANGEMENTS
 
     Our officers serve at the discretion of the board.  We do not presently
have an employment contract in effect with any of our executive officers. The
compensation committee, as plan administrator of our stock option plan, has the
authority to accelerate vesting of the shares of common stock subject to
outstanding options held by the chief executive officer and our other executive
officers or any unvested shares actually held by those individuals under our
stock option plan, in the event that we are acquired by merger, consolidation or
asset sale or there is a change in control effected by a successful tender or
exchange offer for more than 50% of our outstanding voting securities or a
change in the majority of the board as a result of one or more contested
elections for board membership. Alternatively, the compensation committee may
condition such accelerated vesting upon the individual's position with us being
replaced with a lesser position or the termination of the individual's service
within a designated period following the acquisition or takeover. In addition,
we have agreements with certain management members regarding acceleration of
option vesting in the event of the consummation of a transaction that results in
a change of control.
 
                                       46
<PAGE>   51
 
                             EXECUTIVE COMPENSATION
 
     SUMMARY COMPENSATION TABLE.  The following table provides certain summary
information concerning the compensation earned by our chief executive officer
and certain other executive officers (collectively, the "Named Officers") whose
salary and bonus exceeded $100,000 for services rendered in all capacities to us
and our subsidiaries during 1997 and 1998.
 
                           SUMMARY COMPENSATION TABLE
 
<TABLE>
<CAPTION>
                                                                                          LONG-TERM
                                                                                        COMPENSATION
                                                           ANNUAL COMPENSATION      ---------------------
                                                           --------------------     SECURITIES UNDERLYING
NAME AND PRINCIPAL POSITION(S)                      YEAR    SALARY       BONUS             OPTIONS
- --------------------------------------------------  ----   --------     -------     ---------------------
<S>                                                 <C>    <C>          <C>         <C>
Thomas E. Noonan..................................  1998   $185,486     $95,000            120,000
  President, Chief Executive Officer and Chairman   1997    130,000      60,000                 --
  of the Board
Alex Bogaerts.....................................  1998    100,000     104,401                 --
  Vice President (Europe)                           1997     89,000(1)   76,000(1)          25,000
Lin Ja Hong.......................................  1998    110,000      62,642             15,000
  Vice President (Asia/Pacific)                     1997    110,000      43,890             27,500
Richard Macchia...................................  1998    135,000      35,320                 --
  Vice President and Chief Financial Officer        1997      1,688(2)       --                 --
M. Thomas McNeight................................  1998    125,000     240,874                 --
  Vice President (Americas Sales)                   1997    125,000      91,300                 --
</TABLE>
 
- ---------------
(1) Mr. Bogaerts' compensation, other than options, was paid to a consulting
    company owned by Mr. Bogaerts.
(2) Mr. Macchia joined our company in December 1997.
 
     OPTION GRANTS IN LAST YEAR.  The following table provides certain
information concerning stock options granted to each of the Named Officers
during 1998. No stock appreciation rights were granted to these individuals
during 1998.
 
                             OPTION GRANTS IN 1998
 
<TABLE>
<CAPTION>
                                           % OF TOTAL                                    POTENTIAL REALIZABLE VALUE AT
                              NUMBER OF     OPTIONS                                         ASSUMED ANNUAL RATES OF
                             SECURITIES     GRANTED     EXERCISE   MARKET                STOCK PRICE APPRECIATION FOR
                             UNDERLYING        TO        PRICE     PRICE                        OPTION TERM(1)
                               OPTIONS     EMPLOYEES      PER       PER     EXPIRATION   -----------------------------
NAME                           GRANTED      IN 1998      SHARE     SHARE       DATE           5%              10%
- ---------------------------  -----------   ----------   --------   ------   ----------   -------------   -------------
<S>                          <C>           <C>          <C>        <C>      <C>          <C>             <C>
Thomas E. Noonan...........      20,000(2)     2.1%      $22.00    $20.00   3/13/2003     $  121,564      $  268,624
                                100,000(3)    10.4        20.00     20.00   3/13/2008      1,257,789       3,187,485
Alex Bogaerts..............          --         --           --        --          --             --              --
Lin Ja Hong................      15,000(4)     1.6        20.00     20.00   3/13/2008        188,668         478,123
Richard Macchia............          --         --           --        --          --             --              --
M. Thomas McNeight.........          --         --           --        --          --             --              --
</TABLE>
 
- ---------------
(1) Future value assumes appreciation in the market value of the common stock of
    5% and 10% per year over the ten-year option period as mandated by the rules
    and regulations of the Securities and Exchange Commission and does not
    represent the our estimate or projection of the future value of the common
    stock. The actual value realized may be greater than or less than the
    potential realizable values set forth in the table.
 
(2) The option is immediately exercisable with respect to 5,000 shares and
    becomes exercisable for an additional 5,000 shares on January 1 of each of
    1999, 2000 and 2001. The option shares are initially unvested and subject to
    repurchase by us. Our repurchase right shall lapse with respect to, and Mr.
    Noonan shall vest in all of the option shares on March 12, 2003, provided
    that Mr. Noonan remains in our service through such date. In addition, our
    repurchase right lapses on an accelerated basis based upon achievement of
    prescribed revenue levels. Based upon 1988 revenues, 5,000 additional shares
    vested on December 31, 1998.
 
(3) The option is exercisable in its entirety on March 12, 2004, subject to
    acceleration based upon achievement of prescribed revenue levels. Based upon
    our 1998 revenues, 25,000 shares became exercisable on December 31, 1998.
 
                                       47
<PAGE>   52
 
(4) The shares underlying these options vest 25% per year over a four-year
    period and are subject to repurchase by us at the exercise price should Mr.
    Lin cease his employment with us prior to full vesting. If we are acquired
    by merger, consolidation or asset sale, the option shares will accelerate in
    full unless the successor assumes these options. In the event that the
    successor assumes these options, if within 12 months following the
    acquisition, Mr. Lin's position is reduced to a lesser position or Mr. Lin's
    employment is involuntarily terminated, the option shares will accelerate in
    part so that the next annual installment of option shares scheduled to vest
    will immediately vest in full and, to the extent Mr. Lin continues in our
    service, each installment of option shares scheduled to vest thereafter will
    vest on each subsequent anniversary of the acceleration date. Each option
    expires on the earlier of ten years from the date of grant or termination of
    Mr. Lin's employment with us. All options were granted at fair market value
    as determined by the board on the date of grant.
 
     AGGREGATE OPTION EXERCISES IN 1998 AND YEAR-END OPTION VALUES.  The
following table provides certain information concerning option exercises and
option holdings for the fiscal year ended December 31, 1998 with respect to each
of the Named Officers.
 
           AGGREGATE 1998 OPTION EXERCISES AND YEAR-END OPTION VALUES
 
<TABLE>
<CAPTION>
                                                  NUMBER OF SECURITIES          VALUE OF UNEXERCISED
                        SHARES                   UNDERLYING UNEXERCISED         IN-THE-MONEY OPTIONS
                       ACQUIRED               OPTIONS AT DECEMBER 31, 1998     AT DECEMBER 31, 1998(1)
                          ON        VALUE     ----------------------------   ---------------------------
NAME                   EXERCISE   REALIZED    EXERCISABLE    UNEXERCISABLE   EXERCISABLE   UNEXERCISABLE
- ---------------------  --------   ---------   -----------    -------------   -----------   -------------
<S>                    <C>        <C>         <C>            <C>             <C>           <C>
Thomas E. Noonan.....       --    $      --      35,000(2)      85,000(2)    $1,205,000     $2,955,000
Alex Bogaerts........   16,250      519,969      28,750(3)          --        1,568,500             --
Lin Ja Hong..........       --           --      27,500(3)      15,000        1,448,000        525,000
Richard Macchia......       --           --     125,000(3)          --        6,000,000             --
M. Thomas McNeight...  100,000    2,742,356     135,000(3)          --        7,404,750             --
</TABLE>
 
- ---------------
(1) Value determined by subtracting the exercise price from the closing price
    per share of the common stock on the Nasdaq National Market on December 31,
    1998 ($55.00 per share).
 
(2) Mr. Noonan's options vest as described in footnotes (2) and (3) to the table
    captioned "Option Grants in 1998".
 
(3) The shares purchasable upon exercise of these options are subject to
    repurchase by us at the exercise price upon the optionee's termination of
    employment prior to vesting in the shares. Our repurchase right lapses with
    respect to, and the optionee vests in, 25% of the option shares upon the
    optionee's completion of each year of service. As of December 31, 1998, the
    number of exercisable vested option shares for each named officer was as
    follows: Mr. Bogaerts -- no shares; Mr. Lin -- 6,875 shares; Mr.
    Macchia -- 31,250 shares; Mr. McNeight -- 17,500 shares.
 
                             OUR STOCK OPTION PLAN
 
     The board of directors of Internet Security Systems, Inc. first adopted the
Restated 1995 Stock Incentive Plan on September 6, 1995, and its stockholders
approved this stock option plan on January 31, 1996. On December 8, 1997, we
assumed this stock option plan and all outstanding options thereunder and
converted such options on a share-for-share basis into options to purchase
shares of our common stock. As of December 31, 1998, we had reserved 3,000,000
shares of common stock for issuance under our stock option plan. We will
automatically increase this share reserve on the first trading day of each
calendar year beginning with 1999 by an amount equal to three percent of the
number of shares of common stock outstanding on the last trading day of the
immediately preceding calendar year. Accordingly, on January 4, 1999, 518,762
additional shares of common stock were reserved for issuance under our stock
option plan. No single participant in our stock option plan may receive option
grants or direct stock issuances for more than 300,000 shares per calendar year.
 
     Our stock option plan has three separate components:
 
- - the discretionary option grant program, which allows the plan administrator to
  grant options to purchase shares of common stock to eligible individuals at an
  exercise price equal to, greater than or less than their fair market value on
  the grant date;
 
- - the stock issuance program, which allows the plan administrator to issue
  shares of
 
                                       48
<PAGE>   53
 
  common stock directly to eligible individuals for a price equal to, greater
  than or less than their fair market value at the time of issuance, or as a
  bonus for services rendered; and
 
- - the automatic option grant program, which automatically grants options to
  purchase shares of common stock at an exercise price equal to 100% of the fair
  market value of such shares on the grant date at periodic intervals to
  eligible non-employee board members.
 
     The compensation committee of the board administers the discretionary
option grant program and the stock issuance program. The compensation committee,
as current plan administrator, has complete discretion to determine:
 
- - which eligible individuals are to receive option grants or stock issuances;
 
- - the time or times when such option grants or stock issuances are to be made;
 
- - the number of shares subject to each such grant or issuance;
 
- - the status of any granted option as either an incentive stock option or a
  non-statutory stock option under the federal tax laws;
 
- - the vesting schedule to be in effect for the option grant or stock issuance;
  and
 
- - the maximum term for which any granted option is to remain outstanding.
 
     The administration of the automatic option grant program is self-executing
in accordance with its express provisions.
 
     The exercise price for the shares of common stock subject to option grants
made under our stock option plan may be paid in cash or in shares of common
stock (held for the requisite period necessary to avoid a charge to our earnings
for financial reporting purposes) valued at fair market value on the exercise
date. The option may also be exercised through a same-day sale program without
any cash outlay by the optionee. In addition, the plan administrator may provide
financial assistance to optionees in the exercise of outstanding options by
allowing optionees to deliver a full-recourse, interest-bearing promissory note
in payment of the exercise price and any associated withholding taxes incurred
in connection with such exercise. During the 90-day period following the date of
this prospectus, optionees exercising options under our stock option plan will
be required to enter into lock-up agreements with the representatives of the
underwriters.
 
     If we are acquired by merger, consolidation or asset sale, each outstanding
option under the discretionary option grant program which is not to be assumed
by our successor will automatically become fully exercisable, and all unvested
shares under the stock issuance program will immediately vest, except to the
extent our repurchase rights with respect to those shares are to be assigned to
our successor. In the event an outstanding option is assumed and our repurchase
rights are assigned to our successor, and within 12 months following the merger,
consolidation or asset sale, either the optionee is offered a lesser position
compared to the position held by the optionee prior to the acquisition or the
optionee's service is terminated, either involuntarily or through resignation as
a result of being offered a lesser position, then the option will accelerate in
part so that it will become immediately exercisable with respect to the next
annual installment of option shares scheduled to vest. The plan administrator
also has the authority under the discretionary option grant and stock issuance
programs to grant options and to structure repurchase rights so that the shares
subject to those options or repurchase rights will automatically vest in the
event the individual is offered a lesser position or the individual's service is
terminated, whether involuntarily or through a resignation as a result of being
offered a lesser position, within a specified period (not to exceed 12 months)
following a change in control effected by a successful tender offer for more
than 50% of the outstanding voting stock or by proxy contest for the election of
directors. The plan administrator also has the discretion to provide for the
automatic acceleration of outstanding options and the lapse of any outstanding
repurchase rights
                                       49
<PAGE>   54
 
upon certain changes in the ownership or control.
 
     In February 1998, we entered into an Amended and Restated Agreement
Regarding Acceleration of Vesting of Future Optionees with Greylock Equity
Limited Partnership ("Greylock"), Sigma Associates III, L.P., Sigma Investors
III, L.P. and Sigma Partners III, L.P. (collectively, the "Sigma Entities"),
AT&T Venture Fund II, L.P. and Venture Fund I, L.P. (collectively, the "AT&T
Entities") and Kleiner, Perkins, Caufield & Byers VIII, KPCB Information
Sciences Zaibatsu Fund II and KPCB Java Fund (collectively, the "KPCB Entities")
which provides that, in all option grants made after the date of the agreement,
we will provide that no more than the greater of (i) 50% of the unvested shares
issued pursuant to such grant or (ii) the options which would be vested in such
optionee's next vesting installment may become immediately vested in the event
that (x) we sell, convey or otherwise dispose of all or substantially all of our
property or business, or merge into or effect a reorganization with any
corporation (other than a wholly-owned subsidiary corporation) in which our
stockholders immediately prior to the transaction possess less than 50% of the
voting power of the surviving entity (or its parent), and (y) the optionee is
not offered a position with the surviving entity which (I) offers compensation
equivalent to or greater than that provided to the optionee by us immediately
prior to the change in control, and (II) offers duties and responsibilities
comparable to those associated with the position held by the optionee with us
immediately prior to the change in control such that the duties and
responsibilities of the optionee with the surviving entity are not materially
diminished from those of the optionee at our company.
 
     The discretionary option grant program authorizes the issuance of stock
appreciation rights, which provide their holders with the election, subject to
the plan administrator's approval, to surrender their outstanding options for an
appreciation distribution from us equal to the excess of the fair market value
of the vested shares of common stock subject to the surrendered option over the
aggregate exercise price payable for such shares. In addition, the plan
administrator has the authority to grant to certain officers and directors
limited stock appreciation rights which, upon a hostile take-over (as defined in
our stock option plan), generally provide the holders with the automatic right
to surrender his or her outstanding options for an appreciation distribution
from us equal to the excess of the tender price paid in the hostile take-over
for the vested shares subject to the surrendered options over the aggregate
exercise price payable for such shares. Such appreciation distribution may be
made in cash or in shares of common stock.
 
     The plan administrator also has the authority to effect the cancellation of
outstanding options under the discretionary option grant program with the
consent of the affected option holders in return for the grant of new options
for the same or different number of option shares with an exercise price per
share based upon the fair market value of the common stock on the new grant
date.
 
     Under the automatic option grant program, each individual who first joins
the board as a non-employee director will receive an option to purchase 20,000
shares of common stock on the date he or she is first elected or appointed to
the board, provided he or she has not otherwise been in our prior employ. In
addition, at each annual stockholders meeting each individual who is to continue
to serve as a non-employee board member after the meeting will receive an
additional option to purchase 2,500 shares of common stock.
 
     Each automatic grant will have a term of 10 years, subject to earlier
termination following the optionee's cessation of board service. Each automatic
option will be immediately exercisable; however, any shares purchased upon
exercise of the option will be subject to repurchase by us should the optionee's
service as a non-employee board member cease prior to vesting in the shares. An
initial 20,000-share grant will vest in four equal successive annual
installments over an optionee's period of board service. However, the shares
subject to each initial automatic
                                       50
<PAGE>   55
 
grant will immediately vest upon certain changes in the ownership or control of
our company or upon the death or disability of the optionee while serving as a
board member. Each additional 2,500-share grant will vest immediately.
 
     The board may amend or modify our stock option plan at any time. Our stock
option plan will terminate on the earliest of September 6, 2005, the date on
which all available shares have been issued as vested shares or the termination
of all outstanding options in connection with certain changes in the ownership
or control.
 
                                       51
<PAGE>   56
 
                              CERTAIN TRANSACTIONS
 
                        SALE OF SERIES A PREFERRED STOCK
 
     In February 1996, we sold an aggregate of 3,650,000 shares of our Series A
preferred stock for $1.00 per share in a private placement exempt from
registration under Section 4(2) of the Securities Act of 1933. The purchasers of
the Series A preferred stock included, among others, Greylock and the Sigma
Entities. The Series A preferred stock automatically converted into common stock
on a one-for-one basis upon the completion of our initial public offering.
Concurrently with the closing of the financing, David N. Strohm, an employee of
Greylock and the general partner of several venture capital funds associated
with Greylock, and Robert E. Davoli, a general partner of the Sigma Entities,
joined the board.
 
     In connection with the sale of the Series A preferred stock, we entered
into an agreement with Greylock and Sigma Partners concerning certain of the
shares of the common stock sold by the underwriters of the initial public
offering of the common stock to persons designated by us ("Directed Shares").
This agreement required us to use our best efforts to cause Greylock and the
Sigma Entities to receive up to 100,000 Directed Shares at the initial public
offering price. Pursuant to this right, Greylock and the Sigma Entities
purchased 36,488 and 27,674 Directed Shares, respectively, in our initial public
offering. Also in connection with the 1996 Series A preferred stock financing,
we:
 
- - entered into an Agreement Regarding Acceleration of Vesting of Future
  Optionees with Greylock and the Sigma Entities, which was later amended and
  restated to make certain technical clarifications;
 
- - entered into a Rights Agreement, which was amended and restated in connection
  with the sale of our Series B preferred stock; and
 
- - repurchased 100,000 shares of common stock from Christopher W. Klaus, a
  founder, officer and director of the Company, for $15,000.
 
                        SALE OF SERIES B PREFERRED STOCK
 
     In February 1997, we sold an aggregate of 2,086,957 shares of our Series B
preferred stock for $2.53 per share in a private placement exempt from
registration under Section 4(2) of the Securities Act of 1933. The purchasers of
the Series B preferred stock included, among others, Greylock, the Sigma
Entities, the AT&T Entities and the KPCB Entities. The Series B preferred stock
automatically converted into common stock on a one-for-one basis upon the
closing of our initial public offering. Richard S. Bodman, the managing general
partner of the AT&T Entities, joined our board in July 1997.
 
     In connection with the sale of the Series B preferred stock, we entered
into an agreement with the AT&T Entities and Kleiner, Perkins, Caufield & Byers
("KPCB") concerning Directed Shares. This agreement required us to use our best
efforts to cause the AT&T Entities and KPCB to receive up to 100,000 Directed
Shares at the initial public offering price. Pursuant to this right, the AT&T
Entities and KPCB purchased 15,141 and 19,789 Directed Shares, respectively in
our initial public offering.
 
     In connection with the sale of the Series B preferred stock, we also
entered into an Agreement Regarding Acceleration of Vesting of Future Optionees
with the AT&T Entities and the KPCB Entities, which was later amended and
restated to make certain technical clarifications. We also entered into an
Amended and Restated Rights Agreement. Pursuant to this agreement, purchasers of
the Series A preferred stock and Series B preferred stock have the right,
subject to certain conditions and limitations, to require us to file a
registration statement, including, if requested, a shelf registration statement,
under the Securities Act of 1933 in order to register all or part of their
shares of common stock. In certain circumstances, we may defer such
registrations, and the underwriters have the right, subject to certain
limitations, to limit the number of shares included in such registrations. In
the event that we propose to register any of our securities under the
 
                                       52
<PAGE>   57
 
Securities Act of 1933, either for our account or for the account of other
security holders, the purchasers of the Series A preferred stock and Series B
preferred stock and certain holders of the common stock, including Christopher
W. Klaus, Thomas E. Noonan and Kevin J. O'Connor, are entitled to include their
shares of common stock in such registration, subject to marketing and other
limitations. Generally, we are required to bear all expenses associated with
such registrations.
 
   AMENDED AND RESTATED AGREEMENT REGARDING ACCELERATION OF FUTURE OPTIONEES
 
     In February 1998, we entered into an Amended and Restated Agreement
Regarding Acceleration of Vesting of Future Optionees with Greylock, the Sigma
Entities, the AT&T Entities and the KPCB Entities which restricts the
acceleration of vesting of shares subject to options in certain situations. For
a more detailed description of this agreement, see "Management -- Our Stock
Option Plan".
 
                              FUTURE TRANSACTIONS
 
     All future transactions, including loans, between us and our officers,
directors, principal stockholders and their affiliates, will be approved by a
majority of the board, including a majority of the independent and disinterested
outside directors on the board, and will continue to be on terms no less
favorable to us than could be obtained from unaffiliated third parties.
 
                                       53
<PAGE>   58
 
                       PRINCIPAL AND SELLING STOCKHOLDERS
 
     The following table sets forth certain information regarding beneficial
ownership of the common stock as of January 28, 1999 adjusted to reflect the
sale of shares offered hereby for
 
- - each person who is known by us to own beneficially more than five percent of
  the common stock;
- - each Named Officer;
- - each director;
- - each selling stockholder; and
- - all current executive officers and directors as a group.

     Unless otherwise indicated, the address for the following stockholders is
c/o ISS Group, Inc., 6600 Peachtree-Dunwoody Road, 300 Embassy Row, Suite 500,
Atlanta, Georgia 30328.
 
<TABLE>
<CAPTION>
                                       SHARES BENEFICIALLY                    SHARES BENEFICIALLY
                                         OWNED BEFORE THE                       OWNED AFTER THE
                                             OFFERING            NUMBER         OFFERING(1)(2)
                                     ------------------------   OF SHARES   -----------------------
BENEFICIAL OWNER                       NUMBER      PERCENTAGE    OFFERED      NUMBER     PERCENTAGE
- -----------------------------------  -----------   ----------   ---------   ----------   ----------
<S>                                  <C>           <C>          <C>         <C>          <C>
Christopher W. Klaus...............    3,915,276      22.6%      800,000     3,115,276      16.8%
Ark Asset Management Co., Inc.(3)..    2,740,000      15.8            --     2,740,000      14.8
Thomas E. Noonan(4)................    1,621,070       9.3       140,000     1,481,070       8.0
Greylock Equity Limited
  Partnership(5)...................      885,991       5.1            --       885,991       4.8
Alex Bogaerts(6)...................       42,600         *         3,000        39,600         *
Lin Ja Hong(7).....................       31,250         *         2,500        28,750         *
Rich Macchia(8)....................      125,600         *        12,500       112,500         *
M. Thomas McNeight(9)..............      135,000         *        17,000       118,000         *
Richard S. Bodman(10)..............      281,638       1.6            --       281,638       1.5
Robert E. Davoli(11)...............      841,762       4.9            --       841,762       4.5
Kevin J. O'Connor(12)..............      473,980       2.7        70,000       403,980       2.2
David N. Strohm(5).................      885,991       5.1            --       885,991       4.8
Nancy Blair(13)....................      157,500         *        20,000       137,500         *
H. Keith Cooley(14)................      130,000         *        30,000       100,000         *
Glenn M. McGonnigle(15)............      166,590         *        60,000       106,590         *
Charles Meyers(16).................       90,000         *        20,000        70,000
Patrick J.D. Taylor(17)............       59,500         *        25,000        34,500         *
All directors and officers as a
  group (11 persons)(18)...........    8,484,167      47.5      1,075,000    7,409,167      38.9
</TABLE>
 
- ---------------
 
   * Indicates less than 1%.
 
 (1) Assumes no exercise of the underwriters' over-allotment option.
 
 (2) Beneficial ownership is calculated in accordance with the rules of the
     Securities and Exchange Commission. In computing the number of shares
     beneficially owned by a person and the percentage ownership of that person,
     shares of common stock subject to options held by that person that are
     currently exercisable or become exercisable within 60 days following
     January 28, 1999, are deemed outstanding. However, such shares are not
     deemed outstanding for the purpose of computing the percentage ownership of
     any other person. Unless otherwise indicated in the footnotes to this
     table, the persons and entities named in the table have sole voting and
     sole investment power with respect to all shares beneficially owned,
     subject to community property laws where applicable.
 
 (3) Based solely on information provided by Ark Asset Management Co., Inc. on
     its Schedule 13G filed December 9, 1998 with the Securities and Exchange
     Commission. The address for Ark Asset Management Co., Inc. is 125 Broad
     Street, New York, New York 10004.
 
                                       54
<PAGE>   59
 
 (4) Includes 168,822 shares held in family trusts and options immediately
     exercisable for 35,000 shares of common stock.
 
 (5) Includes 83,760 shares of common stock held by Mr. Strohm and 802,231
     shares held by Greylock Equity Limited Partnership. The general partner of
     Greylock Equity Limited Partnership is Greylock Equity GP Limited
     Partnership. Mr. Strohm, a director of our company, is a general partner of
     Greylock Equity GP Limited Partnership. Mr. Strohm disclaims beneficial
     ownership of the shares held by Greylock Equity Limited Partnership except
     to the extent of his pecuniary interest therein arising from his general
     partnership interest in Greylock Equity GP Limited Partnership. The address
     of Greylock Equity Limited Partnership and Mr. Strohm is c/o Greylock
     Equity Limited Partnership, 755 Page Mill Road, Building A, Palo Alto,
     California 94304.
 
 (6) Includes options immediately exercisable for 28,750 shares of common stock.
 
 (7) Includes options immediately exercisable for 31,250 shares of common stock.
 
 (8) Includes option immediately exercisable for 125,000 shares of common stock.
 
 (9) Includes options immediately exercisable for 135,000 shares of common
     stock.
 
(10) Includes 66 shares of common stock and options immediately exercisable for
     20,000 shares of common stock held by Mr. Bodman and 261,572 shares held by
     AT&T Venture Fund II, L.P. The general partner of AT&T Venture Fund II,
     L.P. is Venture Management LLC. Mr. Bodman is a managing member of Venture
     Management LLC. Mr. Bodman disclaims beneficial ownership of the shares
     held by AT&T Venture Fund II, L.P. except to the extent of his pecuniary
     interest therein from his management interest in Venture Management LLC.
     Mr. Bodman's address is c/o AT&T Ventures, L.L.C., Two Wisconsin Circle,
     Chevy Chase, Maryland 20815.
 
(11) Includes 49,340 shares of common stock and options immediately exercisable
     for 20,000 shares of common stock held by Mr. Davoli, 125,472 shares held
     by Sigma Associates III, L.P., 10,175 shares held by Sigma Investors III,
     L.P. and 636,775 shares held by Sigma Partners III, L.P. Mr. Davoli, a
     director of our company, is also a general partner of Sigma Management III,
     L.P., which is the general partner of Sigma Associates III, L.P., Sigma
     Investors III, L.P. and Sigma Partners III, L.P. Mr. Davoli disclaims
     beneficial ownership of the shares held by Sigma Associates III, L.P.,
     Sigma Investors III, L.P. and Sigma Partners III, L.P. except to the extent
     of his pecuniary interest therein from his general partnership interest in
     Sigma Management III, L.P. The address of Mr. Davoli and the Sigma Entities
     is 20 Custom House Street, Suite 830, Boston, Massachusetts 02110.
 
(12) Includes options immediately exercisable for 20,000 shares of common stock.
     In addition to the number of shares shown as offered for sale in the table,
     Mr. O'Connor has granted the underwriters the right to purchase up to an
     additional 20,000 shares pursuant to the underwriters' over-allotment
     option. Mr. O'Connor's address is c/o DoubleClick Inc., 41 Madison Avenue,
     New York, New York 10010.
 
(13) Includes options immediately exercisable for 157,500 shares of common
     stock.
 
(14) Includes options immediately exercisable for 130,000 shares of common
     stock.
 
(15) Includes options immediately exercisable for 85,500 shares of common stock.
     In addition to the number of shares shown as offered for sale in the table,
     Mr. McGonnigle has granted the underwriters the right to purchase up to an
     additional 10,000 shares pursuant to the underwriters' over-allotment
     option.
 
(16) Includes options immediately exercisable for 90,000 shares common stock.
 
(17) Includes options immediately exercisable for 14,500 shares of common stock.
 
(18) Includes options immediately exercisable for 545,000 shares of common
     stock.
 
                                       55
<PAGE>   60
 
                           DESCRIPTION OF SECURITIES
 
                    AUTHORIZED AND OUTSTANDING CAPITAL STOCK
 
     Our authorized capital stock consists of 50,000,000 shares of common stock,
par value $0.001 per share, and 20,000,000 shares of preferred stock, par value
$0.001 per share. Upon consummation of this offering, no shares of preferred
stock and 18,512,462 shares of common stock (18,842,462 shares if the
underwriters' over-allotment option is exercised in full) will be outstanding.
The following summary is qualified in its entirety by reference to our charter
and bylaws, copies of which are filed as exhibits to the registration statement
of which this prospectus is a part.
 
                                  COMMON STOCK
 
     As of December 31, 1998, there were 17,292,087 shares of common stock
outstanding that were held by 201 stockholders of record. The holders of common
stock are entitled to one vote per share on all matters to be voted upon by the
stockholders. Subject to preferences that may be applicable to any outstanding
preferred stock, the holders of common stock are entitled to receive ratably
such dividends, if any, as may be declared from time to time by the board out of
funds legally available therefor. In the event of liquidation, dissolution or
winding up, the holders of common stock are entitled to share ratably in all
assets remaining after payment of liabilities, subject to prior distribution
rights of preferred stock, if any, then outstanding. The common stock has no
preemptive or conversion rights or other subscription rights. There are no
redemption or sinking fund provisions applicable to the common stock. All
outstanding shares of common stock are fully paid and nonassessable, and the
shares of common stock to be issued upon completion of this offering will be
fully paid and nonassessable.
 
                                PREFERRED STOCK
 
     The board has the authority to issue the preferred stock in one or more
series and to fix the rights, preferences, privileges and restrictions thereof,
including dividend rights, dividend rates, conversion rights, voting rights,
terms of redemption, redemption prices, liquidation preferences and the number
of shares constituting any series or the designation of such series, without
further vote or action by the stockholders. The issuance of preferred stock may
have the effect of delaying, deferring or preventing a change in control of our
company without further action by the stockholders and may adversely affect the
voting and other rights of the holders of common stock. The issuance of
preferred stock with voting and conversion rights may adversely affect the
voting power of the holders of common stock, including the loss of voting
control to others. At present, we have no plans to issue any shares of preferred
stock.
 
                                 STOCK OPTIONS
 
     As of December 31, 1998, options to purchase a total of 2,379,670 shares of
common stock were outstanding. The total number of shares of common stock that
may be subject to the granting of options under our stock option plan shall be
equal to 3,000,000 shares plus the number of shares with respect to options
previously granted under our stock option plan that terminate without being
exercised, expire, are forfeited or canceled, and the number of shares of common
stock that are surrendered in payment of any options or any tax withholding
requirements. In addition, on the first trading date of each year, the share
reserve will be increased by an amount equal to three percent of the total
number of shares of common stock outstanding on the last trading day of the
immediately preceding calendar year. Pursuant to this automatic increase
provision, on January 4, 1999 an additional 518,762 shares of common stock were
reserved for issuance under our stock option plan. See "Management -- Our Stock
Option Plan" and "Shares Eligible for Future Sale".
 
     On May 21, 1998, we filed a registration statement with the Securities and
Exchange Commission pursuant to which we registered
 
                                       56
<PAGE>   61
 
the 3,000,000 shares of common stock issued or issuable at that time upon the
exercise of options granted under our stock option plan. Such registration
statement became immediately effective upon filing. We have outstanding a large
number of stock options to purchase common stock with exercise prices
significantly below the current market price of the common stock. The possible
sale of a significant number of such shares by the holders thereof may have an
adverse effect on the price of the common stock.
 
    CERTAIN ANTI-TAKEOVER, LIMITED LIABILITY AND INDEMNIFICATION PROVISIONS
 
SECTION 203 OF THE DELAWARE GENERAL CORPORATION LAW
 
     We are subject to the provisions of Section 203 of the Delaware General
Corporation Law, as amended from time to time. Subject to certain exceptions,
Section 203 prohibits a publicly-held Delaware corporation from engaging in a
"business combination" with an "interested stockholder" for a period of three
years after the date of the transaction in which the person became an interested
stockholder, unless the interested stockholder attained such status with the
approval of the board of directors or unless the business combination is
approved in a prescribed manner. A "business combination" includes mergers,
assets sales and other transactions resulting in a financial benefit to the
interested stockholder. Subject to certain exceptions, an "interested
stockholder" is a person who, together with affiliates and associates, owns, or
within three years did own, 15% or more of the corporation's voting stock. The
statute could prohibit or delay the accomplishment of mergers or other takeover
or change in control attempts with respect to us and, accordingly, may
discourage attempts to acquire our company.
 
CHARTER AND BYLAW PROVISIONS
 
     Our charter and bylaws include provisions that may have the effect of
discouraging, delaying or preventing a change in control or an unsolicited
acquisition proposal that a stockholder might consider favorable, including a
proposal that might result in the payment of a premium over the market price for
the shares held by stockholders. These provisions are summarized in the
following paragraphs.
 
     CLASSIFIED BOARD OF DIRECTORS.  Our charter and bylaws provide for the
board to be divided into three classes of directors serving staggered,
three-year terms. The classification of the board has the effect of requiring at
least two annual stockholder meetings, instead of one, to replace a majority of
board members.
 
     SUPERMAJORITY VOTING.  Our charter requires that holders of at least
66 2/3% of our company's combined voting power approve certain amendments to the
charter unless such amendments are approved by a majority of the directors not
affiliated or associated with any person holding (or which has announced an
intention to acquire) 26% or more of the voting power of our outstanding capital
stock. Either a majority of the board or holders of a majority of voting stock
may amend the bylaws, but certain amendments approved by stockholders require
the approval of at least 66 2/3% of our combined voting power unless such
amendments are approved by a majority of the directors not affiliated or
associated with any person holding (or which has announced an intention to
acquire) 26% or more of the voting power of our outstanding capital stock.
 
     AUTHORIZED BUT UNISSUED OR UNDESIGNATED CAPITAL STOCK.  Our charter
authorizes 50,000,000 shares of common stock and 20,000,000 shares of preferred
stock. No preferred stock will be designated upon consummation of this offering.
After this offering, 18,512,462 shares of common stock will be outstanding
(18,842,462 shares if the underwriters' over-allotment option is exercised in
full). The authorized but unissued (and in the case of preferred stock,
undesignated) stock may be issued by the board in one or more transactions. In
this regard, our charter grants the board broad power to establish the rights
and preferences of authorized and unissued preferred stock. The issuance of
shares of preferred stock pursuant to the board's authority described
 
                                       57
<PAGE>   62
 
above could decrease the amount of earnings and assets available for
distribution to holders of common stock and adversely affect the rights and
powers, including voting rights, of such holders and may have the effect of
delaying, deferring or preventing a change in control. The board does not
currently intend to seek stockholder approval prior to any issuance of preferred
stock, unless otherwise required by law.
 
     SPECIAL MEETINGS OF STOCKHOLDERS.  Our bylaws provide that special meetings
of our stockholders may be called only by our board, chairman or President.
 
     NO STOCKHOLDER ACTION BY WRITTEN CONSENT.  Our charter and bylaws provide
that an action required or permitted to be taken at any annual or special
meeting of the stockholders may only be taken at a duly called annual or special
meeting of stockholders. This provision prevents stockholders from initiating or
effecting any action by written consent, and thereby taking actions opposed by
the board.
 
     NOTICE PROCEDURES.  Our bylaws establish advance notice procedures with
regard to all stockholder proposals to be brought before meetings of our
stockholders, including proposals relating to the nomination of candidates for
election as directors, the removal of directors and amendments to our charter or
bylaws. These procedures require notice of such stockholder proposals to be
given timely and in writing to our corporate secretary prior to the meeting.
Generally, to be timely, notice must be received by our corporate secretary not
less than 120 days prior to the meeting. The notice must contain certain
information specified in our bylaws.
 
     OTHER ANTI-TAKEOVER PROVISIONS.  See "Management -- Our Stock Option Plan"
for a discussion of certain provisions of our stock option plan which may have
the effect of discouraging, delaying or preventing a change in control or
unsolicited acquisition proposals.
 
     LIMITATION OF DIRECTOR LIABILITY.  Our charter limits the liability of
directors (in their capacity as directors but not in their capacity as officers)
to our company or our stockholders to the fullest extent permitted by Delaware
law. Specifically, directors will not be personally liable for monetary damages
for breach of a director's fiduciary duty as a director, except for liability:
 
- - for any breach of the director's duty of loyalty to our company or our
  stockholders;
 
- - for acts or omissions not in good faith or which involve intentional
  misconduct or a knowing violation of law;
 
- - under Section 174 of the Delaware General Corporation Law, which relates to
  unlawful payments of dividends or unlawful stock repurchases or redemptions;
  or
 
- - for any transaction from which the director derived an improper personal
  benefit.
 
     INDEMNIFICATION ARRANGEMENTS.  Our bylaws provide that our directors and
officers shall be indemnified and provide for the advancement to them of
expenses in connection with actual or threatened proceedings and claims arising
out of their status as such to the fullest extent permitted by the Delaware
General Corporation Law. We have entered into indemnification agreements with
each of our directors and executive officers that will provide them with rights
to indemnification and expense advancement to the fullest extent permitted under
the Delaware General Corporation Law.
 
REGISTRATION RIGHTS
 
     Pursuant to the terms of the Amended and Restated Rights Agreement between
our company and certain existing stockholders, the holders of 2,222,761 shares
of common stock have the right, subject to certain conditions and limitations,
to require us to file a registration statement, including, if requested, a shelf
registration statement, under the Securities Act of 1933 in order to register
all or part of such stockholders' shares of common stock. We may in certain
circumstances defer such registrations, and the underwriters have the right,
subject to certain limitations, to limit the number of
 
                                       58
<PAGE>   63
 
shares included in such registrations. In the event that we propose to register
any of our securities under the Securities Act of 1933, either for our own
account or for the account of other security holders, certain stockholders
holding 7,189,177 shares of common stock are entitled to include their shares of
common stock in such registration, subject to marketing and other limitations.
Generally, we are required to bear the expense of all such registrations.
 
                          TRANSFER AGENT AND REGISTRAR
 
     The transfer agent and registrar for the common stock is SunTrust Bank,
Atlanta, located in Atlanta, Georgia.
 
                                       59
<PAGE>   64
 
                        SHARES ELIGIBLE FOR FUTURE SALE
 
     Upon the closing of the offering, we will have an aggregate of 18,512,462
shares of common stock outstanding, assuming no exercise of the underwriters'
over-allotment option and no exercise of outstanding options to purchase common
stock after December 31, 1998.
 
     Of these shares, the 3,450,000 shares sold in our IPO in March 1998, the
2,400,000 shares being offered hereby and 5,165,872 shares that have been sold
in accordance with Rule 144 are freely tradeable.
 
     Of the remaining outstanding shares of common stock, (i) approximately
6,982,398 shares are subject to 90-day lock-up agreements, approximately
6,851,580 of which are also "restricted securities" as that term is defined
under Rule 144, and (ii) approximately 514,192 shares are "restricted
securities", as that term is defined under Rule 144, and not subject to lock-up
agreements. The 6,982,398 shares that are subject to 90-day lock-up agreements
will be eligible for immediate sale in the public market without restriction on
their expiration except that the 6,941,308 shares which are also held by our
"affiliates" may only be sold in compliance with the volume and other
limitations of Rule 144.
 
     In general, under Rule 144, a person (or persons whose shares are
aggregated), including an affiliate, who has beneficially owned shares for at
least one year is entitled to sell, within any three-month period commencing 90
days after the date of this prospectus, a number of shares that does not exceed
the greater of 1% of the then outstanding shares of common stock (approximately
185,125 shares immediately after the offering) or the average weekly trading
volume in the common stock during the four calendar weeks preceding the date on
which notice of such sale is filed, subject to certain restrictions. In
addition, a person who is not deemed to have been an affiliate of us at any time
during the 90 days preceding a sale and who has beneficially owned the shares
proposed to be sold for at least two years would be entitled to sell such shares
under Rule 144(k) without regard to the share volume limitations described
above. To the extent that shares were acquired from an affiliate of us, such
affiliates' holding period for the purpose of effecting a sale under Rule 144
commences on the date of transfer from the affiliate.
 
     On May 21, 1998, we filed a registration statement with the Commission
pursuant to which it registered the 3,000,000 shares of common stock issued or
issuable upon the exercise of options granted or that may be granted in the
future under our stock option plan, as well as 100,000 shares of common stock
that were subject to options granted pursuant to written compensation agreements
separate from our stock option plan. Such registration statement became
immediately effective upon filing. At December 31, 1998, options to purchase
2,379,670 shares were issued and outstanding under our stock option plan and
options to purchase 60,000 shares were issued and outstanding outside of our
stock option plan, all of which shares will be eligible for sale in the public
market from time to time, subject to vesting and, in the case of certain of such
options, the expiration of lock-up agreements. These stock options generally
have exercise prices significantly below the current market price of the common
stock. The possible sale of a significant number of such shares by the holders
thereof may have an adverse affect on the price of the common stock.
 
     The market price of the common stock after the offering may be
significantly affected by the risks detailed in this prospectus, including, but
not limited to, those set forth under the caption "Risk Factors". In particular,
the stock prices for many high technology companies, especially those that base
their respective businesses on the Internet, recently have experienced wide
fluctuations and extreme volatility which have often been unrelated to the
operating performance of such companies. Such fluctuations have adversely
affected and may in the future adversely affect the market price of the common
stock. Furthermore, following periods of volatility in the market price of a
company's securities, securities class action
                                       60
<PAGE>   65
 
claims frequently are brought against the subject company. To the extent that
the market price of the common stock falls dramatically in any period of time,
there is a high likelihood that claims, with or without merit, will be brought
against us. Such litigation would be very expensive to defend and would divert
management attention and resources regardless of outcome.
 
                                       61
<PAGE>   66
 
                            VALIDITY OF COMMON STOCK
 
     The validity of the common stock offered hereby will be passed upon for ISS
by Brobeck, Phleger & Harrison LLP, Austin, Texas, U.S. counsel to ISS. Certain
legal matters in connection with the offering will be passed upon for the
underwriters by Ropes & Gray, Boston, Massachusetts, U.S. counsel for the
underwriters.
 
                                    EXPERTS
 
ISS GROUP, INC.
 
     The consolidated financial statements and schedule audited by Ernst & Young
LLP have been included in reliance on their report given on their authority as
experts in accounting and auditing.
 
MARCH INFORMATION SYSTEMS LIMITED
 
     The financial statements audited by Ernst & Young have been included in
reliance on their report given on their authority as experts in accounting and
auditing.
 
                             ADDITIONAL INFORMATION
 
     We have filed with the Securities and Exchange Commission a registration
statement on Form S-1 (including the exhibits and schedules thereto) under the
Securities Act of 1933 with respect to the shares to be sold in the offering.
This prospectus does not contain all of the information set forth in the
registration statement. For further information with respect to us and the
shares to be sold in the offering, reference is made to the registration
statement. Statements contained in this prospectus as to the contents of any
contract, agreement or other document referred to are not necessarily complete,
and in each instance reference is made to the copy of such contract, agreement
or other document filed as an exhibit to the registration statement, each such
statement being qualified in all respects by such reference. In addition, we
file annual, quarterly and current reports, proxy statements and other
information with the Securities and Exchange Commission.
 
     You may read and copy all or any portion of the registration statement or
any reports, statements or other information we file at the Securities and
Exchange Commission's public reference room at 450 Fifth Street, N.W.,
Washington, D.C. 20549. You can request copies of these documents, upon payment
of a duplicating fee, by writing to the Securities and Exchange Commission.
Please call the Securities and Exchange Commission at 1-800-SEC-0330 for further
information on the operation of the public reference rooms. Our filings with the
Securities and Exchange Commission, including the registration statement of
which this prospectus is a part, are also available to you on the Securities and
Exchange Commission's Internet site (http://www.sec.gov). In addition, reports,
proxy statements and other information concerning our company may be inspected
at the National Association of Securities Dealers, Inc. at 1735 K Street, N.W.,
Washington, D.C. 20006.
 
                                       62
<PAGE>   67
 
                   INDEX TO CONSOLIDATED FINANCIAL STATEMENTS
 
<TABLE>
<S>                                                           <C>
ISS GROUP, INC.
Report of Independent Auditors..............................   F-2
Consolidated Balance Sheets as of December 31, 1997 and
  1998......................................................   F-3
Consolidated Statements of Operations for the Years Ended
  December 31, 1996, 1997 and 1998..........................   F-4
Consolidated Statements of Stockholders' Equity (Deficit)
  for the Years Ended December 31, 1996, 1997 and 1998......   F-5
Consolidated Statements of Cash Flows for the Years Ended
  December 31, 1996, 1997 and 1998..........................   F-6
Notes to Consolidated Financial Statements..................   F-7
MARCH INFORMATION SYSTEMS LIMITED
Report of Independent Auditors..............................  F-18
Consolidated Balance Sheets as of March 31, 1997 and 1998
  and September 30, 1998 (unaudited)........................  F-19
Consolidated Statements of Operations for the Years Ended
  March 31, 1997 and 1998 and the Six Months Ended September
  30, 1997 and 1998 (unaudited).............................  F-20
Consolidated Statements of Shareholders' Equity for the
  Years Ended March 31, 1997 and 1998 and the Six Months
  Ended September 30, 1998 (unaudited)......................  F-21
Consolidated Statements of Cash Flows for the Years Ended
  March 31, 1997 and 1998 and the Six Months Ended September
  30, 1997 and 1998 (unaudited).............................  F-22
Notes to Consolidated Financial Statements..................  F-23
Unaudited Pro Forma Consolidated Statement of Operations....  F-30
</TABLE>
 
                                       F-1
<PAGE>   68
 
                         REPORT OF INDEPENDENT AUDITORS
 
Board of Directors
ISS Group, Inc.
 
     We have audited the accompanying consolidated balance sheets of ISS Group,
Inc. as of December 31, 1997 and 1998, and the related consolidated statements
of operations, stockholders' equity (deficit), and cash flows for each of the
three years in the period ended December 31, 1998. These financial statements
are the responsibility of the Company's management. Our responsibility is to
express an opinion on these financial statements based on our audits.
 
     We conducted our audits in accordance with generally accepted auditing
standards. Those standards require that we plan and perform the audit to obtain
reasonable assurance about whether the financial statements are free of material
misstatement. An audit includes examining, on a test basis, evidence supporting
the amounts and disclosures in the financial statements. An audit also includes
assessing the accounting principles used and significant estimates made by
management, as well as evaluating the overall financial statement presentation.
We believe that our audits provide a reasonable basis for our opinion.
 
     In our opinion, the financial statements referred to above present fairly,
in all material respects, the consolidated financial position of ISS Group, Inc.
at December 31, 1997 and 1998, and the consolidated results of its operations
and its cash flows for each of the three years in the period ended December 31,
1998, in conformity with generally accepted accounting principles.
 
                                          /s/ Ernst & Young LLP
 
January 15, 1999
 
                                       F-2
<PAGE>   69

                                ISS GROUP, INC.
 
                          CONSOLIDATED BALANCE SHEETS
 
<TABLE>
<CAPTION>
                                                                    DECEMBER 31,
                                                              ------------------------
                                                                 1997         1998
                                                              ----------   -----------
<S>                                                           <C>          <C>
                                        ASSETS
Current assets:
  Cash and cash equivalents.................................  $3,929,000   $52,632,000
  Accounts receivable, less allowance for doubtful accounts
     of $255,000 and $287,000, respectively.................   4,038,000    12,586,000
  Prepaid expenses and other current assets.................     281,000       743,000
                                                              ----------   -----------
          Total current assets..............................   8,248,000    65,961,000
Property and equipment:
  Computer equipment........................................   1,688,000     4,370,000
  Office furniture and equipment............................     268,000     1,027,000
  Leasehold improvements....................................      15,000       275,000
                                                              ----------   -----------
                                                               1,971,000     5,672,000
  Less accumulated depreciation.............................     402,000     1,655,000
                                                              ----------   -----------
                                                               1,569,000     4,017,000
Goodwill, less accumulated amortization of $77,000..........          --     3,094,000
Other intangible assets, less accumulated amortization of
  $154,000..................................................          --     4,692,000
Other assets................................................      49,000       257,000
                                                              ----------   -----------
       Total assets.........................................  $9,866,000   $78,021,000
                                                              ==========   ===========


<CAPTION>
                 LIABILITIES AND STOCKHOLDERS' EQUITY (DEFICIT)
<S>                                                           <C>          <C>        
Current liabilities:
  Accounts payable..........................................  $2,002,000   $   692,000
  Accrued expenses..........................................   1,798,000     4,202,000
  Deferred revenues.........................................   2,106,000     6,678,000
  Current portion of long-term debt.........................      70,000            --
                                                              ----------   -----------
       Total current liabilities............................   5,976,000    11,572,000
Long-term debt..............................................      70,000            --
Other liabilities...........................................          --       134,000
Commitments and contingencies
Redeemable, Convertible Preferred Stock (5,737,000 shares
  authorized):
  Series A; $.001 par value; 3,650,000 and 0 shares issued
     and outstanding, respectively (liquidation preference
     $1 per share)..........................................   3,621,000            --
  Series B; $.001 par value; 2,087,000 and 0 shares issued
     and outstanding, respectively (liquidation preference
     $2.53 per share).......................................   5,257,000            --
Stockholders' equity (deficit):
  Preferred stock; $.001 par value; 20,000,000 shares
     authorized, none issued or outstanding
  Common stock, $.001 par value, 50,000,000 shares
     authorized, 7,921,000 and 17,292,000 shares issued and
     outstanding, respectively..............................       8,000        17,000
  Additional paid-in capital................................     695,000    76,110,000
  Deferred compensation.....................................    (571,000)     (662,000)
  Cumulative adjustment for currency revaluation............          --       142,000
  Accumulated deficit.......................................  (5,190,000)   (9,292,000)
                                                              ----------   -----------
       Total stockholders' equity (deficit).................  (5,058,000)   66,315,000
                                                              ----------   -----------
       Total liabilities and stockholders' equity
        (deficit)...........................................  $9,866,000   $78,021,000
                                                              ==========   ===========
</TABLE>
 
See accompanying notes.
 
                                       F-3
<PAGE>   70
 
                                ISS GROUP, INC.
 
                     CONSOLIDATED STATEMENTS OF OPERATIONS
 
<TABLE>
<CAPTION>
                                                              YEAR ENDED DECEMBER 31,
                                                      ---------------------------------------
                                                         1996          1997          1998
                                                      -----------   -----------   -----------
<S>                                                   <C>           <C>           <C>
Revenues:
  Perpetual licenses................................  $ 4,233,000   $10,936,000   $25,936,000
  Subscriptions.....................................      219,000     2,465,000     7,406,000
  Professional services.............................       10,000        66,000     2,587,000
                                                      -----------   -----------   -----------
                                                        4,462,000    13,467,000    35,929,000
Costs and expenses:
  Cost of revenues..................................       18,000       676,000     4,831,000
  Research and development..........................    1,225,000     3,434,000     9,321,000
  Charge for in-process research and development....           --            --       802,000
  Sales and marketing...............................    3,768,000    11,731,000    22,762,000
  General and administrative........................      656,000     1,773,000     4,389,000
  Amortization......................................           --            --       230,000
                                                      -----------   -----------   -----------
                                                        5,667,000    17,614,000    42,335,000
                                                      -----------   -----------   -----------
Operating loss......................................   (1,205,000)   (4,147,000)   (6,406,000)
Interest income.....................................       77,000       245,000     2,382,000
Interest expense....................................       (3,000)      (17,000)      (16,000)
                                                      -----------   -----------   -----------
Loss before income taxes............................   (1,131,000)   (3,919,000)   (4,040,000)
Provision for income taxes..........................           --            --        62,000
                                                      ===========   ===========   ===========
Net loss............................................  $(1,131,000)  $(3,919,000)  $(4,102,000)
                                                      ===========   ===========   ===========
Basic and diluted net loss per share of Common
  Stock.............................................  $     (0.14)  $     (0.50)  $     (0.28)
                                                      ===========   ===========   ===========
Weighted average number of shares used in
  calculating basic and diluted net loss per share
  of Common Stock...................................    7,916,000     7,907,000    14,883,000
                                                      ===========   ===========   ===========
Unaudited pro forma net loss per share of Common
  Stock.............................................                $     (0.29)  $     (0.25)
                                                                    ===========   ===========
Unaudited weighted average number of shares used in
  calculating unaudited pro forma net loss per share
  of Common Stock...................................                 13,644,000    16,189,000
                                                                    ===========   ===========
</TABLE>
 
See accompanying notes.
 
                                       F-4
<PAGE>   71
 
                                ISS GROUP, INC.
 
           CONSOLIDATED STATEMENTS OF STOCKHOLDERS' EQUITY (DEFICIT)
<TABLE>
<CAPTION>
                                                                                                  ACCUMULATED       RETAINED
                                                 COMMON STOCK       ADDITIONAL                       OTHER          EARNINGS
                                             --------------------     PAID-IN       DEFERRED     COMPREHENSIVE    (ACCUMULATED
                                               SHARES     AMOUNT      CAPITAL     COMPENSATION       INCOME         DEFICIT)
                                             ----------   -------   -----------   ------------   --------------   -------------
<S>                                          <C>          <C>       <C>           <C>            <C>              <C>
Balance at December 31, 1995...............   8,002,000   $8,000    $   125,000    $      --        $     --       $  (140,000)
  Comprehensive income (loss)
    Net loss...............................          --       --             --           --              --        (1,131,000)
  Repurchase of Common Stock from
    founder................................    (100,000)      --        (15,000)          --              --                --
  Accretion related to Redeemable,
    Convertible Preferred Stock............          --       --         (7,000)          --              --                --
                                             ----------   -------   -----------    ---------        --------       -----------
Balance at December 31, 1996...............   7,902,000    8,000        103,000           --              --                --
  Comprehensive income (loss)
    Net loss...............................          --       --             --           --              --        (3,919,000)
  Accretion related to Redeemable,
    Convertible Preferred Stock............          --       --        (11,000)          --              --                --
  Deferred compensation related to stock
    options................................          --       --        571,000     (571,000)             --                --
  Issuance of Common Stock.................      19,000       --         32,000           --              --                --
                                             ----------   -------   -----------    ---------        --------       -----------
Balance at December 31, 1997...............   7,921,000    8,000        695,000     (571,000)             --        (5,190,000)
  Comprehensive income (loss)
    Net loss...............................          --       --             --           --              --        (4,102,000)
    Translation adjustment.................          --       --             --           --         142,000                --
                                                     --       --             --           --              --                --
  Issuance of Common Stock:
    Initial public offering................   3,070,000    3,000     61,528,000           --              --                --
    Conversion of Redeemable, Convertible
      Preferred Stock in connection with
      the initial public offering..........   5,737,000    6,000      8,872,000           --              --                --
    Acquisitions...........................     158,000       --      3,901,000           --              --                --
    Exercise of stock options..............     405,000       --        292,000           --              --                --
    Issuance to consultant.................       1,000       --         11,000           --              --                --
  Deferred compensation related to stock
    options................................          --       --        811,000     (811,000)             --                --
  Amortization of deferred compensation in
    connection with stock options..........          --       --             --      720,000              --                --
                                             ----------   -------   -----------    ---------        --------       -----------
Balance at December 31, 1998...............  17,292,000   $17,000   $76,110,000    $(662,000)       $142,000       $(9,292,000)
                                             ==========   =======   ===========    =========        ========       ===========
 
<CAPTION>
                                                                 TOTAL
                                                             STOCKHOLDERS'
                                             COMPREHENSIVE       EQUITY
                                                INCOME         (DEFICIT)
                                             -------------   --------------
<S>                                          <C>             <C>
Balance at December 31, 1995...............            --     $    (7,000)
  Comprehensive income (loss)
    Net loss...............................   $(1,131,000)     (1,131,000)
                                              ===========
  Repurchase of Common Stock from
    founder................................            --         (15,000)
  Accretion related to Redeemable,
    Convertible Preferred Stock............            --          (7,000)
                                                              -----------
Balance at December 31, 1996...............                    (1,160,000)
  Comprehensive income (loss)
    Net loss...............................   $(3,919,000)     (3,919,000)
                                              ===========
  Accretion related to Redeemable,
    Convertible Preferred Stock............            --         (11,000)
  Deferred compensation related to stock
    options................................            --              --
  Issuance of Common Stock.................            --          32,000
                                                              -----------
Balance at December 31, 1997...............            --      (5,058,000)
  Comprehensive income (loss)
    Net loss...............................   $(4,102,000)     (4,102,000)
    Translation adjustment.................       142,000         142,000
                                              -----------
                                              $(3,960,000)             --
                                              ===========
  Issuance of Common Stock:
    Initial public offering................            --      61,531,000
    Conversion of Redeemable, Convertible
      Preferred Stock in connection with
      the initial public offering..........            --       8,878,000
    Acquisitions...........................            --       3,901,000
    Exercise of stock options..............            --         292,000
    Issuance to consultant.................            --          11,000
  Deferred compensation related to stock
    options................................            --              --
  Amortization of deferred compensation in
    connection with stock options..........                       720,000
                                                              -----------
Balance at December 31, 1998...............                   $66,315,000
                                                              ===========
</TABLE>
 
See accompanying notes.
 
                                       F-5
<PAGE>   72
 
                                ISS GROUP, INC.
 
                     CONSOLIDATED STATEMENTS OF CASH FLOWS
 
<TABLE>
<CAPTION>
                                                              YEAR ENDED DECEMBER 31,
                                                      ---------------------------------------
                                                         1996          1997          1998
                                                      -----------   -----------   -----------
<S>                                                   <C>           <C>           <C>
OPERATING ACTIVITIES
Net loss............................................  $(1,131,000)  $(3,919,000)  $(4,102,000)
Adjustments to reconcile net loss to net cash used
  in operating activities:
     Depreciation...................................       66,000       334,000     1,253,000
     Amortization of goodwill and intangibles.......           --            --       231,000
     Charge for in-process research and
       development..................................           --            --       802,000
     Amortization of deferred compensation..........           --            --       720,000
     Other non-cash expense.........................           --        31,000       118,000
     Changes in assets and liabilities, excluding
       the effects of acquisitions:
          Accounts receivable.......................   (1,802,000)   (2,089,000)   (8,107,000)
          Prepaid expenses and other assets.........     (146,000)     (179,000)     (501,000)
          Accounts payable and accrued expenses.....      955,000     2,728,000       776,000
          Deferred revenues.........................      607,000     1,462,000     4,461,000
                                                      -----------   -----------   -----------
          Net cash used in operating activities.....   (1,451,000)   (1,632,000)   (4,349,000)
                                                      -----------   -----------   -----------
INVESTING ACTIVITIES
Acquisitions, net of cash acquired..................           --            --    (5,206,000)
Purchases of property and equipment.................     (320,000)   (1,630,000)   (3,567,000)
                                                      -----------   -----------   -----------
Net cash used in investing activities...............     (320,000)   (1,630,000)   (8,773,000)
                                                      -----------   -----------   -----------
FINANCING ACTIVITIES
Proceeds from (payments on) long-term debt..........      210,000       (70,000)     (140,000)
Net proceeds from Redeemable, Convertible Preferred
  Stock issuances...................................    3,607,000     5,253,000            --
Payments on notes payable to shareholder............      (30,000)           --            --
Net proceeds from initial public offering...........           --            --    61,531,000
Other Common Stock activities.......................      (15,000)        1,000       292,000
                                                      -----------   -----------   -----------
Net cash provided by financing activities...........    3,772,000     5,184,000    61,683,000
                                                      -----------   -----------   -----------
Foreign currency impact on cash.....................           --            --       142,000
Net increase in cash and cash equivalents...........    2,001,000     1,922,000    48,703,000
Cash and cash equivalents at beginning of year......        6,000     2,007,000     3,929,000
                                                      -----------   -----------   -----------
Cash and cash equivalents at end of year............  $ 2,007,000   $ 3,929,000   $52,632,000
                                                      ===========   ===========   ===========
SUPPLEMENTAL CASH FLOW DISCLOSURE
Interest paid.......................................  $     1,000   $    17,000   $    16,000
                                                      ===========   ===========   ===========
</TABLE>
 
See accompanying notes.
 
                                       F-6
<PAGE>   73
 
                                ISS GROUP, INC.
 
                   NOTES TO CONSOLIDATED FINANCIAL STATEMENTS
                               DECEMBER 31, 1998
 
1. SIGNIFICANT ACCOUNTING POLICIES
 
CONSOLIDATION AND DESCRIPTION OF BUSINESS
 
     The consolidated financial statements include the accounts of ISS Group,
Inc. and its subsidiaries ("ISS"). All significant intercompany investment
accounts and transactions have been eliminated in consolidation.
 
     On March 27, 1998, ISS completed an initial public offering ("IPO") of its
Common Stock. A total of 3,450,000 shares were sold at $22 per share, including
450,000 shares sold pursuant to the underwriters over-allotment option and
380,000 sold by certain selling stockholders. ISS did not receive any of the
proceeds from the sale of shares by the selling stockholders. The net proceeds
to ISS were approximately $61,531,000 and certain of such proceeds have been
used for general corporate purposes. ISS's shares are traded on the Nasdaq
National Market under the ticker symbol "ISSX".
 
     ISS Group, Inc. was incorporated in the State of Delaware on December 8,
1997 to be a holding company for Internet Security Systems, Inc., a Georgia
company incorporated on April 19, 1994, to design, market, and sell computer
network security assessment software. In addition, ISS has various other
subsidiaries in Europe and the Asia/Pacific region with primary marketing and
sales responsibilities for ISS's products and services in their respective
markets.
 
     The financial statements of foreign subsidiaries have been translated into
United States dollars in accordance with Financial Accounting Standards Board
("FASB") Statement of Financial Accounting Standards ("SFAS") No. 52 Foreign
Currency Translation. Revenues from international customers, except in Japan,
were denominated in U.S. dollars. Revenues from Japanese customers and
international expenditures were denominated in the respective local currencies
and translated using the average exchange rates for the year. The effect on the
statements of operations related to transaction gains and losses is
insignificant for all years presented. All balance sheet accounts have been
translated using the exchange rates in effect at the balance sheet date.
 
     ISS's business is focused on maintaining the latest security threat and
vulnerability checks within existing products and creating new products and
services that are consistent with ISS's goal of providing an adaptive solution
approach to enterprise network security. This approach entails continuous
security risk monitoring and response to develop an active and informed network
security policy.
 
REVENUE RECOGNITION
 
     ISS recognizes its perpetual license revenues upon (i) delivery of software
or, if the customer has evaluation software, delivery of the software key, and
(ii) issuance of the related license, assuming no significant vendor obligations
or customer acceptance rights exist. For perpetual license agreements when
payment terms extend over periods greater than twelve months, revenue is
recognized as such amounts are billable. In October 1997, the AICPA issued
Statement of Position ("SOP") No. 97-2, Software Revenue Recognition, which ISS
adopted, effective January 1, 1997. Such adoption had no effect on ISS's methods
of recognizing revenue from license and maintenance activities. Prior to 1997,
ISS's revenue recognition policy was in accordance with the preceding
authoritative guidance provided by SOP No. 91-1, Software Revenue Recognition.
 
                                       F-7
<PAGE>   74
                                ISS GROUP, INC.
 
           NOTES TO CONSOLIDATED FINANCIAL STATEMENTS -- (CONTINUED)
 
1. SIGNIFICANT ACCOUNTING POLICIES (CONTINUED)
     Subscriptions revenues include maintenance and term licenses. Annual
renewable maintenance is a separate component of perpetual license agreements
with revenue recognized ratably over the maintenance contract term. Term
licenses allow customer use of the product and maintenance for a specified
period, generally 12 months, for which revenues are also recognized ratably over
the contract term. Professional services revenues are recognized as such
services are performed.
 
COST OF REVENUES
 
     Cost of revenues include amounts related to ISS's technical support group
who provide assistance to customers with maintenance agreements and the costs
related to ISS's professional services.
 
CASH AND CASH EQUIVALENTS
 
     Cash equivalents include all highly liquid investments with a maturity of
three months or less when purchased. Such amounts are stated at cost, which
approximates market value.
 
CONCENTRATIONS OF CREDIT RISK
 
     Financial instruments that potentially subject ISS to significant
concentrations of credit risk consist principally of cash and cash equivalents
and accounts receivable. ISS maintains cash and cash equivalents in short-term
money market accounts with two financial institutions and short-term, investment
grade commercial paper. ISS's sales are primarily to companies located in the
United States, Europe and the Asia/Pacific region. ISS performs periodic credit
evaluations of its customers' financial condition and does not require
collateral. Accounts receivable are due principally from large U.S. companies
under stated contract terms. ISS provides for estimated credit losses, which
have not been significant to date, as required.
 
PROPERTY AND EQUIPMENT
 
     Property and equipment are stated at cost less accumulated depreciation.
Depreciation is computed using the straight-line method for financial reporting
purposes over the estimated useful lives of the assets (primarily three years).
 
                                       F-8
<PAGE>   75
                                ISS GROUP, INC.
 
           NOTES TO CONSOLIDATED FINANCIAL STATEMENTS -- (CONTINUED)
 
1. SIGNIFICANT ACCOUNTING POLICIES (CONTINUED)
GOODWILL AND INTANGIBLES
 
     The major classes of intangible assets, including goodwill (excess of cost
over acquired net assets), at December 31, 1998 are as follows:
 
<TABLE>
<CAPTION>
                                                              LIFE
                                                              ----
<S>                                                           <C>    <C>
Goodwill....................................................   10    $3,171,000
less accumulated amortization...............................            (77,000)
                                                                     ----------
                                                                     $3,094,000
                                                                     ==========
Core technology.............................................    8    $3,853,000
Developed technology........................................    5       778,000
Work force..................................................    6       215,000
                                                                     ----------
                                                                      4,846,000
less accumulated amortization...............................           (154,000)
                                                                     ----------
                                                                     $4,692,000
                                                                     ==========
</TABLE>
 
     Goodwill and other intangible assets are amortized using the straight-line
method for the period indicated. They are reviewed for impairment whenever
events indicate that their carrying amounts may not be recoverable. In such
reviews, undiscounted cash flows associated with these assets are compared with
their carrying values to determine if a write-down to fair value is required.
 
RESEARCH AND DEVELOPMENT COSTS
 
     Research and development costs are charged to expense as incurred. ISS has
not capitalized any such development costs under SFAS No. 86, Accounting for the
Costs of Computer Software to Be Sold, Leased, or Otherwise Marketed, because
the cost incurred between the attainment of technological feasibility for the
various software products through the date when such products are made available
for general release to customers has been insignificant.
 
INCOME TAXES
 
     ISS uses the liability method of accounting for income taxes. Under this
method, deferred income tax assets and liabilities are determined based on
differences between the financial reporting and tax bases of assets and
liabilities and are measured using the enacted tax rates and laws that will be
in effect when the differences are expected to reverse.
 
ADVERTISING COSTS
 
     ISS incurred $485,000, $572,000 and $486,000 of advertising costs for the
years ended December 31, 1996, 1997 and 1998, respectively, which are expensed
as incurred and are included in sales and marketing expense in the statements of
operations.
 
USE OF ESTIMATES
 
     The preparation of financial statements in conformity with generally
accepted accounting principles requires management to make estimates and
assumptions that affect the amounts
 
                                       F-9
<PAGE>   76
                                ISS GROUP, INC.
 
           NOTES TO CONSOLIDATED FINANCIAL STATEMENTS -- (CONTINUED)
 
1. SIGNIFICANT ACCOUNTING POLICIES (CONTINUED)
reported in the financial statements and accompanying notes. Actual results may
differ from those estimates, and such differences may be material to the
consolidated financial statements.
 
STOCK-BASED COMPENSATION
 
     ISS generally grants stock options for a fixed number of shares to certain
employees with an exercise price equal to the fair value of the shares at the
date of grant. ISS accounts for stock option grants in accordance with
Accounting Principles Board ("APB") Opinion No. 25, Accounting for Stock Issued
to Employees, and, accordingly, recognizes compensation expense only if the fair
value of the underlying Common Stock exceeds the exercise price of the stock
option on the date of grant. In October 1995, the FASB issued SFAS No. 123,
Accounting for Stock-Based Compensation, which provides an alternative to APB
Opinion No. 25 in accounting for stock-based compensation issued to employees.
As permitted by SFAS No. 123, ISS continues to account for stock-based
compensation in accordance with APB Opinion No. 25 and has elected the pro forma
disclosure alternative of SFAS No. 123 (see Note 5).
 
LOSS PER SHARE
 
     Basic and diluted historical net loss per share (see Note 9) was computed
by dividing net loss plus accretion of the Series A and Series B Redeemable,
Convertible Preferred Stock by the weighted average number of shares of Common
Stock. Common Stock equivalents were antidilutive and therefore were not
included in the computation of weighted average shares used in computing diluted
loss per share. Also, ISS has no Common Stock equivalents due to "cheap stock"
as defined in Securities and Exchange Commission ("SEC") Staff Accounting
Bulletin No. 98.
 
     Unaudited pro forma net loss per share was computed by dividing net loss by
the unaudited weighted average number of shares of Common Stock outstanding plus
the assumed conversion of the Redeemable, Convertible Preferred Stock into
5,737,000 shares of Common Stock as of the later of (i) January 1, 1997 or (ii)
the date of issuance of such preferred stock, instead of March 27, 1998 when
such shares of preferred stock automatically converted into Common Stock.
 
RECENTLY ISSUED ACCOUNTING STANDARDS
 
     In June 1997, the FASB issued SFAS No. 131, Disclosures about Segments of
an Enterprise and Related Information. SFAS No. 131 establishes standards for
the way that public business enterprises report information about operating
segments in annual financial statements for periods beginning after December 15,
1997. The Statement requires that business segment financial information be
reported in the financial statements utilizing the management approach. The
management approach is defined as the manner in which management organizes the
segments within the enterprise for making operating decisions and assessing
performance. Since ISS is organized as, and operates in, a single business
segment that provides products, technical support and consulting and training
services as components of its enterprise solution for network security, this
Statement did not have an impact on financial reporting for the year ended
December 31, 1998.
 
     ISS adopted SFAS No. 130, Reporting Comprehensive Income, on January 1,
1998. ISS reported comprehensive income in its statement of changes in
stockholders' equity (deficit). The
 
                                      F-10
<PAGE>   77
                                ISS GROUP, INC.
 
           NOTES TO CONSOLIDATED FINANCIAL STATEMENTS -- (CONTINUED)
 
1. SIGNIFICANT ACCOUNTING POLICIES (CONTINUED)
adoption of SFAS No. 130 resulted in revised and additional disclosures but had
no effect on the financial position, results of operations, or liquidity of ISS.
 
RECLASSIFICATIONS
 
     Certain reclassifications were made to the prior years' financial
statements to conform with the 1998 presentation.
 
2. FAIR VALUE OF FINANCIAL INSTRUMENTS
 
     The carrying amounts reported in the balance sheets for cash and cash
equivalents, accounts receivable and accounts payable approximate their fair
values. The carrying amounts reported in the balance sheet at December 31, 1997
for long-term debt approximated its fair values as the interest rate related to
such debt was variable and commensurate with the credit worthiness of ISS.
 
3. BUSINESS COMBINATION AND ASSET ACQUISITION
 
     In October 1998, ISS acquired March Information Systems Limited ("March"),
a United Kingdom-based developer of Windows NT and Unix-based security
assessment technologies. Also in October 1998, ISS acquired the technology
assets of DbSecure, Inc., a developer of database security risk assessment
software. ISS issued 158,000 shares of ISS Common Stock and paid $5,206,000 in
cash, net of cash acquired, and direct transaction costs for these acquisitions.
 
     Both of these acquisitions have been accounted for as purchases and their
results have been included in the results of ISS's operations from the effective
dates of acquisition. Substantially all of the aggregate consideration of
$9,144,000 was allocated to identified intangibles, including core and developed
technologies, in-process research and development, work force and goodwill (see
Note 1).
 
     The valuations of core and developed technologies and in-process research
and development were based on the present value of estimated future cash flows
over the lesser of: (i) five years or (ii) the period in which the product is
expected to be integrated into an existing ISS product. The resulting values
were reviewed for reasonableness based on the time and cost spent on the effort,
the complexity of the development effort and, in the case of in-process
development projects, the stage to which it had progressed. For in-process
research and development, the valuation was reduced for the core technology
component of such product and the percentage of product development remaining at
the acquisition date. The resulting in-process research and development amount
of $802,000 is reflected as a charge in the 1998 statement of operations.
 
                                      F-11
<PAGE>   78
                                ISS GROUP, INC.
 
           NOTES TO CONSOLIDATED FINANCIAL STATEMENTS -- (CONTINUED)
 
3. BUSINESS COMBINATION AND ASSET ACQUISITION (CONTINUED)
     The following table summarizes pro forma unaudited results of operations as
if the acquisition of March was concluded on January 1, 1997. The effect of the
DbSecure acquisition is not included as its impact was immaterial. The
adjustments to the historical data reflect the reduction of interest income in
connection with the cash portion of the purchase price and amortization of
goodwill and intangibles. This unaudited pro forma financial information is not
necessarily indicative of what the combined operations would have been if ISS
had control of such combined businesses for the periods presented.
 
<TABLE>
<CAPTION>
                                                                 1997          1998
                                                              -----------   -----------
<S>                                                           <C>           <C>
Revenues....................................................  $15,513,000   $37,735,000
Operating loss..............................................   (4,901,000)   (6,838,000)
Net loss....................................................   (4,946,000)   (4,828,000)
Per share:
  Basic and diluted net loss................................  $     (0.62)  $     (0.32)
  Pro forma net loss........................................  $     (0.36)  $     (0.30)
</TABLE>
 
4. REDEEMABLE, CONVERTIBLE PREFERRED STOCK
 
     Redeemable, Convertible Preferred Stock consisted of the following:
 
<TABLE>
<CAPTION>
                                                        GROSS              NET
SERIES                       DATE OF ISSUANCE          PROCEEDS          PROCEEDS         SHARES ISSUED
- ------                       -----------------        ----------        ----------        --------------
<S>                          <C>                      <C>               <C>               <C>
  A                          February 2, 1996         $3,650,000        $3,607,000          3,650,000
  B                          February 14, 1997         5,280,000         5,253,000          2,087,000
                                                      ----------        ----------          ---------
                                                      $8,930,000        $8,860,000          5,737,000
                                                      ==========        ==========          =========
</TABLE>
 
     Accretion related to the Series A and Series B Redeemable, Convertible
Preferred Stock was recorded over the respective redemption period by charges
against additional paid-in capital with corresponding increases to the carrying
value of the Series A and Series B Redeemable, Convertible Preferred Stock. Such
increases aggregated $7,000 and $11,000 for the years ended December 31, 1996
and 1997, respectively, and were immaterial in 1998.
 
     All of the outstanding shares of Redeemable, Convertible Preferred Stock
were automatically converted into an aggregate of 5,737,000 shares of Common
Stock on March 27, 1998 in connection with the IPO.
 
5. STOCK OPTION PLANS
 
     ISS's Incentive Stock Plan (the "Plan") provides for the granting of
qualified or nonqualified options to purchase shares of ISS's Common Stock.
Under the Plan, there are 3,000,000 shares reserved for future issuances, which
increases automatically on the first trading day of each year, beginning with
1999, by an amount equal to 3% of the number of shares of Common Stock
outstanding on the last trading day of the immediately preceding year.
 
     Certain options granted under the Plan prior to the IPO are immediately
exercisable, subject to a right of repurchase by ISS at the original exercise
price for all unvested shares. Options granted subsequent to the IPO are
generally exercisable as vesting occurs. Vesting is generally in equal annual
installments over four years, measured from the date of the grant.
 
                                      F-12
<PAGE>   79
                                ISS GROUP, INC.
 
           NOTES TO CONSOLIDATED FINANCIAL STATEMENTS -- (CONTINUED)
 
5. STOCK OPTION PLANS (CONTINUED)
     During the quarters ended December 31, 1997 and March 31, 1998, deferred
compensation of $571,000 and $811,000, respectively, was recorded for options
granted with an exercise price less than the fair value of the Common Stock on
the date of grant. The deferred compensation was determined by comparing the
exercise price of stock options issued in December 1997 to the estimated price
range for the IPO as set forth in the initial filing on January 20, 1998 of
ISS's Registration Statement on Form S-1. The fair value of ISS's Common Stock
in January and February 1998 was based on the final estimated price range
contained in ISS's pre-effective amendment to its Registration Statement filed
in March 1998. The amounts are being charged to operations proportionately over
the four-year vesting period of the related stock options. Amortization of
deferred compensation for the year ended December 31, 1998 was $720,000. All
other options were issued at fair market value on the date of grant.
 
     On December 8, 1997, the Board of Directors granted to each of the four
non-employee directors a nonstatutory option to purchase up to 20,000 shares of
Common Stock outside the Plan, on the same terms as if those options had been
granted under the 1995 Plan. ISS reserved 80,000 shares of Common Stock for
issuance under these options.
 
     A summary of ISS's stock option activity is as follows:
 
<TABLE>
<CAPTION>
                                                           1997                    1998
                                                   ---------------------   ---------------------
                                                                WEIGHTED                WEIGHTED
                                                                AVERAGE                 AVERAGE
                                                     NUMBER     EXERCISE     NUMBER     EXERCISE
                                                   OF SHARES     PRICE     OF SHARES     PRICE
                                                   ----------   --------   ----------   --------
<S>                                                <C>          <C>        <C>          <C>
Outstanding at beginning of year.................     810,000    $0.16      1,888,000    $ 2.71
  Granted........................................   1,103,000     4.54        961,000     22.78
  Exercised......................................      (7,000)    0.15       (405,000)     0.72
  Canceled.......................................     (18,000)    0.50        (64,000)     9.32
                                                   ----------              ----------
Outstanding at end of year.......................   1,888,000     2.71      2,380,000     10.98
                                                   ==========              ==========
Exercisable at end of year.......................   1,888,000     2.71      1,585,000      3.85
                                                   ==========              ==========
Weighted average fair value of options granted
  during the year................................  $     2.34              $    12.77
                                                   ==========              ==========
</TABLE>
 
     The following table summarizes information about stock options outstanding
at December 31, 1998:
 
<TABLE>
<CAPTION>
                                                 OPTIONS OUTSTANDING              OPTIONS FULLY
                                             ----------------------------     VESTED AND EXERCISABLE
                                               NUMBER OF       WEIGHTED     --------------------------
                                                OPTIONS         AVERAGE         NUMBER        WEIGHTED
                                             OUTSTANDING AT    REMAINING      EXERCISABLE     AVERAGE
RANGE OF                                      DECEMBER 31,    CONTRACTUAL   AT DECEMBER 31,   EXERCISE
EXERCISE PRICES                                   1998           LIFE            1998          PRICE
- ---------------                              --------------   -----------   ---------------   --------
<S>                                          <C>              <C>           <C>               <C>
$0.15-0.60.................................     695,000        7.7 years        289,000        $0.26
$1.00-7.00.................................     741,000        8.9 years        185,000         5.99
$8.00-20.00................................     612,000        9.2 years             --           --
$21.00-30.00...............................     181,000        9.8 years             --           --
$31.00-50.00...............................     150,000        9.7 years             --           --
</TABLE>
 
     ISS has reserved 2,379,000 shares of ISS common stock for the future
exercise of stock options at December 31, 1998.
 
                                      F-13
<PAGE>   80
                                ISS GROUP, INC.
 
           NOTES TO CONSOLIDATED FINANCIAL STATEMENTS -- (CONTINUED)
 
5. STOCK OPTION PLANS (CONTINUED)
     Pro forma information regarding net income and net income per share is
required by SFAS No. 123, which also requires that the information be determined
as if ISS had accounted for its employee stock options granted subsequent to
December 31, 1994 under the fair value method prescribed by that Statement. The
fair value for options granted was estimated at the date of grant using the
Black-Scholes option pricing model. The following weighted average assumptions
were used for 1997 and 1998, respectively: risk-free interest rates of 6.28% and
5.27%; no dividend yield; a .60 volatility factor; and an expected life of the
options of 4 and 5 years, respectively.
 
     The Black-Scholes option valuation model was developed for use in
estimating the fair value of traded options which have no vesting restrictions
and are fully transferable. In addition, option valuation models require the
input of highly subjective assumptions including the expected stock price
volatility. Because employee stock options have characteristics different from
those of traded options, and because the changes in the subjective input
assumptions can materially affect the fair value estimate, in management's
opinion, the existing models do not necessarily provide a reliable single
measure of the fair value of its employee stock options.
 
     For purposes of pro forma disclosures, the estimated fair value of the
option is amortized to expense over the options' vesting period. The following
pro forma information adjusts net loss for the years ended December 31, 1997 and
1998 for the impact of SFAS No. 123:
 
<TABLE>
<CAPTION>
                                                                  YEAR ENDED
                                                                 DECEMBER 31,
                                                           -------------------------
                                                              1997          1998
                                                           -----------   -----------
<S>                                                        <C>           <C>
Pro forma net loss.......................................  $(3,975,000)  $(6,126,000)
                                                           ===========   ===========
Pro forma net loss per share.............................  $     (0.29)  $     (0.38)
                                                           ===========   ===========
</TABLE>
 
6. COMMITMENTS AND CONTINGENT LIABILITIES
 
     ISS has noncancellable operating leases for facilities that expire at
various dates through July 2002. Future minimum payments under noncancellable
operating leases with initial terms of one year or more consisted of the
following at December 31, 1998:
 
<TABLE>
<CAPTION>
                                                              OPERATING
                                                                LEASES
                                                              ----------
<S>                                                           <C>
1999........................................................  $1,855,000
2000........................................................   1,693,000
2001........................................................   1,513,000
2002........................................................     683,000
                                                              ----------
          Total minimum lease payments......................  $5,744,000
                                                              ==========
</TABLE>
 
     Rent expense was approximately $105,000, $401,000 and $1,200,000 for the
years ended December 31, 1996, 1997, and 1998, respectively.
 
     In July 1998, Network Associates, Inc. ("Network Associates"), a competitor
of ISS, filed a patent infringement suit against ISS in the Federal District
Court for the Northern District of California. The suit alleges that ISS's
product, RealSecure, violates certain patent claims issued for Network
Associates' intrusion detection technology. ISS believes the lawsuit is without
merit
 
                                      F-14
<PAGE>   81
                                ISS GROUP, INC.
 
           NOTES TO CONSOLIDATED FINANCIAL STATEMENTS -- (CONTINUED)
 
6. COMMITMENTS AND CONTINGENT LIABILITIES (CONTINUED)
and intends to defend against it vigorously. However, there can be no assurance
that the lawsuit will not have or result in a material adverse effect on ISS's
business, operating results or financial condition.
 
7. INCOME TAXES
 
     A reconciliation of the provision for income taxes to the statutory federal
income tax rate is as follows:
 
<TABLE>
<CAPTION>
                                                               YEAR ENDED DECEMBER 31,
                                                        -------------------------------------
                                                          1996         1997          1998
                                                        ---------   -----------   -----------
<S>                                                     <C>         <C>           <C>
Statutory rate at 34%, applied to pretax loss.........  $(384,000)  $(1,332,000)  $(1,440,000)
State income taxes, net of federal income tax
  benefit.............................................    (45,000)     (157,000)     (160,000)
Intangibles...........................................         --            --       345,000
Research and development tax credit...................    (28,000)     (159,000)     (384,000)
Foreign operations....................................    100,000            --        62,000
Other.................................................     46,000       (26,000)       42,000
Change in valuation allowance.........................    311,000     1,674,000     1,597,000
                                                        ---------   -----------   -----------
                                                        $      --   $        --   $    62,000
                                                        =========   ===========   ===========
</TABLE>
 
     The provision for income taxes for the year ended December 31, 1998
consisted of $62,000 of current income taxes related to some of ISS's foreign
operations.
 
     Deferred income taxes reflect the net income tax effects of temporary
differences between the carrying amounts of assets and liabilities for financial
reporting purposes and the amounts used for income tax purposes. Significant
components of ISS's net deferred income tax assets are as follows:
 
<TABLE>
<CAPTION>
                                                                     DECEMBER 31,
                                                              --------------------------
                                                                 1997           1998
                                                              -----------   ------------
<S>                                                           <C>           <C>
Deferred income tax liabilities:
Core technology.............................................  $        --   $   (494,000)
                                                              -----------   ------------
Total deferred income tax liabilities.......................           --       (494,000)
                                                              -----------   ------------
Deferred income tax assets:
  Depreciation..............................................       69,000         72,000
  Accrued liabilities.......................................      143,000        410,000
  Allowance for doubtful accounts...........................       97,000        109,000
  Deferred compensation.....................................           --        274,000
  Net operating loss carryforwards..........................    1,573,000      5,178,000
  Research and development tax credit carryforwards.........      187,000        571,000
                                                              -----------   ------------
          Total deferred income tax assets..................    2,069,000      6,120,000
Less deferred income tax asset valuation allowance..........   (2,069,000)    (6,120,000)
                                                              -----------   ------------
Net deferred income tax assets..............................  $        --   $         --
                                                              ===========   ============
</TABLE>
 
     For financial reporting purposes, a valuation allowance has been recognized
to reduce the net deferred income tax assets to zero. ISS has not recognized the
benefit from the future use of such loss carryforwards because management's
evaluation of all the available evidence in
 
                                      F-15
<PAGE>   82
                                ISS GROUP, INC.
 
           NOTES TO CONSOLIDATED FINANCIAL STATEMENTS -- (CONTINUED)
 
7. INCOME TAXES (CONTINUED)
assessing the realizability of the tax benefits of such loss carryforwards and
other deferred income tax benefits indicates that the underlying assumptions of
future profitable operations contain risks that do not provide sufficient
assurance to recognize such tax benefits currently.
 
     ISS has approximately $13,600,000 of net operating loss carryforwards for
federal income tax purposes that expire in varying amounts between 2011 and
2018. These carryforwards include approximately $7,700,000 related to exercises
of stock options in 1998 for which the income tax benefit, if realized, would
increase additional paid-in capital. ISS also has approximately $800,000 of net
operating loss carryforwards related to its foreign operations which expire
between 2002 and 2003. Additionally, ISS has approximately $571,000 of research
and development tax credit carryforwards which expire between 2011 and 2014.
 
8. EMPLOYEE BENEFIT PLANS
 
     ISS sponsors a 401(k) plan that covers substantially all employees over 21
years of age. ISS may make contributions to the plan at its discretion, but has
made no contributions to the plan through December 31, 1998.
 
9. LOSS PER SHARE
 
     The following table sets forth the computation of basic, diluted and pro
forma (unaudited) net loss per share:
 
<TABLE>
<CAPTION>
                                                              YEAR ENDED DECEMBER 31,
                                                      ---------------------------------------
                                                         1996          1997          1998
                                                      -----------   -----------   -----------
<S>                                                   <C>           <C>           <C>
Numerator:
  Net loss..........................................  $(1,131,000)  $(3,919,000)  $(4,102,000)
  Accretion of Series A and Series B Redeemable,
     Convertible Preferred Stock....................       (7,000)      (11,000)           --
                                                      -----------   -----------   -----------
                                                      $(1,138,000)  $(3,930,000)  $(4,102,000)
                                                      ===========   ===========   ===========
Denominator:
  Denominator for basic and diluted net loss per
     share -- weighted average shares...............    7,916,000     7,907,000    14,883,000
  Redeemable, Convertible Preferred Stock...........           --     5,737,000     1,306,000
                                                      -----------   -----------   -----------
  Weighted average shares for pro forma net loss per
     share..........................................    7,916,000    13,644,000    16,189,000
                                                      ===========   ===========   ===========
Basic net loss per share............................  $     (0.14)  $     (0.50)  $     (0.28)
                                                      ===========   ===========   ===========
Diluted net loss per share..........................  $     (0.14)  $     (0.50)  $     (0.28)
                                                      ===========   ===========   ===========
Pro forma net loss per share (unaudited)............                $     (0.29)  $     (0.25)
                                                                    ===========   ===========
</TABLE>
 
     Stock options aggregating 1,888,000 and 2,379,000 at December 31, 1997 and
1998, respectively, are not included in the above calculations as they are
antidilutive.
 
10. EXPORT SALES
 
     Export sales from the United States to the Europe and Asia/Pacific region
represented approximately 10% and 3%, respectively, of total revenues for the
year ended December 31, 1997
 
                                      F-16
<PAGE>   83
                                ISS GROUP, INC.
 
           NOTES TO CONSOLIDATED FINANCIAL STATEMENTS -- (CONTINUED)
 
10. EXPORT SALES (CONTINUED)
and 12% and 0%, respectively, of total revenues for the year ended December 31,
1998. Export sales were not significant for the year ended December 31, 1996.
Revenues generated from ISS's foreign operations located in the Europe and
Asia/Pacific region totaled approximately 0% and 8%, respectively, and 2% and
5%, respectively, of total revenues for the years ended December 31, 1997 and
1998, respectively. ISS had no revenue generating foreign operations prior to
1997.
 
11. QUARTERLY FINANCIAL RESULTS (UNAUDITED)
 
     Summarized quarterly results for the two years ended December 31, 1997 and
1998 are as follows (in thousands, except per share data):
 
<TABLE>
<CAPTION>
                                                    FIRST     SECOND      THIRD     FOURTH
                                                   -------    -------    -------    -------
<S>                                                <C>        <C>        <C>        <C>
1997 by quarter:
  Revenues.....................................    $ 2,225    $ 2,671    $ 3,473    $ 5,098
  Operating loss...............................       (429)      (678)    (1,092)    (1,948)
  Net loss.....................................       (394)      (610)    (1,026)    (1,889)
 
Loss per share(1):
  Basic and diluted............................      (0.05)     (0.08)     (0.13)     (0.24)
  Pro forma (unaudited)........................      (0.03)     (0.05)     (0.08)     (0.14)
 
1998 by quarter:
  Revenues.....................................      6,073      7,331      9,430     13,095
  Operating loss...............................     (1,705)    (1,924)    (1,348)    (1,429)
  Net loss.....................................     (1,639)    (1,083)      (583)      (797)
 
Loss per share(1):
  Basic and diluted............................      (0.19)     (0.06)     (0.03)     (0.05)
  Pro forma (unaudited)........................      (0.12)        --         --         --
</TABLE>
 
- ---------------
 
(1) Because of the method used in calculating per share data, the quarterly per
    share data will not add to the per share data as computed for the year.
 
                                      F-17
<PAGE>   84
 
                 REPORT OF ERNST & YOUNG, INDEPENDENT AUDITORS
 
To the Board of Directors and Shareholders
March Information Systems Limited
 
     We have audited the accompanying consolidated balance sheets of March
Information Systems Limited as of March 31, 1997 and 1998 and the related
consolidated statements of operations, stockholders' equity and cash flows for
each of the two years in the period ended March 31, 1998, which have been
prepared in accordance with accounting principles generally accepted in the
United States and are expressed in U.S. Dollars. These financial statements are
the responsibility of the Company's management. Our responsibility is to express
an opinion on these financial statements based on our audits.
 
     We conducted our audits in accordance with UK auditing standards, which do
not differ materially from auditing standards generally accepted in the United
States. Those standards require that we plan and perform the audit to obtain
reasonable assurance about whether the financial statements are free of material
misstatement. An audit includes examining, on a test basis, evidence supporting
the amounts and disclosures in the financial statements. An audit also includes
assessing the accounting principles used and significant estimates made by
management, as well as evaluating the overall financial statement presentation.
We believe that our audits provide a reasonable basis for our opinion.
 
     In our opinion, the consolidated financial statements referred to above
present fairly, in all material respects, the financial position of March
Information Systems Limited at March 31, 1997 and 1998 and the results of its
operations and its cash flows for the each of the two years in the period ended
March 31, 1998, in conformity with accounting principles generally accepted in
the United States.
                                          /s/ Ernst & Young
 
Reading, England
October 16, 1998
 
                                      F-18
<PAGE>   85
 
                       MARCH INFORMATION SYSTEMS LIMITED
 
                          CONSOLIDATED BALANCE SHEETS
 
<TABLE>
<CAPTION>
                                                              MARCH 31,
                                                         -------------------   SEPTEMBER 30,
                                                           1997       1998         1998
                                                         --------   --------   -------------
                                                                                (UNAUDITED)
<S>                                                      <C>        <C>        <C>
                                           ASSETS
Current Assets
Cash and cash equivalents..............................  $  4,494   $ 16,900     $ 38,683
Accounts receivable....................................   533,080    538,851      441,074
Other receivables......................................    32,433     25,724       81,089
Prepaid expenses.......................................    26,545     20,800       49,765
Other current assets...................................    15,434     15,742       26,105
                                                         --------   --------     --------
          Total current assets.........................   611,986    618,017      636,716
Investments (Note 2)...................................       821        837           --
Equipment and fixtures:
     Computer equipment................................   176,594    220,985      243,701
     Office furniture and equipment....................    36,244     38,469       39,039
     Motor vehicles....................................   312,857    230,541      243,216
                                                         --------   --------     --------
                                                          525,695    489,995      525,956
     Less accumulated depreciation.....................   327,295    356,635      391,792
                                                         --------   --------     --------
                                                          198,400    133,360      134,164
Deferred income taxes (Note 4).........................    12,256     12,704       12,704
                                                         --------   --------     --------
          Total Assets.................................  $823,463   $764,918     $783,584
                                                         ========   ========     ========
 
                            LIABILITIES AND SHAREHOLDERS' EQUITY
Current Liabilities
Accounts payable.......................................  $  1,478   $ 42,763     $ 44,084
Accrued expenses and other liabilities.................    68,457     51,747       91,516
Deferred revenue.......................................    92,227     84,301      111,370
Taxes and social security payable......................   180,387     98,011      103,193
Notes payable to Directors.............................    52,544     90,428           --
Current portion of capital lease obligations...........    63,378     25,713       20,802
                                                         --------   --------     --------
          Total current liabilities....................   458,471    392,963      370,965
Capital lease obligation (Note 3)......................    31,191      6,097       12,710
Minority interest......................................       161         --           --
Commitments (Note 7)
Shareholders' Equity
Ordinary shares: $1 par value, 50,000 shares
  authorized; 9,600 issued and outstanding at March 31,
  1997, 9,700 shares at March 31,1998 and 9,800 shares
  at September 30, 1998................................    14,654     14,821       14,988
Retained earnings......................................   292,128    317,305      345,180
Cumulative translation adjustment......................    26,858     33,732       39,741
                                                         --------   --------     --------
          Total shareholders' equity...................   333,640    365,858      399,909
                                                         --------   --------     --------
          Total Liabilities and Shareholders' Equity...  $823,463   $764,918     $783,584
                                                         ========   ========     ========
</TABLE>
 
                                      F-19
<PAGE>   86
 
                       MARCH INFORMATION SYSTEMS LIMITED
 
                     CONSOLIDATED STATEMENTS OF OPERATIONS
 
<TABLE>
<CAPTION>
                                                   YEAR ENDED             SIX MONTHS ENDED
                                                    MARCH 31,               SEPTEMBER 30,
                                             -----------------------    ---------------------
                                                1997         1998         1997        1998
                                             ----------   ----------    --------   ----------
                                                                             (UNAUDITED)
<S>                                          <C>          <C>           <C>        <C>
Revenues:
  Consulting...............................  $1,294,573   $1,224,339    $566,991   $  663,205
  Licenses.................................     267,568      690,764     275,582      461,247
  Maintenance and other....................      73,909      131,265      65,231       74,323
                                             ----------   ----------    --------   ----------
                                              1,636,050    2,046,368     907,804    1,198,775
Research and development...................     460,027      697,808     367,380      405,083
Marketing, general and administrative......   1,176,375    1,193,958     519,050      695,334
Depreciation and amortization..............     110,216       99,304      55,029       39,293
                                             ----------   ----------    --------   ----------
                                              1,746,618    1,991,070     941,459    1,139,710
Operating (loss) profit....................    (110,568)      55,298     (33,655)      59,065
Equity share of losses of affiliated
  company..................................       3,263           --          --           --
Interest expense...........................     (29,253)     (12,861)     (6,518)      (6,921)
Interest income............................       1,680        3,103       1,995          714
Other income...............................          --          330       8,402          727
                                             ----------   ----------    --------   ----------
Income (loss) before taxation and minority
  interests................................    (134,878)      45,870     (29,776)      53,585
Minority interest..........................         692           --          --           --
Income tax benefit (expense)...............      26,677      (20,693)         --      (25,710)
                                             ----------   ----------    --------   ----------
Net (loss) income..........................  $ (107,509)  $   25,177    $(29,776)  $   27,875
                                             ==========   ==========    ========   ==========
</TABLE>
 
See accompanying Notes to the Consolidated Financial Statements.
 
                                      F-20
<PAGE>   87
 
                       MARCH INFORMATION SYSTEMS LIMITED
 
                CONSOLIDATED STATEMENTS OF SHAREHOLDERS' EQUITY
 
<TABLE>
<CAPTION>
                                                                           CUMULATIVE
                                                      COMMON    RETAINED   TRANSLATION
                                                       STOCK    EARNINGS   ADJUSTMENT     TOTAL
                                                      -------   --------   -----------   --------
<S>                                                   <C>       <C>        <C>           <C>
Balance at March 31, 1996 (unaudited)...............  $14,654   $399,637     $20,267     $434,558
Net loss............................................       --   (107,509)         --     (107,509)
Cumulative translation adjustment...................       --         --       6,591        6,591
                                                      -------   --------     -------     --------
Balance at March 31, 1997...........................   14,654    292,128      26,858      333,640
Net income..........................................       --     25,177          --       25,177
Cumulative translation adjustment...................       --         --       6,874        6,874
Issuance of ordinary stock for bonuses to
  employees.........................................      167         --          --          167
                                                      -------   --------     -------     --------
Balance at March 31, 1998...........................   14,821    317,305      33,732      365,858
Net income (unaudited)..............................       --     27,875          --       28,042
Cumulative translation adjustment (unaudited).......       --         --       6,009        6,009
Issuance of ordinary stock for bonuses to employees
  (unaudited).......................................      167         --          --          167
                                                      -------   --------     -------     --------
Balance at September 30, 1998 (unaudited)...........  $14,988   $345,180     $39,741     $399,909
                                                      =======   ========     =======     ========
</TABLE>
 
See accompanying Notes to the Consolidated Financial Statements
 
                                      F-21
<PAGE>   88
 
                       MARCH INFORMATION SYSTEMS LIMITED
 
                     CONSOLIDATED STATEMENTS OF CASH FLOWS
 
<TABLE>
<CAPTION>
                                                YEAR ENDED             SIX MONTHS ENDED
                                                   MARCH                SEPTEMBER 30,
                                            -------------------   --------------------------
                                              1997       1998        1997           1998
                                            ---------   -------   -----------    -----------
                                                                  (UNAUDITED)    (UNAUDITED)
<S>                                         <C>         <C>       <C>            <C>
CASH FLOWS FROM OPERATING ACTIVITIES
Net (loss) income.........................  $(107,509)  $25,177    $ (29,776)     $ 27,875
Adjustments to reconcile net (loss) income
  to net cash provided by operating
  activities:
  Depreciation............................    110,216    99,304       55,029        39,293
  Minority interest.......................        692        --           --            --
  Loss on disposal of assets..............      6,107    12,354        7,926         7,953
  Changes in operating assets and
     liabilities:
     Accounts receivable..................    (59,188)    4,719      160,112       102,894
     Other receivable.....................    (23,401)    7,210        6,915       (53,496)
     Prepaid expenses.....................    (13,036)    6,149       (8,360)      (27,881)
     Other current assets.................        714        --           --        (9,856)
     Accounts payable.....................       (159)   40,450       39,022           670
     Accrued expenses and other
       liabilities........................     70,140    18,406       27,189       (51,336)
     Deferred revenue.....................     30,478    (9,567)     (19,845)       25,122
     Taxes and social security payable....     28,839   (84,279)    (147,501)        3,629
     Deferred income taxes................     (5,259)     (448)          --            --
                                            ---------   -------    ---------      --------
Net cash provided by operating
  activities..............................     38,634   119,475       90,711        64,867
CASH FLOWS FROM INVESTING ACTIVITIES
Purchases of equipment and fixtures.......    (87,164)  (44,026)      (5,003)      (18,917)
Loss from Joint Venture...................         --        --           --           827
                                            ---------   -------    ---------      --------
Net cash used in investing activities.....    (87,164)  (44,026)      (5,003)      (18,090)
CASH FLOWS FROM FINANCING ACTIVITIES
Payments on capital lease obligations.....    (35,355)  (63,374)     (36,852)      (25,993)
Minority interest.........................     (1,537)     (161)        (160)           --
Dividends paid............................    (41,050)       --           --            --
Issuance of ordinary stock for bonus......         --       167          167           167
                                            ---------   -------    ---------      --------
Net cash used in financing activities.....    (77,942)  (63,368)     (36,845)      (25,826)
                                            ---------   -------    ---------      --------
Net (decrease) increase in cash and cash
  equivalents.............................   (126,472)   12,081       48,863        20,951
Cash and cash equivalents at the beginning
  of the year.............................    124,544     4,494        4,494        16,900
Translation adjustment....................      6,422       325         (596)          832
                                            ---------   -------    ---------      --------
Cash and cash equivalents at the end of
  the year................................  $   4,494   $16,900    $  52,761      $ 38,683
                                            =========   =======    =========      ========
SUPPLEMENTAL DISCLOSURE OF CASH FLOW
  INFORMATION
Interest paid.............................  $  13,850   $12,368    $   5,866      $  8,182
                                            =========   =======    =========      ========
Income taxes paid.........................  $  56,455   $    --    $  20,047      $     --
                                            =========   =======    =========      ========
SUPPLEMENTAL SCHEDULE OF NON-CASH
  INVESTING AND FINANCING ACTIVITIES
Equipment and fixtures acquired under
  capital leases..........................  $      --   $    --    $      --      $ 27,190
                                            =========   =======    =========      ========
</TABLE>
 
See accompanying Notes to the Consolidated Financial Statements
 
                                      F-22
<PAGE>   89
 
                       MARCH INFORMATION SYSTEMS LIMITED
 
                   NOTES TO CONSOLIDATED FINANCIAL STATEMENTS
 
1. SUMMARY OF SIGNIFICANT ACCOUNTING POLICIES
 
  DESCRIPTION OF BUSINESS
 
     March Information Systems ("March" or the "Company") was incorporated in
England in 1990 with the name March Systems Consultancy Limited with the
objective of providing computer consultancy services in systems administration,
application development and systems integration. The Company's name was changed
in February 1997 to March Information Systems reflecting the refocus of the
company as a supplier of specialist security software rather than as a
consultancy company. The company was acquired in October 1998 by ISS Group, Inc.
as further explained in Note 7.
 
     The Company provides security software and services to customers using
computers running UNIX and Windows NT operating systems with the objective of
helping those customers improve the security of and reduce the threats to
critical corporate data held on these computers.
 
  BASIS OF PRESENTATION
 
     These financial statements do not comprise the statutory accounts of the
Company within the meaning of Section 240 of the Companies Act 1985, as amended
(the "Companies Act"). The Company's statutory accounts, which are its primary
financial statements, are prepared in accordance with the Companies Act and are
presented in British pounds. Statutory accounts for the year ended March 31,
1997 and March 31, 1998 have been prepared and the auditors have given
unqualified audit reports thereon. The consolidated financial statements have
been prepared in accordance with accounting principles generally accepted in the
United States and have been prepared in U.S. dollars. These consolidated
financial statements have been translated from the functional currency (British
pounds) to U.S. dollars in accordance with Statement of Financial Accounting
Standards No. 52 -"Foreign Currency Translation". Under this Statement assets
and liabilities are translated at year end rates and income and expenses are
translated at average rates.
 
     The consolidated financial statements include the accounts of the Company
and its wholly owned subsidiaries. All significant intercompany balances and
transactions have been eliminated. Investments in 50% or less owned companies
and joint ventures over which the Company has the ability to exercise
significant influence are accounted for using the equity method.
 
  REVENUE RECOGNITION
 
     The Company recognizes its license revenue upon (i) delivery of software
or, if the customer has evaluation software, delivery of the software key, and
(ii) issuance of the related license, assuming no significant vendor obligations
or customer acceptance rights exist. In October 1997, the AICPA issued Statement
of Position ("SOP") No. 97-2, Software Revenue Recognition, which the Company
adopted, effective April 1, 1997. Such adoption had no effect on the Company's
revenue recognition policies related to its licensee and maintenance activities.
Prior to 1997, the Company's revenue recognition policy was in accordance with
the preceding authoritative guidance provided by SOP No. 91-1, Software Revenue
Recognition.
 
     Annual renewable maintenance is a separate component of each contract, and
is recognized ratably over the contract term. Professional services revenues are
recognized as such services are performed.
 
                                      F-23
<PAGE>   90
                       MARCH INFORMATION SYSTEMS LIMITED
 
           NOTES TO CONSOLIDATED FINANCIAL STATEMENTS -- (CONTINUED)
 
1. SUMMARY OF SIGNIFICANT ACCOUNTING POLICIES (CONTINUED)
  EQUIPMENT AND FIXTURES
 
     Depreciation is provided so as to write down the cost of property and
equipment to their estimated residual value over their expected useful lives
which is typically 3-4 years. The principal annual depreciation rates and
methods of calculation are as follows:
 
<TABLE>
<S>                                                           <C>
Computer and telecom equipment..............................  3 years straight line
Furniture and fittings......................................  3 years straight line
Motor vehicles..............................................  4 years straight line
</TABLE>
 
  INCOME TAXES
 
     Income taxes are accounted for in accordance with Statement of Financial
Accounting Standards No. 109, "Accounting for Income Taxes." Under the asset and
liability method of Statement No. 109, deferred income tax assets and
liabilities are recognized for the future tax consequences attributable to
carryforward losses and differences between the financial statement carrying
amounts of existing assets and liabilities, and their respective tax bases.
Deferred income tax assets and liabilities are measured using enacted tax rates
expected to apply to taxable income in the years in which those temporary
differences are expected to be recovered or settled. Deferred income tax assets
are recorded at their likely realizable amount.
 
  FOREIGN CURRENCY TRANSLATION
 
     Although the Company's functional currency is the British pound, some
transactions are made in different currencies. Foreign currency transactions are
converted into local currency at the rate of exchange prevailing at the date of
the transaction. Exchange gains or losses arising from transactions denominated
in a currency other than the functional currency of the entity involved are
included in other expenses.
 
  USE OF ESTIMATES
 
     The preparation of financial statements requires management to make
estimates and assumptions that affect the reported amounts of assets and
liabilities and disclosure of contingent assets and liabilities at the date of
the financial statements and the reported amounts of revenues and expenses
during the reporting period. Actual results could differ from those estimates.
 
     Certain estimates used by management are particularly susceptible to
significant changes, such as the recoverability and amortization periods of
intangible assets. Management believes that as of March 31, 1997 and 1998 and
September 30, 1998, the estimates used are adequate based on the information
currently available.
 
  INTERIM FINANCIAL INFORMATION
 
     The financial information at September 30, 1998 and for the six months
ended September 30, 1997 and 1998 is unaudited but included all adjustments
(consisting of normal recurring adjustments) which the Company considers
necessary for a fair presentation of the financial position at such date and the
operating results and cash flows for those periods. Results of the September 30,
1998 period are not necessarily indicative of the results for the entire year.
 
                                      F-24
<PAGE>   91
                       MARCH INFORMATION SYSTEMS LIMITED
 
           NOTES TO CONSOLIDATED FINANCIAL STATEMENTS -- (CONTINUED)
 
1. SUMMARY OF SIGNIFICANT ACCOUNTING POLICIES (CONTINUED)
  FAIR VALUE OF FINANCIAL INSTRUMENTS
 
     The carrying amounts for the Company's financial instruments, including
cash, accounts receivable, accounts payable, accrued expenses and long-term debt
approximate fair values.
 
     However, considerable judgment is required in interpreting market data to
develop estimates of fair value. Therefore, the estimates are not necessarily
indicative of the amounts which could be realized or would be paid in a current
market exchange. The effect of using different market assumptions and/or
estimation methodologies may be material to the estimated fair value amount.
 
  CASH AND CASH EQUIVALENTS
 
     The Company considers investments in highly liquid instruments purchased
with an original maturity of 90 days or less to be cash equivalents. Such
amounts are stated at cost which approximates market value.
 
  CONCENTRATION OF CREDIT RISK
 
     The Company performs ongoing credit evaluations of its customers' financial
condition and, generally, does not require collateral on accounts receivable.
When required, the Company maintains allowances for credit losses and such
losses have been within management's expectations. The Company's services are
provided to customers mainly throughout Europe and United States. There was no
allowance for doubtful accounts established for the periods presented and
write-offs of accounts receivable have not been significant.
 
     The Company had one customer that accounted for approximately 49% of total
revenues for the year ended March 31, 1997 and 45% for the six months ended
September 30, 1997 and two customers that accounted for approximately 33% and
41% of total revenues for the year ended March 31, 1998 and 29% and 42% of total
revenues for the six months ended September 30, 1998, respectively.
 
  PENSION PLAN
 
     The Company sponsors a defined contribution pension plan. The pension
charge represents the amounts payable by the Company to the fund. Employees are
eligible to join the plan after three months of employment. The Company matches
the employees contribution up to a maximum 5% of the employees salary. If an
employee belongs to a pension fund outside of the company and does not elect to
join the pension fund maintained by March, then the Company will contribute to
the outside fund at a rate of 5% or match what the employee contributes,
whichever is lower. Contributions for the year ended March 31, 1997 and 1998 and
the six months ending September 30, 1997 and 1998 were $45,030, $47,247, $23,733
and $22,588, respectively.
 
  RESEARCH AND DEVELOPMENT
 
     Research and development costs are charged to expense as incurred. The
Company has not capitalized any such development costs under SFAS No. 86,
Accounting for the Costs of Computer Software to be sold, leased, or otherwise
marketed, because the costs incurred by the company between the attainment of
technological feasibility for the related software product through the date when
the product is available for general release to customers is insignificant.
 
                                      F-25
<PAGE>   92
                       MARCH INFORMATION SYSTEMS LIMITED
 
           NOTES TO CONSOLIDATED FINANCIAL STATEMENTS -- (CONTINUED)
 
1. SUMMARY OF SIGNIFICANT ACCOUNTING POLICIES (CONTINUED)
  ADVERTISING
 
     Costs related to advertising are expensed as incurred. Advertising expense
was $4,879, $4,031 $1,051 and $7,589 for the years ended March 31, 1997 and 1998
and the six months ended September 30, 1997 and 1998, respectively.
 
  NEW ACCOUNTING PRONOUNCEMENTS
 
     In June 1997, the FASB issued SFAS No. 130, "Reporting Comprehensive
Income". This Statement requires that changes in comprehensive income be shown
in a financial statement that is displayed with the same prominence as other
financial statements. The Statement will be effective for annual periods
beginning after December 15, 1997 and the Company will adopt its provisions in
fiscal 1998. Reclassification for earlier periods is required for comparative
purposes. The Company is currently evaluating the impact this Statement will
have on its financial statements, however, because the Statement requires only
additional disclosure, the Company does not expect the statement to have a
material impact on its financial position or results of operations.
 
     In June 1997, the FASB issued SFAS No 131, "Disclosure about Segments of an
Enterprise and Related Information," which changes the way public companies
report information about operating segments. SFAS No. 131, which is based on the
management approach to segment reporting, establishes requirements to report
selected segment information quarterly and to report entity-wide disclosures
about products and services, major customers, and the material countries in
which the entity holds assets and reports revenue. The Statement will be
effective for annual periods beginning after December 15, 1997 and the Company
will adopt its provisions in fiscal 1998. The Company does not expect the
Statement to have a material impact on its financial position or results of
operations.
 
  YEAR 2000 (UNAUDITED)
 
     The Company has determined that its current computer systems are Year 2000
compliant and would function properly with respect to dates in the Year 2000 and
beyond. The Company has not noted any Year 2000 issues with its products;
however, the Company has not performed a significant amount of testing with
respect to its products. The Company has yet to initiate discussions with all of
its third-party relationships to ensure that those parties have appropriate
plans in place to correct all of their year 2000 issues.
 
     While the Company believes its planning efforts are adequate to address its
Year 2000 concerns, there can be no assurance that the systems and products of
other companies on which the Company's operations rely will be converted on a
timely basis and will not have a material adverse effect on the Company's
results of operations. The cost of the Year 2000 initiatives is not expected to
be material to the Company's consolidated results of operations or financial
position.
 
2. BUSINESS COMBINATIONS
 
     The Company incorporated a wholly-owned subsidiary in Belgium, March
Systems Consultancy BVBA, in January 1993 to exploit the market for temporary
computer specialists in Belgium and Western Europe. March Systems Consultancy
BVBA was dissolved in December 1997 as the UK company continued to focus on
software development.
 
                                      F-26
<PAGE>   93
                       MARCH INFORMATION SYSTEMS LIMITED
 
           NOTES TO CONSOLIDATED FINANCIAL STATEMENTS -- (CONTINUED)
 
2. BUSINESS COMBINATIONS (CONTINUED)
     Also in 1993, the Company acquired a 50% interest in another company,
Westmount UK Limited, supplying UNIX based I-CASE software and professional
services. Westmount UK ceased trading in December 1997.
 
3. COMMITMENTS
 
  OPERATING LEASES
 
     The Company leases two separate office spaces under non-cancelable
operating leases. One lease is month to month and the other expires on September
30, 1999. The Company also leases cars and computer equipment under a
non-cancelable lease arrangements.
 
     Required future minimum lease payments under both operating and capital
leases as of March 31, 1998 are as follows:
 
<TABLE>
<CAPTION>
                                                              OPERATING   CAPITAL
                                                               LEASES      LEASES
                                                              ---------   --------
<S>                                                           <C>         <C>
Years ending December 31:
  1999......................................................   $31,817    $ 32,226
  2000......................................................    15,908       3,190
                                                               -------    --------
          Total minimum payments required...................   $47,725      35,416
                                                               =======
  Present value of future lease payments....................                31,810
  Less current portion......................................               (25,713)
                                                                          --------
  Noncurrent portion........................................              $  6,097
                                                                          ========
</TABLE>
 
     Rent expense was $42,152, $43,629, $16,424 and $22,744 for the fiscal years
ending March 31, 1997 and March 31, 1998, and the six months ending September
30, 1997 and September 30, 1998, respectively.
 
     Equipment and fixtures financed under a capital lease were $277,639,
$158,365 and $85,592 at March 31, 1997, March 31, 1998 and September 30, 1998,
respectively. Accumulated amortization related to the leased assets were
$139,910, $98,466 and $37,528 at March 31, 1997, March 31, 1998 and September
30, 1998, respectively. Amortization related to capital leases are included in
depreciation expense.
 
4. INCOME TAX
 
     The deferred tax asset reflects the net tax effects of temporary
differences between the carrying amounts of assets and liabilities for financial
reporting purposes and the amounts used for income tax purposes.
 
     Significant components of the Company's deferred tax assets are as follows:
 
<TABLE>
<CAPTION>
                                                                 YEAR ENDED
                                                                  MARCH 31,
                                                              -----------------
                                                               1997      1998
                                                              -------   -------
<S>                                                           <C>       <C>
Book over tax depreciation..................................  $11,468   $10,945
Other.......................................................      788     1,759
                                                              =======   =======
          Total deferred tax asset..........................  $12,256   $12,704
                                                              =======   =======
</TABLE>
 
                                      F-27
<PAGE>   94
                       MARCH INFORMATION SYSTEMS LIMITED
 
           NOTES TO CONSOLIDATED FINANCIAL STATEMENTS -- (CONTINUED)
 
4. INCOME TAX (CONTINUED)
     Significant components of the benefit (provision) for income taxes
attributable to operations are as follows:
 
<TABLE>
<CAPTION>
                                                                  YEAR ENDED
                                                                  MARCH 31,
                                                              ------------------
                                                               1997       1998
                                                              -------   --------
<S>                                                           <C>       <C>
Current.....................................................  $21,418   $(20,811)
Deferred....................................................    5,259        118
                                                              =======   ========
                                                              $26,677   $(20,693)
                                                              =======   ========
</TABLE>
 
     A reconciliation of the statutory income tax rate to the Company's
effective income tax rate is as follows:
 
<TABLE>
<CAPTION>
                                                                  YEAR ENDED
                                                                  MARCH 31,
                                                              ------------------
                                                               1997       1998
                                                              -------   --------
<S>                                                           <C>       <C>
Income tax at statutory rates...............................  $32,370   $ (9,564)
Income not taxable..........................................       --      3,276
Non deductible expenses.....................................   (6,239)   (12,210)
Other.......................................................      809       (152)
Change in rate for deferred accounts........................     (263)    (2,043)
                                                              =======   ========
                                                              $26,677   $(20,693)
                                                              =======   ========
                                                                19.8%      45.4%
                                                              =======   ========
</TABLE>
 
5. RELATED PARTIES
 
     The directors of the Company have made short term loans to assist in the
funding of the Company during temporary cash flow shortages. At March 31, 1997
and March 31, 1998 the total of the loans were approximately $52,544 and
$90,428, respectively. There were no balances outstanding at September 30, 1998.
There were no specific payment terms attached to the notes. The balances are
included in accrued expenses and other liabilities on the balance sheet.
Subsequent to year end, the balance of the notes were paid.
 
6. SEGMENT REPORTING
 
     Revenue by geographic area is as follows:
 
<TABLE>
<CAPTION>
                                                YEAR ENDED              SIX MONTHS ENDED
                                                 MARCH 31,                SEPTEMBER 30,
                                          -----------------------   -------------------------
                                             1997         1998         1997          1998
                                          ----------   ----------   -----------   -----------
                                                                    (UNAUDITED)   (UNAUDITED)
<S>                                       <C>          <C>          <C>           <C>
United Kingdom customers................  $1,553,784   $1,473,022    $691,533     $  691,287
Continental Europe customers............      62,754      118,691      57,866        240,123
United States of America................          --      358,461     147,386         41,610
Rest of the world.......................      19,512       96,194      11,019        225,755
                                          ==========   ==========    ========     ==========
          Total revenue.................  $1,636,050   $2,046,368    $907,804     $1,198,775
                                          ==========   ==========    ========     ==========
</TABLE>
 
                                      F-28
<PAGE>   95
                       MARCH INFORMATION SYSTEMS LIMITED
 
           NOTES TO CONSOLIDATED FINANCIAL STATEMENTS -- (CONTINUED)
 
7. SUBSEQUENT EVENTS
 
     On October 6, 1998, the Company was purchased by ISS Group, Inc. for $4.75
million plus 120,000 shares of ISS Group, Inc.'s common stock. The acquisition
will be accounted for as a purchase. ISS Group is a US based company currently
being traded on the NASDAQ stock exchange. Upon acquisition, the Company's name
was changed to ISS Group Ltd.
 
                                      F-29
<PAGE>   96
 
            ISS GROUP, INC. ACQUISITION OF MARCH INFORMATION SYSTEMS
 
                       UNAUDITED PRO FORMA FINANCIAL DATA
 
     On October 6, 1998, ISS acquired privately held March Information Systems
Limited ("March Systems"), a United Kingdom-based developer of Windows NT and
Unix-based security assessment technologies. Under the terms of the agreement,
ISS Group, Inc. ("ISS" or "Company") acquired all of the outstanding stock of
March Systems in exchange for $4.75 million in cash and 120,000 shares of ISS
Group common stock. The ISS shares were valued at the closing price of ISS
common stock on October 6, 1998 of $24 per share, as quoted on the NASDAQ
National Market System. In addition, there were transaction costs of
approximately $265,000, principally for legal and accounting professional
services and stock transfer taxes. The transaction has been accounted for using
the purchase method of accounting and the results of March Systems will be
included in future results of ISS from October 6, 1998, the closing date of the
transaction.
 
     The Unaudited Pro Forma Consolidated Statement of Operations set forth
below for the year ended December 31, 1998 gives effect to the acquisition as if
it occurred on January 1, 1998. It has been derived from the ISS historical
consolidated statement of operations for the year ended December 31, 1998 and
from the March Systems unaudited consolidated statement of operations for the
nine-month period ended September 30, 1998.
 
     The Pro Forma Consolidated Financial Statements do not purport to be
indicative of the results of operations or financial position which would have
actually been reported if the acquisition had been consummated on the date
indicated, or which may be reported in the future.
 
                                      F-30
<PAGE>   97
 
            UNAUDITED PRO FORMA CONSOLIDATED STATEMENT OF OPERATIONS
                          YEAR ENDED DECEMBER 31, 1998
 
<TABLE>
<CAPTION>
                                                        MARCH
                                                     INFORMATION    PRO FORMA
                                                       SYSTEMS     ACQUISITION     ISS GROUP
                                        ISS GROUP      LIMITED     ADJUSTMENTS     PRO FORMA
                                       -----------   -----------   -----------    -----------
<S>                                    <C>           <C>           <C>            <C>
Revenues:
  Perpetual licenses.................  $25,936,000   $1,029,000     $      --     $26,965,000
  Subscriptions......................    7,406,000      109,000                     7,515,000
  Professional services..............    2,587,000      668,000                     3,255,000
                                       -----------   ----------     ---------     -----------
                                        35,929,000    1,806,000                    37,735,000
                                       -----------   ----------     ---------     -----------
Costs and expenses:..................                        --
  Cost of revenues...................    4,831,000      584,000                     5,415,000
  Research and development...........    9,321,000      387,000                     9,708,000
  Charge for in-process research and
     development.....................      802,000                                    802,000
  Sales and marketing................   22,762,000      585,000                    23,347,000
  Amortization.......................      230,000           --       607,000(1)      837,000
  General and administrative.........    4,389,000       75,000                     4,464,000
                                       -----------   ----------     ---------     -----------
                                        42,335,000    1,631,000       607,000      44,573,000
                                       -----------   ----------     ---------
Operating income (loss)..............   (6,406,000)     175,000      (607,000)     (6,838,000)
Interest income (expense), net.......    2,366,000      (31,000)     (196,000)(2)   2,139,000
                                       -----------   ----------     ---------     -----------
Income (loss) before income taxes....   (4,040,000)     144,000      (803,000)     (4,699,000)
Provision for income taxes...........       62,000       67,000                       129,000
                                       -----------   ----------     ---------     -----------
Net income (loss)....................  $(4,102,000)  $   77,000     $(803,000)     (4,828,000)
                                       ===========   ==========     =========     ===========
Basic and diluted net loss per share
  of Common Stock....................  $     (0.28)                               $     (0.32)
                                       ===========                                ===========
Weighted average number of shares
  used in calculating basic and
  diluted net loss per share of
  Common Stock.......................   14,883,000                    120,000      15,003,000
                                       ===========                  =========     ===========
Unaudited pro forma net loss per
  share of Common Stock (see note
  3).................................  $     (0.25)                               $     (0.30)
                                       ===========                                ===========
Unaudited weighted average number of
  shares used in calculating pro
  forma net loss per share of Common
  Stock (see note 3).................   16,189,000                    120,000      16,309,000
                                       ===========                  =========     ===========
</TABLE>
 
See accompanying notes to unaudited pro forma consolidated financial statements
for explanation of pro forma acquisition adjustments.
 
                                      F-31
<PAGE>   98
 
            ISS GROUP, INC. ACQUISITION OF MARCH INFORMATION SYSTEMS
               NOTES TO UNAUDITED PRO FORMA FINANCIAL INFORMATION
 
(1) ALLOCATION OF PURCHASE PRICE AND RELATED AMORTIZATION
 
     The purchase price was allocated first to tangible net assets, then to
identified intangible assets with any remaining unallocated purchase price
attributed to goodwill. The fair value of tangible assets approximated their
historical book values at September 30, 1998. The identified intangible assets,
along with their estimated lives for amortization, are as follows:
 
<TABLE>
<CAPTION>
                                                                           LIFE
                                                                           ----
<S>                                                           <C>          <C>
Professional work force.....................................  $  215,000     6
Core technology software....................................   3,099,000     8
Developed software..........................................     380,000     5
In process research and development software................     705,000
Goodwill....................................................   3,096,000    10
</TABLE>
 
     The value assigned to in-process research and development software, in
accordance with generally accepted accounting principles, was written off at the
time of the acquisition and is reflected in the ISS consolidated financial
results for the year ended December 31, 1998.
 
(2) INTEREST INCOME
 
     In connection with the payment of $5,015,000 in cash in conjunction with
the acquisition, including transaction costs, interest income was reduced for
the nine months ended September 30, 1998 using the 5.2% interest rate earned on
such funds.
 
(3) PRO FORMA LOSS PER SHARE
 
     The Pro Forma basic and diluted historical net loss per share use the
historical amounts for ISS Group, Inc adjusted by the impact of the March
Systems acquisition. This impact includes March Systems historical net income
for the periods, the impact of purchase accounting adjustments and the shares of
Common Stock issued in connection with the acquisition.
 
     Additionally, these pro forma consolidated statements of operation reflect
adjustments to the pro forma net loss per share amounts reflected in the ISS
historical consolidated statements of operations. The per share amounts were
computed for the historical ISS statements by dividing its net losses by the
number of shares of common Stock outstanding plus the conversion of the
3,650,000 shares of Series A and 2,087,000 shares of Series B Redeemable,
Convertible Preferred Stock into 5,737,000 share of Common Stock which occurred
upon consummation of ISS's initial public offering in March 1998. These pro
forma financial statements adjust such net loss and weighted average share
amounts for March Systems historical net income for the period, the impact of
purchase accounting adjustments and the shares of Common Stock issued in
connection with the acquisition.
 
                                      F-32
<PAGE>   99
 
                                  UNDERWRITING
 
     ISS, the selling stockholders and the underwriters for the U.S. offering
(the "U.S. Underwriters") named below have entered into an underwriting
agreement with respect to the shares being offered in the United States. Subject
to certain conditions, each U.S. Underwriter has severally agreed to purchase
the number of shares indicated in the following table. Goldman, Sachs & Co.,
Dain Rauscher Wessels, a division of Dain Rauscher Incorporated, Warburg Dillon
Read LLC, a subsidiary of UBS AG, and BancBoston Robertson Stephens Inc. are the
representatives of the U.S. Underwriters.
 
<TABLE>
<CAPTION>
                                                              Number of
                        Underwriters                           Shares
                        ------------                          ---------
<S>                                                           <C>
Goldman, Sachs & Co.........................................
Dain Rauscher Wessels.......................................
Warburg Dillon Read LLC, a subsidiary of UBS AG.............
BancBoston Robertson Stephens Inc...........................
 
                                                              ---------
          Total.............................................  1,920,000
                                                              =========
</TABLE>
 
                             ----------------------
 
     If the U.S. Underwriters sell more shares than the total number set forth
in the table above, the U.S. Underwriters have an option to buy up to an
additional 264,000 shares from ISS and an option to buy an additional 24,000
shares from the selling stockholders to cover such sales. They may exercise that
option for 30 days. If any shares are purchased pursuant to this option, the
U.S. Underwriters will severally purchase shares in approximately the same
proportion as set forth in the table above.
 
     The following tables show the per share and total underwriting discounts
and commissions to be paid to the U.S. Underwriters by ISS and the selling
stockholders. Such amounts are shown assuming both no exercise and full exercise
of the U.S. Underwriters' option to purchase additional shares.
 
<TABLE>
<CAPTION>
                               Paid by the Company
                         -------------------------------
                             No                Full
                          Exercise           Exercise
                         -----------       -------------
<S>                      <C>               <C>
Per Share............     $                  $
Total................     $                  $
</TABLE>
 
<TABLE>
<CAPTION>
                               Paid by the Selling
                                  Stockholders
                         -------------------------------
                             No                Full
                          Exercise           Exercise
                         -----------       -------------
<S>                      <C>               <C>
Per Share............     $                  $
Total................     $                  $
</TABLE>
 
     Shares sold by the Underwriters to the public will initially be offered at
the initial public offering price set forth on the cover of this Prospectus. Any
shares sold by the Underwriters to securities dealers may be sold at a discount
of up to $          per share from the initial public offering price. Any such
securities dealers may resell any shares purchased from the U.S. Underwriters to
certain other brokers or dealers at a discount of up to $          per share
from the initial public offering price. If all the shares are not sold at the
initial offering price, the representatives may change the offering price and
the other selling terms.
 
     ISS and the selling stockholders have entered into underwriting agreements
with the Underwriters for the sale of shares outside of the United States. The
terms and conditions of both offerings are the same and the sale of shares in
both Offerings are conditioned on each other. Goldman Sachs International, Dain
Rauscher Wessels, a division of Dain Rauscher Incorporated, Warburg Dillon Read,
a division of UBS AG, and BancBoston Robertson Stephens Inc. are representatives
of the Underwriters for the international offering outside of the United States
(the "International Underwriters"). ISS and the selling stockholders have
granted the International Underwriters similar options to
 
                                       U-1
<PAGE>   100
 
purchase up to an aggregate of an additional
72,000 shares.
 
     The Underwriters for both of the Offerings have entered into an agreement
in which they agree to restrictions on where and to whom they and any dealer
purchasing from them may offer shares as a part of the distribution of the
shares. The Underwriters also have agreed that they may sell shares among each
of the underwriting groups.
 
     ISS and the selling stockholders have agreed with the Underwriters not to
dispose of or hedge any of their common stock or securities convertible into or
exchangeable for shares of common stock during the period from the date of this
prospectus continuing through the date 90 days after the date of this
prospectus, except with the prior written consent of the representatives. This
agreement does not apply to any existing employee benefit plans. See "Shares
Available for Future Sale" for a discussion of certain transfer restrictions.
 
     The common stock will be quoted on the Nasdaq National Market under the
symbol "ISSX".
 
     In connection with the Offerings, the Underwriters may purchase and sell
shares of common stock in the open market. These transactions may include short
sales, stabilizing transactions and purchases to cover positions created by
short sales. Short sales involve the sale by the Underwriters of a greater
number of shares than they are required to purchase in the Offerings.
Stabilizing transactions consist of certain bids or purchases made for the
purpose of preventing or retarding a decline in the market price of the common
stock while the Offerings are in progress.
 
     The Underwriters also may impose a penalty bid.  This occurs when a
particular Underwriter repays to the Underwriters a portion of the underwriting
discount received by it because the representatives have repurchased shares sold
by or for the account of such Underwriter in stabilizing or short covering
transactions.
 
     These activities by the Underwriters may stabilize, maintain or otherwise
affect the market price of the common stock. As a result, the price of the
common stock may be higher than the price that otherwise might exist in the open
market. If these activities are commenced, they may be discontinued by the
Underwriters at any time. These transactions may be effected on the Nasdaq
National Market, in the over-the-counter market or otherwise.
 
     ISS estimates that the total expenses of the Offerings, excluding
underwriting discounts and commissions, will be approximately $       .
 
     ISS and the selling stockholders have agreed to indemnify the several
Underwriters against certain liabilities, including liabilities under the
Securities Act of 1933.
 
     This prospectus may be used by the Underwriters and other dealers in
connection with offers and sales of the shares, including sales of shares
initially sold by the Underwriters in the Offerings being made outside of the
United States, to persons located in the United States.
 
                                       U-2
<PAGE>   101

                       [Inside Back Cover of Prospectus]

     Picture headed "SAFEsuite Architecture" depicts a rectangle segmented into
12 parts: One segment spans the top of the top of the rectangle and is titled
"Information Risk Management". Immediately below that segment is another segment
spanning the top of the rectangle entitled "SAFEsuite Decisions" and includes
that product's square logo. Immediately below that segment are two segments of
half the length of the rectangle. The left segment is entitled "Vulnerability
Management" and the right segment is entitled "Threat Management". Below the
Vulnerability Management segment are three segments, entitled (from left to
right) "Internet Scanner", "Database Scanner" and "System Scanner", each with a
circular product logo. Below the "Threat Management" segment are two segments
(on a level even with the three segments below "Vulnerability Management")
entitled "RealSecure Engine" and "RealSecure Agent", both with a circular
product logo. Below these five segments is a segment spanning the length of the
rectangle entitled "Security Knowledge Base". Below that segment is another
segment spanning the width of the rectangle with 4 rectangular "X-Force" logos.
Along the right edge of the rectangle is a segment entitled "Professional
Services" with the words "Implementation" "Consulting" "Training" and "Advisory
Service" underneath the title.

<PAGE>   102
 
- ----------------------------------------------------------
- ----------------------------------------------------------
 
     No dealer, salesperson or other person is authorized to give you any
information or to represent anything not contained in this prospectus. You must
not rely on any unauthorized information or representations. This prospectus is
an offer to sell or to buy only the shares offered hereby, but only under
circumstances and in jurisdictions where it is lawful to do so. The information
contained in this prospectus is current only as of its date.
 
                             ----------------------
 
                               TABLE OF CONTENTS
 
<TABLE>
<CAPTION>
                                          Page
                                          ----
<S>                                       <C>
Prospectus Summary......................    1
Risk Factors............................    3
Use of Proceeds.........................   12
Price Range of Common Stock.............   12
Dividend Policy.........................   12
Capitalization..........................   13
Dilution................................   14
Selected Consolidated Financial Data....   15
Management's Discussion and Analysis of
  Financial Condition and Results of
  Operations............................   16
Business................................   24
Management..............................   43
Certain Transactions....................   52
Principal and Selling Stockholders......   54
Description of Securities...............   56
Shares Eligible for Future Sale.........   60
Validity of Common Stock................   62
Experts.................................   62
Additional Information..................   62
Index to Consolidated Financial
  Statements............................  F-1
Underwriting............................  U-1
</TABLE>
 
- ----------------------------------------------------------
- ----------------------------------------------------------
- ----------------------------------------------------------
- ----------------------------------------------------------
 
                                2,400,000 Shares
 
                                ISS GROUP, INC.
 
                                  Common Stock
                             ----------------------
 
                                   (ISS LOGO)
                             ----------------------
                              GOLDMAN, SACHS & CO.
 
                             DAIN RAUSCHER WESSELS
                    A DIVISION OF DAIN RAUSCHER INCORPORATED
                            WARBURG DILLON READ LLC
 
                                   BANCBOSTON
                               ROBERTSON STEPHENS
 
                      Representatives of the Underwriters
- ----------------------------------------------------------
- ----------------------------------------------------------
<PAGE>   103
 
                                    PART II
 
                     INFORMATION NOT REQUIRED IN PROSPECTUS
 
     All capitalized terms used and not defined in Part II of this registration
statement shall have the meaning assigned to them in the prospectus which forms
a part of this registration statement.
 
ITEM 13.  OTHER EXPENSES OF ISSUANCE AND DISTRIBUTION
 
     The following table sets forth the costs and expenses, other than
underwriting discounts and commissions, payable by the registrant connection
with the sale of common stock being registered. All amounts are estimates,
except the SEC registration fee and the NASD filing fee.
 
<TABLE>
<S>                                                           <C>
SEC Registration fee........................................  $ 46,375
NASD fee....................................................    17,182
Nasdaq National Market listing fee..........................    17,500
Printing and engraving expenses.............................   200,000
Legal fees and expenses.....................................   150,000
Accounting fees and expenses................................   120,000
Blue sky fees and expenses..................................     5,000
Transfer agent fees.........................................    10,000
Miscellaneous...............................................    33,943
                                                              --------
          Total.............................................  $600,000
                                                              ========
</TABLE>
 
ITEM 14.  INDEMNIFICATION OF DIRECTORS AND OFFICERS
 
     Subsection (a) of Section 145 of the Delaware General Corporation Law
empowers a corporation to indemnify any person who was or is a party or is
threatened to be made a party to any threatened, pending or completed action,
suit or proceeding whether civil, criminal, administrative or investigative
(other than an action by or in the right of the corporation) by reason of the
fact that he is or was a director, officer, employee or agent of the
corporation, or is or was serving at the request of the corporation as a
director, officer, employee or agent of another corporation, partnership, joint
venture, trust or other enterprise, against expenses (including attorneys'
fees), judgments, fines and amounts paid in settlement actually and reasonably
incurred by him in connection with such action, suit or proceeding if he acted
in good faith and in a manner he reasonably believed to be in or not opposed to
the best interests of the corporation, and, with respect to any criminal action
or proceeding, had no reasonable cause to believe his conduct was unlawful.
 
     Subsection (b) of Section 145 empowers a corporation to indemnify any
person who was or is a party or is threatened to be made a party to any
threatened, pending or completed action or suit by right of the corporation to
procure a judgment in its favor by reason of the fact that such person acted in
any of the capacities set forth above, against expenses (including attorneys'
fees) actually and reasonably incurred by him in connection with the defense or
settlement of such action or suit if he acted in good faith and in a manner he
reasonably believed to be in or not opposed to the best interests of the
corporation, except that no indemnification may be made in respect to any claim
issue or matter as to which such person shall have been adjudged to be liable to
the corporation unless and only to the extent that the Court of Chancery or the
court in which such action or suit was brought shall determine upon application
that, despite the adjudication of liability but in view of all the circumstances
of the case, such person is fairly and reasonably entitled to indemnity for such
expenses which the Court of Chancery or such other court shall deem proper.
 
                                      II-1
<PAGE>   104
 
     Section 145 further provides that to the extent a director or officer of a
corporation has been successful on the merits or otherwise in the defense of any
such action, suit or proceeding referred to in subsections (a) and (b) of
Section 145 or in the defense of any claim, issue or matter therein, he shall be
indemnified against expenses (including attorneys' fees) actually and reasonably
incurred by him in connection therewith; that the indemnification provided for
by Section 145 shall not be deemed exclusive of any other rights which the
indemnified party may be entitled; that indemnification provided by Section 145
shall, unless otherwise provided when authorized or ratified, continue as to a
person who has ceased to be a director, officer, employee or agent and shall
inure to the benefit of such person's heirs, executors and administrators; and
empowers the corporation to purchase and maintain insurance on behalf of a
director or officer of the corporation against any liability asserted against
him and incurred by him in any such capacity, or arising out of his status as
such, whether or not the corporation would have the power to indemnify him
against such liabilities under Section 145.
 
     Section 102(b)(7) of the Delaware General Corporation Law provides that a
certificate of incorporation may contain a provision eliminating or limiting the
personal liability of a director to the corporation or its stockholders for
monetary damages for breach of fiduciary duty as a director, provided that such
provision shall not eliminate or limit the liability of the director (i) for any
breach of the director's duty of loyalty to the corporation or its stockholders,
(ii) for acts or omissions not in good faith or which involve intentional
misconduct or a knowing violation of law, (iii) under Section 174 of the
Delaware General Corporation Law or (iv) for any transaction from which the
director derived an improper personal benefit.
 
     Article Eleventh of the registrant's charter provides that, to the fullest
extent permitted by the Delaware General Corporation Law as the same exists or
as it may hereafter be amended, no director of the registrant shall be
personally liable to the registrant or its stockholders for monetary damages for
breach of fiduciary duty as a director.
 
     Section 6.1 of the registrant's bylaws further provides that the registrant
shall, to the maximum extent and in the manner permitted by the Delaware General
Corporation Law indemnify each of its directors and officers against expenses
(including attorneys' fees), judgments, fines, settlements, and other amounts
actually and reasonably incurred in connection with any proceeding, arising by
reason of the fact that such person is or was an agent of the registrant.
 
     The registrant has entered into indemnification agreements with each of its
directors and executive officers that provide for indemnification and expense
advancement to the fullest extent permitted under the Delaware General
Corporation Law.
 
     The registrant has purchased officers' and directors' liability insurance.
 
     The registrant has agreed to indemnify certain directors and officers
against certain liabilities, including liabilities under the Securities Act of
1933 (the "Securities Act"), pursuant to Section 7 of the Amended and Restated
Rights Agreement.
 
ITEM 15.  RECENT SALES OF UNREGISTERED SECURITIES
 
     Within the last three years, the registrant has sold the following
securities or engaged in the following transactions in private placements exempt
from registration under the Securities Act pursuant to Section 4(2) thereof:
 
          (1) On September 6, 1995, Internet Security Systems, Inc. ("Oldco")
     sold 1,293,475 shares of its common stock, par value $1.00 per share
     ("Oldco Common Stock") to Kevin J. O'Connor for $50,000.
 
                                      II-2
<PAGE>   105
 
          (2) On December 29, 1995, Oldco issued 1,959,770 shares of Oldco
     Common Stock to Thomas E. Noonan and 162,890 shares of Oldco Common Stock
     to Glenn McGonnigle in consideration for their employment with Oldco.
 
          (3) On February 2 and 21, 1996, Oldco sold an aggregate of 3,650,000
     shares of its Series A Preferred Stock, par value $1.00 per share, for an
     aggregate of $3,650,000 to Greylock Equity Limited Partnership, Sigma
     Associates III, L,P., Sigma Investors III, L.P., Sigma Partners III, L.P.
     and John P. Imlay, Jr., which shares automatically converted into an
     aggregate of 3,650,000 shares of common stock upon closing of the
     registrant's Initial Public Offering on March 27, 1998. Also in connection
     with the sale of Oldco's Series A Preferred Stock, Oldco repurchased
     100,000 shares of Oldco Common Stock from Christopher W. Klaus for $15,000.
 
          (4) On February 14, 1997, Oldco sold an aggregate of 2,086,957 shares
     of its Series B Preferred Stock, par value $1.00 per share, for an
     aggregate of $5,280,001 to Greylock Equity Limited Partnership, Sigma
     Associates III, L.P., Sigma Investors III, L.P., Sigma Partners III, L.P.,
     John P. Imlay, Jr., Kleiner Perkins Caufield & Byers VIII, KPCB Information
     Sciences Zaibatsu Fund II, KPCB Java Fund, AT&T Venture Fund II, L.P. and
     Venture Fund I, L.P., which shares automatically converted into 2,086,457
     Shares of common stock upon closing of the registrant's initial public
     offering on March 27, 1998.
 
          (5) On July 26, 1997, Oldco issued an aggregate of 12,500 shares of
     common stock to an executive recruiter in partial consideration for
     services rendered.
 
          (6) In December 1997, the registrant, Oldco and the shareholders of
     Oldco entered into an exchange agreement whereby (i) each share of Oldco
     Common Stock was exchanged for one share of the registrant's common stock,
     (ii) each share of Oldco's Series A Preferred Stock was exchanged for one
     share of the registrant's Series A Preferred Stock and (iii) each share of
     Oldco's Series B Preferred Stock was exchanged for one share of the
     registrant's Series B Preferred Stock.
 
          (7) On February 24, 1998, the registrant issued an aggregate of 1,000
     shares of common stock to an executive recruiter in partial consideration
     for services rendered.
 
          (8) In this period, holders of options issued under our stock option
     plan exercised options to purchase 412,000 shares of common stock for
     approximately $293,000.
 
          (9) The registrant has from time to time granted stock options to
     employees. The following table sets forth certain information regarding
     such grants:
 
<TABLE>
<CAPTION>
                                                         NUMBER OF      RANGE OF
                                                          SHARES     EXERCISE PRICES
                                                         ---------   ---------------
<S>                                                      <C>         <C>
April 19, 1994 (inception) through December 31,
  1995.................................................          --  $           --
January 1, 1996 through December 31, 1996..............     810,350   0.15 -   0.60
January 1, 1997 through December 31, 1997..............   1,023,000   0.60 -   7.00
January 1, 1998 through December 31, 1998..............     964,535   8.00 - 48.125
</TABLE>
 
     The above securities were offered and sold by the registrant in reliance
upon exemptions for registration pursuant to either (i) Section 4(2) of the
Securities Act, as transactions not involving any public offering, or (ii) Rule
701 under the Securities Act. No underwriters were involved in connections with
the sales of securities referred to in this Item 15.
 
                                      II-3
<PAGE>   106
 
ITEM 16.  EXHIBITS AND FINANCIAL STATEMENT SCHEDULES
 
     (a) Exhibits:
 
<TABLE>
<C>    <C>  <S>
 1.1   --   Form of U.S. Underwriting Agreement.
 3.1*  --   Certificate of Incorporation.
 3.2*  --   Bylaws.
 4.1*  --   Specimen common stock certificate.
 4.2*  --   See Exhibits 3.1 and 3.2 for provisions of the Certificate
            of Incorporation and Bylaws of the registrant defining the
            rights of holders of common stock of the registrant.
+5.1   --   Opinion of Brobeck, Phleger & Harrison LLP.
10.1*  --   1995 Stock Incentive Plan.
10.2*  --   Internet Security Systems, Inc. Amended and Restated Rights
            Agreement.
10.3*  --   Stock Exchange Agreement dated December 9, 1997.
10.4*  --   Amended and Restated Agreement Regarding Acceleration of
            Vesting of Future Optionees.
10.5*  --   Forms of Non-Employee Director Compensation Agreement,
            Notice of Stock Option Grant and Stock Option Agreement.
10.6*  --   Sublease for Atlanta facilities.
10.7*  --   Form of Indemnification Agreement for directors and certain
            officers.
10.8*  --   Series B Preferred Stock Purchase Agreement.
10.9   --   Sublease for additional Atlanta facilities.
21.1   --   Subsidiaries of registrant.
23.1   --   Consent of Ernst & Young LLP.
23.2   --   Consent of Ernst & Young.
23.3   --   Consent of Brobeck, Phleger & Harrison LLP (included in the
            opinion filed as Exhibit 5.1).
24.1   --   Power of attorney pursuant to which amendments to this
            registration statement may be filed (included on the
            signature page in Part 11 hereof).
27.1   --   Financial Data Schedule (for SEC use only).
</TABLE>
 
- ---------------
* Incorporated by reference to the registrant's registration statement on Form
  S-1, Registration No. 333-44529.
 
+ To be filed by amendment.
 
     (b) Financial Statement Schedules
 
     The following financial statement schedule of the registrant is included in
Part II of the registration statement:
 
          Report of Ernst & Young LLP, Independent Auditors
 
          Schedule II -- Valuation and Qualifying Accounts
 
     Except for the financial statement schedule listed above, the financial
statement schedules for which provision is made in the applicable accounting
regulations of the Securities and Exchange Commission (the "Commission")are
either not required under the related instructions or are inapplicable and have
therefore been omitted.
 
ITEM 17.  UNDERTAKINGS
 
     The registrant hereby undertakes to provide to the underwriters at the
closing specified in the underwriting agreements certificates in such
denominations and registered in such names as required by the underwriters to
permit prompt delivery to each purchaser.
 
     Insofar as indemnification for liabilities arising under the Securities Act
may be permitted to directors, officers and controlling persons of the
registrant pursuant to the Delaware General
 
                                      II-4
<PAGE>   107
 
Corporation Law, the charter or the bylaws of the registrant, the underwriting
agreement, or otherwise, the registrant has been advised that in the opinion of
the Commission such indemnification is against public policy as expressed in the
Securities Act, and is, therefore, unenforceable. In the event that a claim for
indemnification against such liabilities (other than the payment by the
registrant of expenses incurred or paid by a director, officer, or controlling
person of the registrant in the successful defense of any action, suit or
proceeding) is asserted by such director, officer or controlling person in
connection with the securities being registered hereunder, the registrant will,
unless in the opinion of its counsel the matter has been settled by controlling
precedent, submit to a court of appropriate jurisdiction the question of whether
such indemnification by it is against public policy as expressed in the
Securities Act and will be governed by the final adjudication of such issue.
 
     The undersigned registrant hereby undertakes that:
 
          (1) For purposes of determining any liability under the Securities
     Act, the information omitted from the form of prospectus filed as part of
     this registration statement in reliance upon Rule 430A and contained in a
     form of prospectus filed by the registrant pursuant to Rule 424 (b) (1) or
     (4) or 497 (h) under the Securities Act shall be deemed to be part of this
     Registration Statement as of the time it was declared effective.
 
          (2) For the purpose of determining any liability under the Securities
     Act, each post-effective amendment that contains a form of prospectus shall
     be deemed to be a new registration statement relating to the securities
     offered therein, and the offering of such securities at that time shall be
     deemed to be the initial bona fide offering thereof.
 
                                      II-5
<PAGE>   108
 
                                   SIGNATURES
 
     Pursuant to the requirements of the Securities Act of 1933, as amended, the
registrant has duly caused this Registration Statement to be signed on its
behalf by the undersigned, thereunto duly authorized, in the City of Atlanta,
State of Georgia, on this 29th day of January, 1999.
 
                                          ISS GROUP, INC.
 
                                          By:     /s/ THOMAS E. NOONAN
                                             -----------------------------------
                                                      Thomas E. Noonan
                                                Chairman, President and Chief
                                                      Executive Officer
 
                               POWER OF ATTORNEY
 
     KNOW ALL PERSONS BY THESE PRESENTS, that each individual whose signature
appears below constitutes and appoints Thomas E. Noonan, Richard Macchia and Jon
Ver Steeg and each of them, his true and lawful attorney-in-fact and agents,
with full power of substitution, for him and in his name, place and stead, in
any and all capacities, to sign any and all amendments (including post-effective
amendments) to this Registration Statement, and to sign any registration
statement for the same offering covered by this Registration Statement that is
to be effective upon filing pursuant to Rule 462(b) promulgated under the
Securities Act of 1933, and all post-effective amendments thereto, and to file
the same, with all exhibits thereto and all documents in connection therewith,
with the Securities and Exchange Commission, granting unto said
attorneys-in-fact and agents full power and authority to do and perform each and
every act and thing requisite and necessary to be done in and about the
premises, as fully to all intents and purposes as he might or could do in
person, hereby ratifying and confirming all that said attorneys-in fact and
agents, or his or their substitute or substitutes, may lawfully do or cause to
be done by virtue hereof.
 
     Pursuant to the requirements of the Securities Act of 1933, as amended,
this Registration Statement has been signed by the following persons in the
capacities and on the dates indicated:
 
<TABLE>
<CAPTION>
                        NAME                                      TITLE                   DATE
                        ----                                      -----                   ----
<C>                                                    <S>                          <C>
                /s/ THOMAS E. NOONAN                   Chairman, President and       January 29, 1999
- -----------------------------------------------------    Chief Executive
                  Thomas E. Noonan                       (Principal Executive
                                                         Officer)
 
              /s/ CHRISTOPHER W. KLAUS                 Chief Technical Officer,      January 29, 1999
- -----------------------------------------------------    Secretary and Director
                Christopher W. Klaus
 
                 /s/ RICHARD MACCHIA                   Vice President and Chief      January 29, 1999
- -----------------------------------------------------    Financial Officer
                   Richard Macchia                       (Principal Financial and
                                                         Accounting Officer)
 
                /s/ RICHARD S. BODMAN                  Director                      January 29, 1999
- -----------------------------------------------------
                  Richard S. Bodman
 
                /s/ ROBERT E. DAVOLI                   Director                      January 29, 1999
- -----------------------------------------------------
                  Robert E. Davoli
 
                /s/ KEVIN J. O'CONNOR                  Director                      January 29, 1999
- -----------------------------------------------------
                  Kevin J. O'Connor
 
                 /s/ DAVID N. STROHM                   Director                      January 29, 1999
- -----------------------------------------------------
                   David N. Strohm
</TABLE>
 
                                      II-6
<PAGE>   109
 
                         REPORT OF INDEPENDENT AUDITORS
 
     We have audited the consolidated financial statements of ISS Group, Inc. as
of December 31, 1997 and 1998, and for each of the three years in the period
ended December 31, 1998, and have issued our report thereon dated January 15,
1999 (included elsewhere in this Registration Statement). Our audits also
included the financial statement schedule listed in Item 16(b) of this
Registration Statement. This schedule is the responsibility of the Company's
management. Our responsibility is to express an opinion based on our audits.
 
     In our opinion, the financial statement schedule referred to above, when
considered in relation to the basic financial statements taken as a whole,
presents fairly in all material respects the information set forth therein.
 
                                          /s/  ERNST & YOUNG LLP
 
Atlanta, Georgia
January 15, 1999
 
                                      II-7
<PAGE>   110
 
                                                                     SCHEDULE II
 
[UPDATE]
 
                       VALUATION AND QUALIFYING ACCOUNTS
 
<TABLE>
<CAPTION>
                                           BALANCE AT
                                          BEGINNING OF                             BALANCE AT
                                              YEAR        PROVISION   WRITEOFFS   END OF YEAR
                                          -------------   ---------   ---------   ------------
<S>                                       <C>             <C>         <C>         <C>
1996
Allowance for Doubtful Accounts.........    $     --      $ 86,000    $  (7,000)    $ 79,000
                                            ========      ========    =========     ========
1997
Allowance for Doubtful Accounts.........    $ 79,000      $195,000    $ (19,000)    $255,000
                                            ========      ========    =========     ========
1998
Allowance for Doubtful Accounts.........    $255,000      $135,000    $(103,000)    $287,000
                                            ========      ========    =========     ========
</TABLE>

<PAGE>   1
DRAFT OF 1/28/99                                                     EXHIBIT 1.1




                                ISS GROUP, INC.

                                  COMMON STOCK
                          (PAR VALUE $0.001 PER SHARE)

                          ----------------------------
                            UNDERWRITING AGREEMENT
                                 (U.S. VERSION)

                          ----------------------------



                                                              February __, 1999

Goldman, Sachs & Co.,
Dain Rauscher Wessels, a division of Dain Rauscher Incorporated,
Warburg Dillon Read LLC, a subsidiary of UBS AG and
BancBoston Robertson Stephens Inc.
         As representatives of the several Underwriters
         named in Schedule I hereto,
c/o Goldman, Sachs & Co.
85 Broad Street
New York, New York 10004

Ladies and Gentlemen:

     ISS Group, Inc., a Delaware corporation (the "Company"), proposes, subject
to the terms and conditions stated herein, to issue and sell to the
Underwriters named in Schedule I hereto (the "Underwriters") an aggregate of
_________ shares and, at the election of the Underwriters, up to _______
additional shares of Common Stock (par value $0.001 per share) ("Stock") of the
Company and the stockholders of the Company named in Schedule II hereto (the
"Selling Stockholders") propose, subject to the terms and conditions stated
herein, to sell to the Underwriters an aggregate of _______ shares and, at the
election of the Underwriters, up to an additional ______ shares of Stock. The
aggregate of _________ shares to be sold by the Company and the Selling
Stockholders is herein called the "Firm Shares" and the aggregate of _______
additional shares to be sold by the Company and the Selling Stockholders is
herein called the "Optional Shares." The Firm Shares and the Optional Shares
that the Underwriters elect to purchase pursuant to Section 2 hereof are herein
collectively called the "Shares."

     It is understood and agreed to by all parties that the Company and the
Selling Stockholders are concurrently entering into an agreement (the
"International Underwriting Agreement") providing for the sale by the Company
and the Selling Stockholders of up to a total of ....... shares of Stock (the
"International Shares"), including the overallotment option thereunder, through
arrangements with certain underwriters outside the United States (the
"International Underwriters"), for whom Goldman Sachs International, Dain
Rauscher Wessels, a division of Dain Rauscher Incorporated, Warburg Dillon
Read, a division of UBS AG and BancBoston Robertson Stephens Inc. are acting as
lead managers.
<PAGE>   2

Anything herein or therein to the contrary notwithstanding, the respective
closings under this Agreement and the International Underwriting Agreement are
hereby expressly made conditional on one another. The Underwriters hereunder
and the International Underwriters are simultaneously entering into an
Agreement between U.S. and International Underwriting Syndicates (the
"Agreement between Syndicates") which provides, among other things, for the
transfer of shares of Stock between the two syndicates. Two forms of prospectus
are to be used in connection with the offering and sale of shares of Stock
contemplated by the foregoing, one relating to the Shares hereunder and the
other relating to the International Shares. The latter form of prospectus will
be identical to the former except for certain substitute pages as included in
the registration statement and amendments thereto as mentioned below. Except as
used in Sections 2, 3, 4, 9 and 11 herein, and except as the context may
otherwise require, references hereinafter to the Shares shall include all the
shares of Stock which may be sold pursuant to either this Agreement or the
International Underwriting Agreement, and references herein to any prospectus
whether in preliminary or final form, and whether as amended or supplemented,
shall include both the U.S. and the international versions thereof.

     1.  (a)      The Company and Internet Security Systems, Inc., a Georgia
corporation and the Company's wholly-owned subsidiary ("ISS"), jointly and
severally represent and warrant to, and agree with, each of the Underwriters
that:

            (i)     A registration statement on Form S-1 (File No. _________) 
         (the "Initial Registration Statement") in respect of the Shares has
         been filed with the Securities and Exchange Commission (the
         "Commission"); the Initial Registration Statement and any post
         effective amendment thereto, each in the form heretofore delivered to
         you, and, excluding exhibits thereto, to you for each of the other
         Underwriters, have been declared effective by the Commission in such
         form; other than a registration statement, if any, increasing the size
         of the offering (a "Rule 462(b) Registration Statement"), filed
         pursuant to Rule 462(b) under the Securities Act of 1933, as amended
         (the "Act"), which became effective upon filing, no other document
         with respect to the Initial Registration Statement has heretofore been
         filed with the Commission; no stop order suspending the effectiveness
         of the Initial Registration Statement, any post-effective amendment
         thereto or the Rule 462(b) Registration Statement, if any, has been
         issued and no proceeding for that purpose has been initiated or
         threatened by the Commission (any preliminary prospectus included in
         the Initial Registration Statement or filed with the Commission
         pursuant to Rule 424(a) of the rules and regulations of the Commission
         under the Act, is hereinafter called a "Preliminary Prospectus"; the
         various parts of the Initial Registration Statement, including all
         exhibits thereto and including the information contained in the form
         of final prospectus filed with the Commission pursuant to Rule 424(b)
         under the Act in accordance with Section 5(a) hereof and deemed by
         virtue of Rule 430A under the Act to be part of the Initial
         Registration Statement at the time it was declared effective or such
         parts of the Rule 462(b) Registration Statement, if any, became or
         hereafter becomes effective, each as amended at the time such part of
         the registration statement became effective, is hereinafter
         collectively called the "Registration Statement"; and such final
         prospectus, in the form first filed pursuant to Rule 424(b) under the
         Act, is hereinafter called the "Prospectus";

            (ii)    No order preventing or suspending the use of any 
         Preliminary Prospectus has been issued by the Commission, and each
         Preliminary Prospectus, at the time of filing thereof, conformed in
         all material respects to the requirements of the Act and the rules and
         regulations of the Commission thereunder, and did not contain an
         untrue statement of a material fact or omit to state a material fact
         required to be stated therein or necessary to make the statements



                                      -2-
<PAGE>   3

         therein, in the light of the circumstances under which they were made,
         not misleading; provided, however, that this representation and
         warranty shall not apply to any statements or omissions made in
         reliance upon and in conformity with information furnished in writing
         to the Company by an Underwriter through Goldman, Sachs & Co.
         expressly for use therein or by a Selling Stockholder expressly for
         use in the preparation of the answers therein to Items 7 and 11(m) of
         Form S-1;

            (iii)   The Registration Statement conforms, and the Prospectus and
         any further amendments or supplements to the Registration Statement or
         the Prospectus will conform, in all material respects to the
         requirements of the Act and the rules and regulations of the
         Commission thereunder and do not and will not, as of the applicable
         effective date as to the Registration Statement and any amendment
         thereto, and as of the applicable filing date as to the Prospectus and
         any amendment or supplement thereto, contain an untrue statement of a
         material fact or omit to state a material fact required to be stated
         therein or necessary to make the statements therein not misleading;
         provided, however, that this representation and warranty shall not
         apply to any statements or omissions made in reliance upon and in
         conformity with information furnished in writing to the Company by an
         Underwriter through Goldman, Sachs & Co. expressly for use therein or
         by a Selling Stockholder expressly for use in the preparation of the
         answers therein to Items 7 and 11(m) of Form S-1;

            (iv)    Neither the Company nor any of its subsidiaries has
         sustained since the date of the latest audited financial statements
         included in the Prospectus any material loss or interference with its
         business from fire, explosion, flood or other calamity, whether or not
         covered by insurance, or from any labor dispute or court or
         governmental action, order or decree, otherwise than as set forth or
         contemplated in the Prospectus; and, since the respective dates as of
         which information is given in the Registration Statement and the
         Prospectus, there has not been any change in the capital stock (other
         than pursuant to the grant or exercise of options described in the
         Prospectus) or long-term debt of the Company or any of its
         subsidiaries or any material adverse change, or any development that
         is reasonably likely to result in a material adverse change, in or
         affecting the general affairs, management, financial position,
         stockholders' equity or results of operations of the Company and its
         subsidiaries, otherwise than as set forth or contemplated in the
         Prospectus;

            (v)     The Company and its subsidiaries have good and marketable
         title in fee simple to all real property and good and marketable title
         to all personal property owned by them, in each case free and clear of
         all liens, encumbrances and defects except such as are described in
         the Prospectus or such as are not material to the Company and its
         subsidiaries; and any real property and buildings held under lease by
         the Company and its subsidiaries are held by them under valid,
         subsisting and enforceable leases with such exceptions as are not
         material to the Company and its subsidiaries;

            (vi)    The Company has been duly incorporated and is validly 
         existing as a corporation in good standing under the laws of the State
         of Delaware, with power and authority (corporate and other) to own its
         properties and conduct its business as described in the Prospectus,
         and has been duly qualified as a foreign corporation for the
         transaction of business and is in good standing under the laws of each
         other jurisdiction in which it owns or leases properties or conducts
         any business so as to require such qualification, or is subject to no
         material liability or disability by reason of the failure to be so
         qualified in any such jurisdiction; and each



                                      -3-
<PAGE>   4

         subsidiary of the Company has been duly incorporated and is validly
         existing as a corporation in good standing under the laws of its
         jurisdiction of incorporation;

            (vii)   The Company has an authorized capitalization as set forth
         in the Prospectus, and all of the issued shares of capital stock of
         the Company have been duly and validly authorized and issued, are
         fully paid and non-assessable and conform to the description of the
         Stock contained in the Prospectus; and all of the issued shares of
         capital stock of each subsidiary of the Company have been duly and
         validly authorized and issued, are fully paid and non-assessable and
         (except for directors' qualifying shares) are owned directly or
         indirectly by the Company, free and clear of all liens, encumbrances,
         equities or claims;

            (viii)  The unissued Shares to be issued and sold by the Company to
         the Underwriters hereunder and under the International Underwriting
         Agreement have been duly and validly authorized and, when issued and
         delivered against payment therefor as provided herein, will be duly
         and validly issued and fully paid and non-assessable and will conform
         to the description of the Stock contained in the Prospectus;

            (ix)    The issue and sale of the Shares to be sold by the Company
         hereunder and under the International Underwriting Agreement and the
         compliance by the Company with all of the provisions of this Agreement
         and the International Underwriting Agreement and the consummation of
         the transactions herein and therein contemplated will not conflict
         with or result in a breach or violation of any of the terms or
         provisions of, or constitute a default under, any indenture, mortgage,
         deed of trust, loan agreement or other agreement or instrument to
         which the Company or any of its subsidiaries is a party or by which
         the Company or any of its subsidiaries is bound or to which any of the
         property or assets of the Company or any of its subsidiaries is
         subject, other than breaches or defaults that are not, individually or
         in the aggregate, reasonably likely to have a material adverse effect
         on the Company and its subsidiaries considered as one enterprise, nor
         will such action result in any violation of the provisions of the
         Certificate of Incorporation or By-laws of the Company or any statute
         or any order, rule or regulation of any court or governmental agency
         or body having jurisdiction over the Company or any of its
         subsidiaries or any of their properties; and no consent, approval,
         authorization, order, registration or qualification of or with any
         such court or governmental agency or body is required for the issue
         and sale of the Shares or the consummation by the Company of the
         transactions contemplated by this Agreement and the International
         Underwriting Agreement, except the registration under the Act of the
         Shares and such consents, approvals, authorizations, registrations or
         qualifications as may be required under state or foreign securities or
         Blue Sky laws in connection with the purchase and distribution of the
         Shares by the Underwriters and the International Underwriters;

            (x)     Neither the Company nor any of its subsidiaries is in
         violation of its Certificate of Incorporation or By-laws or in default
         in the performance or observance of any material obligation,
         agreement, covenant or condition contained in any indenture, mortgage,
         deed of trust, loan agreement, lease or other agreement or instrument
         to which it is a party or by which it or any of its properties may be
         bound;

            (xi)    The statements set forth in the Prospectus under the
         caption "Description of Capital Stock", insofar as they purport to
         constitute a summary of the terms of the Stock, under the caption
         "Certain U.S. Tax Considerations Applicable to Non-U.S. Holders of the
         Common



                                      -4-
<PAGE>   5

         Stock", and under the caption "Underwriting", insofar as they purport
         to describe the provisions of the laws and documents referred to
         therein, are accurate, complete and fair;

            (xii)   Other than as set forth in the Prospectus, there are no
         legal or governmental proceedings pending to which the Company or any
         of its subsidiaries is a party or of which any property of the Company
         or any of its subsidiaries is the subject which, if determined
         adversely to the Company or any of its subsidiaries, would
         individually or in the aggregate have a material adverse effect on the
         current or future consolidated financial position, stockholders'
         equity or results of operations of the Company and its subsidiaries;
         and, to the Company's knowledge, no such proceedings are threatened or
         contemplated by governmental authorities or threatened by others;

            (xiii)  Other than as set forth in the Prospectus, the Company and
         its subsidiaries own or have the right to use pursuant to license,
         sublicense, agreement, or permission all patents, patent applications,
         trademarks, service marks, trade names, copyrights, trade secrets,
         confidential information, proprietary rights and processes
         ("Intellectual Property") necessary for the operation of the business
         of the Company and its subsidiaries as presently conducted and as
         presently proposed to be conducted as described in the Prospectus and
         have taken all steps reasonably necessary to secure assignments of
         such Intellectual Property from its employees and contractors; none of
         the technology employed by the Company or its subsidiaries has been
         obtained or is being used by the Company or its subsidiaries in
         violation of any contractual or fiduciary obligation binding on the
         Company, its subsidiaries or any of their respective directors or
         executive officers or, to the Company's knowledge, any of their
         respective employees or consultants; and the Company and its
         subsidiaries have taken and will maintain reasonable measures to
         prevent the unauthorized dissemination or publication of its
         confidential information.

              To the Company's knowledge, neither the Company nor any of its
         subsidiaries have interfered with, infringed upon, misappropriated, or
         otherwise come into conflict with any Intellectual Property rights of
         third parties, and there has never been any charge, complaint, claim,
         demand, or notice alleging any such interference, infringement,
         misappropriation, or violation (including any claim that the Company
         or any of its subsidiaries must license or refrain from using any
         intellectual property rights of any third party) which, if the subject
         of any unfavorable decision, ruling or finding would, individually or
         in the aggregate, have a material adverse effect on the current or
         future consolidated financial position, stockholders' equity or
         results of operations of the Company and its subsidiaries;

            (xiv)   The Company is not and, after giving effect to the offering
         and sale of the Shares, will not be an "investment company" or an
         entity "controlled" by an "investment company", as such terms are
         defined in the Investment Company Act of 1940, as amended (the
         "Investment Company Act");

            (xv)    Neither the Company nor any of its affiliates does business
         with the government of Cuba or with any person or affiliate located in
         Cuba within the meaning of Section 517.075, Florida Statutes;

            (xvi)   To the Company's knowledge, Ernst & Young LLP, who have
         certified certain financial statements of the Company and its
         subsidiaries, are independent public accountants as required by the
         Act and the rules and regulations of the Commission thereunder;



                                      -5-
<PAGE>   6

             (xvii)  The Company has reviewed its operations and that of its
         subsidiaries and any third parties with which the Company or any of
         its subsidiaries has a material relationship to evaluate the extent to
         which the business or operations of the Company or any of its
         subsidiaries will be affected by the Year 2000 Problem. As a result of
         such review, the Company has no reason to believe, and does not
         believe, that the Year 2000 Problem will have a material adverse
         effect on the general affairs, management, the current or future
         consolidated financial position, business prospects, stockholders'
         equity or results of operations of the Company and its subsidiaries or
         result in any material loss or interference with the Company's
         business or operations. The "Year 2000 Problem" as used herein means
         any significant risk that computer hardware or software used in the
         receipt, transmission, processing, manipulation, storage, retrieval,
         retransmission or other utilization of data or in the operation of
         mechanical or electrical systems of any kind will not, in the case of
         dates or time periods occurring after December 31, 1999, function at
         least as effectively as in the case of dates or time periods occurring
         prior to January 1, 2000; and

             (xviii) The Company has filed all reports it has been required to
         file under the Securities Exchange Act of 1934, as amended, and the
         rules and regulations of the Commission thereunder (the "Exchange
         Act"); such reports when filed conformed in all material respects to
         the requirements of the Exchange Act; and none of such reports
         contained an untrue statement of a material fact or omitted to state a
         material fact required to be stated therein to make the statements
         therein, in light of the circumstances under which they were made, not
         misleading.

         (b) Each of the Selling Stockholders severally represents and warrants
to, and agrees with, each of the Underwriters and the Company that:

             (i)     All consents, approvals, authorizations and orders
         necessary for the execution and delivery by such Selling Stockholder
         of this Agreement, the International Underwriting Agreement and the
         Power of Attorney and the Custody Agreement hereinafter referred to,
         and for the sale and delivery of the Shares to be sold by such Selling
         Stockholder hereunder and under the International Underwriting
         Agreement, have been obtained; and such Selling Stockholder has full
         right, power and authority to enter into this Agreement, the
         International Underwriting Agreement, the Power of Attorney and the
         Custody Agreement and to sell, assign, transfer and deliver the Shares
         to be sold by such Selling Stockholder hereunder and under the
         International Underwriting Agreement;

             (ii)    The sale of the Shares to be sold by such Selling
         Stockholder hereunder and under the International Underwriting
         Agreement and the compliance by such Selling Stockholder with all of
         the provisions of this Agreement, the International Underwriting
         Agreement, the Power of Attorney and the Custody Agreement and the
         consummation of the transactions herein and therein contemplated will
         not conflict with or result in a breach or violation of any of the
         terms or provisions of, or constitute a default under, any statute,
         indenture, mortgage, deed of trust, loan agreement or other agreement
         or instrument to which such Selling Stockholder is a party or by which
         such Selling Stockholder is bound or to which any of the property or
         assets of such Selling Stockholder is subject, nor will such action
         result in any violation of the provisions of any statute or any order,
         rule or regulation of any court or governmental agency or body having
         jurisdiction over such Selling Stockholder or the property of such
         Selling Stockholder;

             (iii)   Such Selling Stockholder has, and immediately prior to
         each Time of Delivery (as defined in Section 4 hereof) such Selling
         Stockholder will have, good and valid title to the



                                      -6-
<PAGE>   7

         Shares to be sold by such Selling Stockholder hereunder and under the
         International Underwriting Agreement, free and clear of all liens,
         encumbrances, equities or claims; and, upon delivery of such Shares
         and payment therefor pursuant hereto and thereto, good and valid title
         to such Shares, free and clear of all liens, encumbrances, equities or
         claims, will pass to the several Underwriters and the International
         Underwriters, as the case may be;

            (iv)    During the period beginning from the date hereof and
         continuing to and including the date 90 days after the date of the
         Prospectus, such Selling Stockholder will not, without your prior
         written consent (A) offer, sell, contract to sell or otherwise dispose
         of, except as provided hereunder or under the International
         Underwriting Agreement, any securities of the Company that are
         substantially similar to the Shares, including but not limited to any
         securities that are convertible into or exchangeable for, or that
         represent the right to receive, Stock or any such substantially
         similar securities (other than pursuant to employee stock option plans
         existing on, or upon the conversion or exchange of convertible or
         exchangeable securities outstanding as of, the date of this Agreement)
         or (B) not to engage directly or indirectly in any transaction the
         likely result of which would involve a transaction prohibited by
         subclause (A) of this clause (iv); provided, that notwithstanding the
         foregoing, (x) if such Selling Stockholder is an individual, he or she
         may transfer shares of Stock either during his or her lifetime or on
         death by gift, will or intestacy to his or her immediate family or to
         a trust the beneficiaries of which are exclusively such Selling
         Stockholder and/or members of his or her immediate family; and (y) if
         such Selling Stockholder is a trust, the trust may transfer shares of
         Stock to any beneficiary of such trust as of the date of this
         Agreement or to the estate of any such beneficiary, and any
         beneficiary who is an individual may transfer any such shares of Stock
         by gift, will or intestacy to his or her members of his or her
         immediate family, provided, however, that in any such described in
         clauses (x) and/or (y), it shall be a condition to the transfer that
         the transferee execute an agreement stating that the transferee is
         receiving and holding the shares of Stock so transferred subject to
         the provisions of this Section (1)(b)(iv), and there shall be no
         further transfer of such shares of Stock except in accordance with the
         provisions of this Section 1(b)(b)(iv), and that for the purposes of
         the foregoing, "immediate family" shall mean spouse, lineal
         descendant, father, mother, brother or sister of the transferor;

            (v)     Such Selling Stockholder has not taken and will not take,
         directly or indirectly, any action which is designed to or which has
         constituted or which might reasonably be expected to cause or result
         in stabilization or manipulation of the price of any security of the
         Company to facilitate the sale or resale of the Shares;

            (vi)    To the extent that any statements or omissions made in the
         Registration Statement, any Preliminary Prospectus, the Prospectus or
         any amendment or supplement thereto are made in reliance upon and in
         conformity with written information furnished to the Company by such
         Selling Stockholder expressly for use therein, such Preliminary
         Prospectus and the Registration Statement did, and the Prospectus and
         any further amendments or supplements to the Registration Statement
         and the Prospectus, when they become effective or are filed with the
         Commission, as the case may be, will conform in all material respects
         to the requirements of the Act and the rules and regulations of the
         Commission thereunder and will not contain any untrue statement of a
         material fact or omit to state any material fact required to be stated
         therein or necessary to make the statements therein not misleading;

            (vii)   In order to document the Underwriters' compliance with the
         reporting and withholding provisions of the Tax Equity and Fiscal
         Responsibility Act of 1982 with respect to the



                                      -7-
<PAGE>   8

         transactions herein contemplated, such Selling Stockholder will
         deliver to you prior to or at the First Time of Delivery (as
         hereinafter defined) a properly completed and executed United States
         Treasury Department Form W-9 (or other applicable form or statement
         specified by Treasury Department regulations in lieu thereof);

            (viii)  Certificates in negotiable form representing all of the
         Shares to be sold by such Selling Stockholder hereunder and under the
         International Underwriting Agreement have been placed in custody under
         a Custody Agreement, in the form heretofore furnished to you (the
         "Custody Agreement"), duly executed and delivered by such Selling
         Stockholder to ISS Group, Inc., as custodian (the "Custodian"), and
         such Selling Stockholder has duly executed and delivered a Power of
         Attorney, in the form heretofore furnished to you (the "Power of
         Attorney"), appointing the persons indicated in Schedule II hereto,
         and each of them, as such Selling Stockholder's attorneys-in-fact (the
         "Attorneys-in-Fact") with authority to execute and deliver this
         Agreement and the International Underwriting Agreement on behalf of
         such Selling Stockholder, to determine the purchase price to be paid
         by the Underwriters and the International Underwriters to the Selling
         Stockholders as provided in Section 2 hereof, to authorize the
         delivery of the Shares to be sold by such Selling Stockholder
         hereunder and otherwise to act on behalf of such Selling Stockholder
         in connection with the transactions contemplated by this Agreement,
         the International Underwriting Agreement and the Custody Agreement;
         and

            (ix)    The Shares represented by the certificates held in custody
         for such Selling Stockholder under the Custody Agreement, as a result
         of the obligations of such Selling Stockholder under this Agreement,
         are subject to the interests of the Underwriters hereunder and the
         International Underwriters under the International Underwriting
         Agreement; the arrangements made by such Selling Stockholder for such
         custody, and the appointment by such Selling Stockholder of the
         Attorneys-in-Fact by the Power of Attorney, are to that extent
         irrevocable; the obligations of the Selling Stockholders hereunder
         shall not be terminated by operation of law, whether by the death or
         incapacity of any individual Selling Stockholder or, in the case of an
         estate or trust, by the death or incapacity of any executor or trustee
         or the termination of such estate or trust, or in the case of a
         partnership or corporation, by the dissolution of such partnership or
         corporation, or by the occurrence of any other event; if any
         individual Selling Stockholder or any such executor or trustee should
         die or become incapacitated, or if any such estate or trust should be
         terminated, or if any such partnership or corporation should be
         dissolved, or if any other such event should occur, before the
         delivery of the Shares hereunder, certificates representing the Shares
         shall be delivered by or on behalf of the Selling Stockholders in
         accordance with the terms and conditions of this Agreement, of the
         International Underwriting Agreement and of the Custody Agreements;
         and actions taken by the Attorneys-in-Fact pursuant to the Powers of
         Attorney shall be as valid as if such death, incapacity, termination,
         dissolution or other event had not occurred, regardless of whether or
         not the Custodian, the Attorneys-in-Fact, or any of them, shall have
         received notice of such death, incapacity, termination, dissolution or
         other event.

     2.  Subject to the terms and conditions herein set forth, (a) the Company
and each of the Selling Stockholders agree, severally and not jointly, to sell
to each of the Underwriters, and each of the Underwriters agrees, severally and
not jointly, to purchase from the Company and each of the Selling Stockholders,
at a purchase price per share of $_____, the number of Firm Shares (to be
adjusted by you so as to eliminate fractional shares) determined by multiplying
the aggregate number of Firm Shares to be sold by the Company and each of the
Selling Stockholders as set forth opposite their



                                      -8-
<PAGE>   9

respective names in Schedule II hereto by a fraction, the numerator of which is
the aggregate number of Firm Shares to be purchased by such Underwriter as set
forth opposite the name of such Underwriter in Schedule I hereto and the
denominator of which is the aggregate number of Firm Shares to be purchased by
all of the Underwriters from the Company and all of the Selling Stockholders
hereunder and (b) in the event and to the extent that the Underwriters shall
exercise the election to purchase Optional Shares as provided below, the
Company agrees to issue and sell and each of the Selling Stockholders agrees to
sell to each of the Underwriters, and each of the Underwriters agrees,
severally and not jointly, to purchase from the Company and each of the Selling
Stockholders, at the purchase price per share set forth in clause (a) of this
Section 2, that portion of the number of Optional Shares as to which such
election shall have been exercised (to be adjusted by you so as to eliminate
fractional shares) determined by multiplying such number of Optional Shares by
a fraction, the numerator of which is the maximum number of Optional Shares
which such Underwriter is entitled to purchase as set forth opposite the name
of such Underwriter in Schedule I hereto and the denominator of which is the
maximum number of Optional Shares that all of the Underwriters are entitled to
purchase hereunder.

         The Company and the Selling Stockholders, as and to the extent
indicated in Schedule II hereto, hereby grant, severally and not jointly, to
the Underwriters the right to purchase at their election up to _______ Optional
Shares, at the purchase price per share set forth in the paragraph above, for
the sole purpose of covering overallotments in the sale of the Firm Shares. Any
such election to purchase Optional Shares shall be made in proportion to the
maximum number of Optional Shares to be sold by the Company and each Selling
Stockholder as set forth in Schedule II hereto initially with respect to the
Optional Shares to be sold by the Company and then among the Selling
Stockholders in proportion to the maximum number of Optional Shares to be sold
by each Selling Stockholder as set forth in Schedule II hereto. Any such
election to purchase Optional Shares may be exercised only by written notice
from you to the Company and the Attorneys-in-Fact, given within a period of 30
calendar days after the date of this Agreement and setting forth the aggregate
number of Optional Shares to be purchased and the date on which such Optional
Shares are to be delivered, as determined by you but in no event earlier than
the First Time of Delivery (as defined in Section 4 hereof) or, unless you and
the Company and the Attorneys-in-Fact otherwise agree in writing, earlier than
two or later than ten business days after the date of such notice.

     3.  Upon the authorization by you of the release of the Firm Shares, the
several Underwriters propose to offer the Firm Shares for sale upon the terms
and conditions set forth in the Prospectus.

     4.    (a) The Shares to be purchased by each Underwriter hereunder, in
definitive form, and in such authorized denominations and registered in such
names as Goldman, Sachs & Co. may request upon at least forty-eight hours' prior
notice to the Company and the Selling Stockholders shall be delivered by or on
behalf of the Company and the Selling Stockholders to Goldman, Sachs & Co.,
through the facilities of the Depository Trust Company ("DTC"), for the account
of such Underwriter, against payment by or on behalf of such Underwriter of the
purchase price therefor by wire transfer to an account designated by the Company
and each Selling Stockholder in Federal (same day) funds. The Company and each
Selling Stockholder will cause the certificates representing the Shares to be
made available for checking and packaging at least twenty-four hours prior to
the Time of Delivery (as defined below) with respect thereto at the office of
DTC or its designated custodian (the "Designated Office"). The time and date of
such delivery and payment shall be, with respect to the Firm Shares, 9:30 a.m.,
New York City time, on ________, 1999 or such other time and date as Goldman,
Sachs & Co., the Company may agree upon in writing, and, with respect to the
Optional Shares, 9:30 a.m., 



                                      -9-
<PAGE>   10
New York time, on the date specified by Goldman, Sachs & Co. in the written
notice given by Goldman, Sachs & Co. of the Underwriters' election to purchase
such Optional Shares, or such other time and date as Goldman, Sachs & Co., the
Company and the Selling Stockholders may agree upon in writing. Such time and
date for delivery of the Firm Shares is herein called the "First Time of
Delivery", such time and date for delivery of the Optional Shares, if not the
First Time of Delivery, is herein called the "Second Time of Delivery", and each
such time and date for delivery is herein called a "Time of Delivery".

           (b) The documents to be delivered at each Time of Delivery by or 
on behalf of the parties hereto pursuant to Section 7 hereof, including the
cross receipt for the Shares and any additional documents requested by the
Underwriters pursuant to Section 7(i) hereof, will be delivered at the offices
of Brobeck, Phleger & Harrison, LLP, 1633 Broadway, New York, New York 10019
(the "Closing Location"), and the Shares will be delivered at the Designated
Office, all at such Time of Delivery. A meeting will be held at the Closing
Location at 3:00 p.m., New York City time, on the New York Business Day next
preceding such Time of Delivery, at which meeting the final drafts of the
documents to be delivered pursuant to the preceding sentence will be available
for review by the parties hereto. For the purposes of this Section 4, "New York
Business Day" shall mean each Monday, Tuesday, Wednesday, Thursday and Friday
which is not a day on which banking institutions in New York are generally
authorized or obligated by law or executive order to close.

     5.    The Company and ISS jointly and severally agree with each of the
Underwriters:

           (a) To prepare the Prospectus in a form approved by you and to file
such Prospectus pursuant to Rule 424(b) under the Act not later than the
Commission's close of business on the second business day following the
execution and delivery of this Agreement, or, if applicable, such earlier time
as may be required by Rule 430A(a)(3) under the Act; to make no further
amendment or any supplement to the Registration Statement or Prospectus which
shall be disapproved by you promptly after reasonable notice thereof; to advise
you, promptly after it receives notice thereof, of the time when any amendment
to the Registration Statement has been filed or becomes effective or any
supplement to the Prospectus or any amended Prospectus has been filed and to
furnish you with copies thereof; to advise you, promptly after it receives
notice thereof, of the issuance by the Commission of any stop order or of any
order preventing or suspending the use of any Preliminary Prospectus or
prospectus, of the suspension of the qualification of the Shares for offering
or sale in any jurisdiction, of the initiation or threatening of any proceeding
for any such purpose, or of any request by the Commission for the amending or
supplementing of the Registration Statement or Prospectus or for additional
information; and, in the event of the issuance of any stop order or of any
order preventing or suspending the use of any Preliminary Prospectus or
prospectus or suspending any such qualification, promptly to use its best
efforts to obtain the withdrawal of such order;

           (b) Promptly from time to time to take such action as you may
reasonably request to qualify the Shares for offering and sale under the
securities laws of such jurisdictions as you may request and to comply with
such laws so as to permit the continuance of sales and dealings therein in such
jurisdictions for as long as may be necessary to complete the distribution of
the Shares, provided that in connection therewith the Company shall not be
required to qualify as a foreign corporation or to file a general consent to
service of process in any jurisdiction;

           (c) Prior to 10:00 a.m., New York City time on the New York Business
Day next succeeding the date of this Agreement and from time to time, to
furnish the Underwriters with copies of the Prospectus in New York City in such
quantities as you may reasonably request, and, if the



                                     -10-
<PAGE>   11

delivery of a prospectus is required at any time prior to the expiration of
nine months after the time of issue of the Prospectus in connection with the
offering or sale of the Shares and if at such time any event shall have
occurred as a result of which the Prospectus as then amended or supplemented
would include an untrue statement of a material fact or omit to state any
material fact necessary in order to make the statements therein, in the light
of the circumstances under which they were made when such Prospectus is
delivered, not misleading, or, if for any other reason it shall be necessary
during such period to amend or supplement the Prospectus in order to comply
with the Act, to notify you and upon your request to prepare and furnish
without charge to each Underwriter and to any dealer in securities as many
copies as you may from time to time reasonably request of an amended Prospectus
or a supplement to the Prospectus which will correct such statement or omission
or effect such compliance, and in case any Underwriter is required to deliver a
prospectus in connection with sales of any of the Shares at any time nine
months or more after the time of issue of the Prospectus, upon your request but
at the expense of such Underwriter, to prepare and deliver to such Underwriter
as many copies as you may request of an amended or supplemented Prospectus
complying with Section 10(a)(3) of the Act;

           (d) To make generally available to the Company's security holders as
soon as practicable, but in any event not later than eighteen months after the
effective date of the Registration Statement (as defined in Rule 158(c) under
the Act), an earnings statement of the Company and its subsidiaries (which need
not be audited) complying with Section 11(a) of the Act and the rules and
regulations thereunder (including, at the option of the Company, Rule 158);

           (e) During the period beginning from the date hereof and continuing
to and including the date 90 days after the date of the Prospectus, not to (i)
offer, sell, contract to sell or otherwise dispose of, except as provided
hereunder and under the International Underwriting Agreement, any securities of
the Company that are substantially similar to the Shares, including but not
limited to any securities that are convertible into or exchangeable for, or
that represent the right to receive, Stock or any such substantially similar
securities (other than pursuant to employee stock option plans existing on, or
upon the conversion or exchange of convertible or exchangeable securities
outstanding as of, the date of this Agreement) or (ii) engage directly or
indirectly in any transaction the likely result of which would involve a
transaction prohibited by clause (i) of this section 5(e), without your prior
written consent;

           (f) To furnish to the Company's stockholders as soon as practicable
after the end of each fiscal year an annual report (including a balance sheet
and statements of income, stockholders' equity and cash flows of the Company
and its consolidated subsidiaries certified by independent public accountants);

           (g) During a period of five years from the effective date of the 
Registration Statement, to furnish to you copies of all reports or other
communications (financial or other) furnished to the Company's stockholders,
and to deliver to you (i) as soon as they are available, copies of any reports
and financial statements furnished to or filed with the Commission or any
national securities exchange on which any class of securities of the Company is
listed; and (ii) such additional information concerning the business and
financial condition of the Company as you may from time to time reasonably
request (such financial statements to be on a consolidated basis to the extent
the accounts of the Company and its subsidiaries are consolidated in reports
furnished to its stockholders generally or to the Commission);



                                     -11-
<PAGE>   12

           (h) To use the net proceeds received by the Company from the sale of
the Shares pursuant to this Agreement and the International Underwriting
Agreement in the manner specified in the Prospectus under the caption "Use of
Proceeds";

           (i) To use its best efforts to list for quotation the Shares on the
National Association of Securities Dealers Automated Quotations National Market
System ("NASDAQ"); and

           (j) If the Company elects to rely upon Rule 462(b), the Company 
shall file a Rule 462(b) Registration Statement with the Commission in
compliance with Rule 462(b) by 10:00 P.M., Washington, D.C. time, on the date
of this Agreement, and the Company shall at the time of filing either pay to
the Commission the filing fee for the Rule 462(b) Registration Statement or
give irrevocable instructions for the payments of such fee pursuant to Rule
111(b) under the Act.

     6.    The Company and each of the Selling Stockholders covenant and agree
with one another and with the several Underwriters that (a) the Company will
pay or cause to be paid the following: (i) the fees, disbursements and expenses
of the Company's counsel and accountants in connection with the registration of
the Shares under the Act and all other expenses in connection with the
preparation, printing and filing of the Registration Statement, any Preliminary
Prospectus and the Prospectus and amendments and supplements thereto and the
mailing and delivering of copies thereof to the Underwriters and dealers; (ii)
the cost of printing or producing any Agreement among Underwriters, this
Agreement, the International Underwriting Agreement, the Agreement between
Syndicates, the Selling Agreements, the Blue Sky Memorandum, closing documents
(including any compilations thereof) and any other documents in connection with
the offering, purchase, sale and delivery of the Shares; (iii) all expenses in
connection with the qualification of the Shares for offering and sale under
state securities laws as provided in Section 5(b) hereof, including the fees
and disbursements of counsel for the Underwriters in connection with such
qualification and in connection with the Blue Sky survey (iv) all fees and
expenses in connection with listing the Shares on the NASDAQ; (iv) the filing
fees incident to, and up to $5,000 of the fees and disbursements of counsel for
the Underwriters in connection with, securing any required review by the
National Association of Securities Dealers, Inc. of the terms of the sale of
the Shares; (v) the cost of preparing stock certificates; (vi) the costs and
charges of any transfer agent or registrar; and (vii) all other costs and
expenses incident to the performance of its obligations hereunder which are not
otherwise specifically provided for in this Section; and (b) such Selling
Stockholder will pay or cause to be paid all costs and expenses incident to the
performance of such Selling Stockholder's obligations hereunder which are not
otherwise specifically provided for in this Section, including (i) any fees and
expenses of counsel for such Selling Stockholder, (ii) the Selling
Stockholder's pro rata share of fees and expenses of the Attorneys-in-Fact and
the Custodian, and (iii) all expenses and taxes incident to the sale and
delivery of the Shares to be sold by such Selling Stockholders to the
Underwriters hereunder. In connection with clause (b) (iii) of the preceding
sentence, Goldman, Sachs & Co. agrees to pay New York State stock transfer tax,
and the Selling Stockholders agree to reimburse Goldman, Sachs & Co. for
associated carrying costs if such tax payment is not rebated on the day of
payment and for any portion of such tax payment not rebated. It is understood,
however, that the Company shall bear, and the Selling Stockholders shall not be
required to pay or to reimburse the Company for, the cost of any other matters
not directly relating to the sale and purchase of the Shares pursuant to this
Agreement, and that, except as provided in this Section, and Sections 8 and 11
hereof, the Underwriters will pay all of their own costs and expenses,
including the fees of their counsel, stock transfer taxes on resale of any of
the Shares by them, and any advertising expenses connected with any offers they
may make.



                                     -12-
<PAGE>   13

     7.    The obligations of the Underwriters hereunder, as to the Shares to
be delivered at each Time of Delivery, shall be subject, in their discretion,
to the condition that all representations and warranties and other statements
of the Company and of the Selling Stockholders herein are, at and as of such
Time of Delivery, true and correct, the condition that the Company and the
Selling Stockholders shall have performed all of its and their obligations
hereunder theretofore to be performed, and the following additional conditions:

                  (a) The Prospectus shall have been filed with the Commission
pursuant to Rule 424(b) within the applicable time period prescribed for such
filing by the rules and regulations under the Act and in accordance with
Section 5(a) hereof; if the Company has elected to rely upon Rule 462(b), the
Rule 462(b) Registration Statement shall have become effective by 10:00 p.m.,
Washington, D.C. time, on the date of this Agreement; no stop order suspending
the effectiveness of the Registration Statement or any part thereof shall have
been issued and no proceeding for that purpose shall have been initiated or
threatened by the Commission; and all requests for additional information on
the part of the Commission shall have been complied with to your reasonable
satisfaction;

                  (b) Ropes & Gray, counsel for the Underwriters, shall have
furnished to you such opinion or opinions (a draft of such opinion is attached
as Annex II(a) hereto), dated such Time of Delivery, with respect to the
matters covered in paragraphs (i), (ii), (vi), (x) and (xiii) of subsection (c)
below as well as such other related matters as you may reasonably request, and
such counsel shall have received such papers and information as they may
reasonably request to enable them to pass upon such matters;

                  (c) Brobeck, Phleger & Harrison LLP, counsel for the Company,
shall have furnished to you their written opinion (a draft of such opinion is
attached as Annex II(B) hereto), dated such Time of Delivery, in form and
substance satisfactory to you, to the effect that:

                      (i)    The Company has been duly incorporated and is
                  validly existing as a corporation in good standing under the
                  laws of the State of Delaware, with power and authority
                  (corporate and other) to own its properties and conduct its
                  business as described in the Registration Statement and
                  Prospectus;

                      (ii)   The Company has an authorized capitalization as
                  set forth in the Prospectus, and all of the issued shares of
                  capital stock of the Company (including the Shares being
                  delivered at such Time of Delivery) have been duly and
                  validly authorized and issued and are fully paid and
                  non-assessable; and the Shares conform in all material
                  respects to the description of the Stock contained in the
                  Registration Statement and Prospectus;

                      (iii)  Each of the Company and ISS has been duly
                  qualified as a foreign corporation for the transaction of
                  business and is in good standing under the laws of the State
                  of Georgia (as to the Company only) and each other
                  jurisdiction in which it owns or leases properties or to such
                  counsel's knowledge conducts any business so as to require
                  such qualification, except where the failure to be so
                  qualified or in good standing would not have a material
                  adverse effect on the Company and its subsidiaries considered
                  as one enterprise, or is subject to no material liability or
                  disability by reason of failure to be so qualified in any
                  such jurisdiction (such counsel being entitled to rely in
                  respect of the opinion in this clause upon opinions of local
                  counsel and in respect of matters of fact upon certificates
                  of officers of the Company,



                                     -13-
<PAGE>   14

                  provided that such counsel shall state that they believe that
                  both you and they are justified in relying upon such opinions
                  and certificates);

                      (iv)   Each subsidiary of the Company has been duly
                  incorporated and is validly existing as a corporation in good
                  standing under the laws of its jurisdiction of incorporation;
                  and all of the issued shares of capital stock of each such
                  subsidiary have been duly and validly authorized and issued,
                  are fully paid and non-assessable, and (except for directors'
                  qualifying shares and except as otherwise set forth in the
                  Prospectus) are owned directly or indirectly by the Company,
                  free and clear of all liens, encumbrances, equities or claims
                  (such counsel being entitled to rely in respect of the
                  opinion in this clause upon opinions of local counsel and in
                  respect to matters of fact upon certificates of officers of
                  the Company or its subsidiaries, provided that such counsel
                  shall state that they believe that both you and they are
                  justified in relying upon such opinions and certificates);

                      (v)    To the best of such counsel's knowledge and other
                  than as set forth in the Prospectus, there are no legal or
                  governmental proceedings pending to which the Company or any
                  of its subsidiaries is a party or of which any property of
                  the Company or any of its subsidiaries is the subject that is
                  required to be described in the Registration Statement or
                  Prospectus and is not so described and, to such counsel's
                  knowledge, no such proceedings are threatened or contemplated
                  by governmental authorities or threatened by others;

                      (vi)   This Agreement and the International Underwriting
                  Agreement have been duly authorized, executed and delivered
                  by the Company;

                      (vii)  The issue and sale of the Shares being delivered
                  at such Time of Delivery to be sold by the Company and the
                  compliance by the Company with all of the provisions of this
                  Agreement and the International Underwriting Agreement and
                  the consummation of the transactions herein contemplated will
                  not conflict with or result in a breach or violation of any
                  of the terms or provisions of, or constitute a default under,
                  any indenture, mortgage, deed of trust, loan agreement or
                  other agreement or instrument which is filed as an exhibit
                  to, or referred to, in the Registration Statement (in giving
                  the opinion in this clause counsel may attach to such opinion
                  a list of the foregoing agreements and instruments), nor will
                  such action result in any violation of the provisions of the
                  Certificate of Incorporation or By-laws of the Company or any
                  statute or any order, rule or regulation known to such
                  counsel of any court or governmental agency or body having
                  jurisdiction over the Company or any of its subsidiaries or
                  any of their properties (other than the clearance of the
                  underwriting arrangements with the NASD, Blue Sky or state
                  securities laws matters in connection with the purchase and
                  distribution of the Shares by the Underwriters);

                      (viii) No consent, approval, authorization, order,
                  registration or qualification of or with any such court or
                  governmental agency or body is required for the issue and
                  sale of the Shares or the consummation by the Company of the
                  transactions contemplated by this Agreement and the
                  International Underwriting Agreement, except the registration
                  under the Act of the Shares, and such consents, approvals,
                  authorizations, registrations or qualifications as may be
                  required under state securities or Blue Sky laws in
                  connection with the purchase and distribution of the Shares
                  by the



                                     -14-
<PAGE>   15

                  Underwriters and the International Underwriters (as to which
                  counsel need express no opinion);

                      (ix)   Neither the Company nor any of its subsidiaries is
                  in violation of its Certificate of Incorporation or By-laws
                  or in default in the performance or observance of any
                  material obligation, agreement, covenant or condition
                  contained in any indenture, mortgage, deed of trust, loan
                  agreement, lease or other agreement or instrument which is
                  filed as an exhibit to, or referred to, in the Registration
                  Statement (in giving the opinion in this clause counsel may
                  attach to such opinion a list of the foregoing agreements and
                  instruments);

                      (x)    The statements set forth in the Prospectus under
                  the caption "Description of Capital Stock", insofar as they
                  purport to constitute a summary of the terms of the Stock,
                  under the caption "Certain U.S. Tax Considerations Applicable
                  to Non-U.S. Holders of the Common Stock" and under the
                  caption "Underwriting", insofar as they purport to describe
                  the provisions of the laws and documents referred to therein,
                  are accurate, complete and fair;

                      (xi)   The Company is not an "investment company" or
                  required to be registered as an investment company under the
                  Investment Company Act;

                      (xii)  No holders of outstanding options under the 1995
                  Restated Stock Incentive Plan (the "Plan") have the right to
                  acquire any shares of capital stock of ISS as a result of the
                  assumption by the Company of the outstanding options issued
                  pursuant to the Plan and all other obligations under the Plan
                  in connection with the transactions contemplated by the Stock
                  Exchange Agreement dated as of December 8, 1997 by and among
                  the Company and the shareholders of ISS. In addition, the
                  Company has consummated the assumption of such options and
                  obligations in accordance with all of the terms and
                  conditions of the Plan, and the Company has obtained all
                  required consents, approvals and authorizations for such
                  assumption; and

                      (xiii) The Registration Statement and the Prospectus and
                  any further amendments and supplements thereto made by the
                  Company prior to such Time of Delivery (other than the
                  financial statements and related schedules therein, as to
                  which such counsel need express no opinion), when filed and
                  at the time the Registration Statement was declared
                  effective, complied as to form in all material respects with
                  the requirements of the Act and the rules and regulations
                  thereunder; although they do not assume any responsibility
                  for the accuracy, completeness or fairness of the statements
                  contained in the Registration Statement or the Prospectus,
                  except for those referred to in the opinion in subsection (x)
                  of this section 7(c), they have no reason to believe that, as
                  of its effective date, the Registration Statement or any
                  further amendment thereto made by the Company prior to such
                  Time of Delivery (other than the financial statements and
                  related schedules therein, as to which such counsel need
                  express no opinion) contained an untrue statement of a



                                     -15-
<PAGE>   16


                  material fact or omitted to state a material fact required to
                  be stated therein or necessary to make the statements therein
                  not misleading or that, as of its date, the Prospectus or any
                  further amendment or supplement thereto made by the Company
                  prior such Time of Delivery (other than the financial
                  statements and related schedules therein, as to which such
                  counsel need express no opinion) contained an untrue
                  statement of a material fact or omitted to state a material
                  fact necessary to make the statements therein, in the light
                  of the circumstances under which they were made, not
                  misleading or that, as of such Time of Delivery, either the
                  Registration Statement or the Prospectus or any further
                  amendment or supplement thereto made by the Company prior to
                  such Time of Delivery (other than the financial statements
                  and related schedules therein, as to which such counsel need
                  express no opinion) contains an untrue statement of a
                  material fact or omits to state a material fact necessary to
                  make the statements therein, in the light of the
                  circumstances under which they were made, not misleading; and
                  they do not know of any amendment to the Registration
                  Statement required to be filed or of any contracts or other
                  documents of a character required to be filed as an exhibit
                  to the Registration Statement or required to be described in
                  the Registration Statement or the Prospectus which are not
                  filed or described as required;

                  (d)      Each of King & Spalding and Nagashimi & Ohno, 
counsel to the Company, shall have furnished to you their written opinion,
dated such time of delivery, in form and substance satisfactory to you, with
respect to the matters set forth in clauses (iv), (v), and (ix) of the
foregoing paragraph (c), relating to Internet Security Systems, Inc., a Georgia
corporation and Internet Security Systems KK, a Japanese corporation,
respectively;

                  (e)      The respective counsel for each of the Selling
Stockholders, as indicated in Schedule II hereto, each shall have furnished to
you their written opinion with respect to each of the Selling Stockholders for
whom they are acting as counsel, dated such Time of Delivery, in form and
substance satisfactory to you, to the effect that:

                      (i)    A Power-of-Attorney and a Custody Agreement dated
                  as of the date of this Agreement have been duly executed and
                  delivered by such Selling Stockholder and constitute valid
                  and binding agreements of such Selling Stockholder in
                  accordance with their terms;

                      (ii)   This Agreement and the International Underwriting
                  Agreement have been duly executed and delivered by or on
                  behalf of such Selling Stockholder; and the sale of the
                  Shares to be sold by such Selling Stockholder hereunder and
                  thereunder and the compliance by such Selling Stockholder
                  with all of the provisions of this Agreement and the
                  International Underwriting Agreement, the Power-of-Attorney
                  and the Custody Agreement and the consummation of the
                  transactions herein and therein contemplated will not
                  conflict with or result in a breach or violation of any terms
                  or provisions of, or constitute a default under, any statute,
                  indenture, mortgage, deed of trust, loan agreement or other
                  agreement or instrument known to such counsel to which such
                  Selling Stockholder is a party or by which such Selling
                  Stockholder is bound or to which any of the property or
                  assets of such Selling Stockholder is subject, nor will such
                  action result in any violation of the provisions of any
                  order, rule or regulation known to such counsel of any court
                  or governmental agency or body having jurisdiction over such
                  Selling Stockholder or the property of such Selling
                  Stockholder;

                      (iii)  No consent, approval, authorization or order of
                  any court or governmental agency or body is required for the
                  consummation of the transactions contemplated by this
                  Agreement and the International Underwriting Agreement in
                  connection with the Shares to be sold by such Selling
                  Stockholder hereunder or thereunder, except such as have



                                     -16-
<PAGE>   17

                  been obtained under the Act and such as may be required under
                  state securities or Blue Sky laws in connection with the
                  purchase and distribution of such Shares by the Underwriters
                  or the International Underwriters;

                      (iv)   Immediately prior to any Time of Delivery, such
                  Selling Stockholder had good and valid title to the Shares to
                  be sold at such Time of Delivery by such Selling Stockholder
                  under this Agreement and the International Underwriting
                  Agreement, free and clear of all liens, encumbrances,
                  equities or claims, and full right, power and authority to
                  sell, assign, transfer and deliver the Shares to be sold by
                  such Selling Stockholder hereunder and thereunder; and

                      (v)    Assuming that the Underwriters purchase the Shares
                  to be sold by each Selling Stockholder for value, in good
                  faith and without notice of any adverse claim within the
                  meaning of the Uniform Commercial Code, upon delivery and
                  payment for the Shares to be sold by each Selling
                  Stockholder, the Underwriters will receive valid title to
                  such Shares, free and clear of all liens, encumbrances,
                  equities or claims.

     In rendering the opinion in paragraph (iv), such counsel may rely upon a
certificate of such Selling Stockholder in respect of matters of fact as to
ownership of, and liens, encumbrances, equities or claims on, the Shares sold
by such Selling Stockholder, provided that such counsel shall state that they
believe that both you and they are justified in relying upon such certificate
and that an original of such certificate is delivered to you;

                  (f) On the date of the Prospectus at a time prior to the
execution of this Agreement, at 9:30 a.m., New York City time, on the effective
date of any post-effective amendment to the Registration Statement filed
subsequent to the date of this Agreement and also at each Time of Delivery,
Ernst & Young LLP shall have furnished to you a letter or letters, dated the
respective dates of delivery thereof, in form and substance satisfactory to
you, to the effect set forth in Annex I hereto;

                  (g)(i) Neither the Company nor any of its subsidiaries shall
have sustained since the date of the latest audited financial statements
included in the Prospectus any loss or interference with its business from
fire, explosion, flood or other calamity, whether or not covered by insurance,
or from any labor dispute or court or governmental action, order or decree,
otherwise than as set forth or contemplated in the Prospectus, and (ii) since
the respective dates as of which information is given in the Prospectus there
shall not have been any change in the capital stock or long-term debt of the
Company or any of its subsidiaries or any change, or any development involving
a prospective change, in or affecting the general affairs, management,
financial position, stockholders' equity or results of operations of the
Company and its subsidiaries, otherwise than as set forth or contemplated in
the Prospectus, the effect of which, in any such case described in Clause (i)
or (ii), is in the judgment of the Representatives so material and adverse as
to make it impracticable or inadvisable to proceed with the public offering or
the delivery of the Shares being delivered at such Time of Delivery on the
terms and in the manner contemplated in the Prospectus;

                  (h) On or after the date hereof (i) no downgrading shall have
occurred in the rating, if any, accorded the Company's debt securities by any
"nationally recognized statistical rating organization", as that term is
defined by the Commission for purposes of Rule 436(g)(2) under the Act, and
(ii) no such organization shall have publicly announced that it has under
surveillance or review, with possible negative implications, its rating of any
of the Company's debt securities;



                                     -17-
<PAGE>   18

                (i) On or after the date hereof there shall not have occurred
any of the following: (i) a suspension or material limitation in trading in
securities generally on the New York Stock Exchange or on NASDAQ; (ii) a
suspension or material limitation in trading in the Company's securities on
NASDAQ; (iii) a general moratorium on commercial banking activities declared by
either Federal or New York State authorities; or (iv) the outbreak or
escalation of hostilities involving the United States or the declaration by the
United States of a national emergency or war, if the effect of any such event
specified in this Clause (iv) in the judgment of the Representatives makes it
impracticable or inadvisable to proceed with the public offering or the
delivery of the Shares being delivered at such Time of Delivery on the terms
and in the manner contemplated in the Prospectus;

                (j) The Shares to be sold at such Time of Delivery shall have
been duly listed for quotation on NASDAQ;

                (k) The Company has obtained and delivered to the Underwriters
executed copies of agreements from stockholders of the Company holding in the
aggregate in excess of 95% of the shares outstanding on the date of this
Agreement, substantially to the effect set forth in Subsection 1(b)(iv) hereof
in form and substance satisfactory to you;

                (l) The Company shall have complied with the provisions of
Section 5(c) hereof with respect to the furnishing of prospectuses on the New
York Business Day next succeeding the date of this Agreement; and

                (m) The Company and the Selling Stockholders shall have
furnished or caused to be furnished to you at such Time of Delivery
certificates of officers of the Company and of the Selling Stockholders,
respectively, satisfactory to you as to the accuracy of the representations and
warranties of the Company and of the Selling Stockholders, respectively, herein
at and as of such Time of Delivery, as to the performance by the Company and
the Selling Stockholders of all of their respective obligations hereunder to be
performed at or prior to such Time of Delivery, and as to such other matters as
you may reasonably request, and the Company shall have furnished or caused to
be furnished certificates as to the matters set forth in subsections (a) and
(f) of this Section.

       8.       (a) The Company and ISS, jointly and severally, will indemnify
and hold harmless each Underwriter against any losses, claims, damages or
liabilities, joint or several, to which such Underwriter may become subject,
under the Act or otherwise, insofar as such losses, claims, damages or
liabilities (or actions in respect thereof) arise out of or are based upon an
untrue statement or alleged untrue statement of a material fact contained in
any Preliminary Prospectus, the Registration Statement or the Prospectus, or
any amendment or supplement thereto, or arise out of or are based upon the
omission or alleged omission to state therein a material fact required to be
stated therein or necessary to make the statements therein not misleading, and
will reimburse each Underwriter for any legal or other expenses reasonably
incurred by such Underwriter in connection with investigating or defending any
such action or claim as such expenses are incurred; provided, however, that the
Company and ISS shall not be liable in any such case to the extent that any
such loss, claim, damage or liability arises out of or is based upon an untrue
statement or alleged untrue statement or omission or alleged omission made in
any Preliminary Prospectus, the Registration Statement or the Prospectus or any
such amendment or supplement in reliance upon and in conformity with written
information furnished to the Company by any Underwriter through Goldman, Sachs
& Co. expressly for use therein.

                (b) Each of the Selling Stockholders will indemnify and hold
harmless each Underwriter against any losses, claims, damages or liabilities,
joint or several, to which such Underwriter may become subject, under the Act
or otherwise, insofar as such losses, claims, damages



                                     -18-
<PAGE>   19

or liabilities (or actions in respect thereof) arise out of or are based upon
an untrue statement or alleged untrue statement of a material fact contained in
any Preliminary Prospectus, the Registration Statement or the Prospectus, or
any amendment or supplement thereto, or arise out of or are based upon the
omission or alleged omission to state therein a material fact required to be
stated therein or necessary to make the statements therein not misleading, and
will reimburse each Underwriter for any legal or other expenses reasonably
incurred by such Underwriter in connection with investigating or defending any
such action or claim as such expenses are incurred; provided, however, that
such Selling Stockholder shall not be liable in any such case to the extent
that any such loss, claim, damage or liability arises out of or is based upon
an untrue statement or alleged untrue statement or omission or alleged omission
made in any preliminary Prospectus, the Registration Statement or the
Prospectus or any such amendment or supplement in reliance upon and in
conformity with written information furnished by any Underwriter through
Goldman, Sachs & Co. expressly for use therein; provided, further, that the
liability of a Selling Stockholder pursuant to this subsection (b) shall not
exceed the product of the number of Shares sold by such Selling Stockholder and
the initial public offering price of the Shares as set forth in the Prospectus.

                (c) Each Underwriter will indemnify and hold harmless the
Company and each Selling Stockholder against any losses, claims, damages or
liabilities to which the Company or such Selling Stockholder may become
subject, under the Act or otherwise, insofar as such losses, claims, damages or
liabilities (or actions in respect thereof) arise out of or are based upon an
untrue statement or alleged untrue statement of a material fact contained in
any Preliminary Prospectus, the Registration Statement or the Prospectus, or
any amendment or supplement thereto, or arise out of or are based upon the
omission or alleged omission to state therein a material fact required to be
stated therein or necessary to make the statements therein not misleading, in
each case to the extent, but only to the extent, that such untrue statement or
alleged untrue statement or omission or alleged omission was made in any
Preliminary Prospectus, the Registration Statement or the Prospectus or any
such amendment or supplement in reliance upon and in conformity with written
information furnished to the Company by such Underwriter through Goldman, Sachs
& Co. expressly for use therein; and will reimburse the Company and each
Selling Stockholder for any legal or other expenses reasonably incurred by the
Company or such Selling Stockholder in connection with investigating or
defending any such action or claim as such expenses are incurred.

                (d) Promptly after receipt by an indemnified party under
subsection (a), (b) or (c) above of notice of the commencement of any action,
such indemnified party shall, if a claim in respect thereof is to be made
against the indemnifying party under such subsection, notify the indemnifying
party in writing of the commencement thereof; but the omission so to notify the
indemnifying party shall not relieve it from any liability which it may have to
any indemnified party otherwise than under such subsection. In case any such
action shall be brought against any indemnified party and it shall notify the
indemnifying party of the commencement thereof, the indemnifying party shall be
entitled to participate therein and, to the extent that it shall wish, jointly
with any other indemnifying party similarly notified, to assume the defense
thereof, with counsel satisfactory to such indemnified party (who shall not,
except with the consent of the indemnified party, be counsel to the
indemnifying party), and, after notice from the indemnifying party to such
indemnified party of its election so to assume the defense thereof, the
indemnifying party shall not be liable to such indemnified party under such
subsection for any legal expenses of other counsel or any other expenses, in
each case subsequently incurred by such indemnified party, in connection with
the defense thereof other than reasonable costs of investigation. No
indemnifying party shall, without the written consent of the indemnified party,
effect the settlement or compromise of, or consent to the entry of any judgment
with respect to, any pending



                                     -19-
<PAGE>   20

or threatened action or claim in respect of which indemnification or
contribution may be sought hereunder (whether or not the indemnified party is
an actual or potential party to such action or claim) unless such settlement,
compromise or judgment (i) includes an unconditional release of the indemnified
party from all liability arising out of such action or claim and (ii) does not
include a statement as to or an admission of fault, culpability or a failure to
act, by or on behalf of any indemnified party.

                (e) If the indemnification provided for in this Section 8 is
unavailable to or insufficient to hold harmless an indemnified party under
subsection (a), (b) or (c) above in respect of any losses, claims, damages or
liabilities (or actions in respect thereof) referred to therein, then each
indemnifying party shall contribute to the amount paid or payable by such
indemnified party as a result of such losses, claims, damages or liabilities
(or actions in respect thereof) in such proportion as is appropriate to reflect
the relative benefits received by the Company and the Selling Stockholders on
the one hand and the Underwriters on the other from the offering of the Shares.
If, however, the allocation provided by the immediately preceding sentence is
not permitted by applicable law or if the indemnified party failed to give the
notice required under subsection (d) above, then each indemnifying party shall
contribute to such amount paid or payable by such indemnified party in such
proportion as is appropriate to reflect not only such relative benefits but
also the relative fault of the Company and the Selling Stockholders on the one
hand and the Underwriters on the other in connection with the statements or
omissions which resulted in such losses, claims, damages or liabilities (or
actions in respect thereof), as well as any other relevant equitable
considerations. The relative benefits received by the Company and the Selling
Stockholders on the one hand and the Underwriters on the other shall be deemed
to be in the same proportion as the total net proceeds from the offering
(before deducting expenses) received by the Company and the Selling
Stockholders bear to the total underwriting discounts and commissions received
by the Underwriters, in each case as set forth in the table on the cover page
of the Prospectus. The relative fault shall be determined by reference to,
among other things, whether the untrue or alleged untrue statement of a
material fact or the omission or alleged omission to state a material fact
relates to information supplied by the Company or the Selling Stockholders on
the one hand or the Underwriters on the other and the parties' relative intent,
knowledge, access to information and opportunity to correct or prevent such
statement or omission. The Company, each of the Selling Stockholders and the
Underwriters agree that it would not be just and equitable if contributions
pursuant to this subsection (e) were determined by pro rata allocation (even if
the Underwriters were treated as one entity for such purpose) or by any other
method of allocation which does not take account of the equitable
considerations referred to above in this subsection (e). The amount paid or
payable by an indemnified party as a result of the losses, claims, damages or
liabilities (or actions in respect thereof) referred to above in this
subsection (e) shall be deemed to include any legal or other expenses
reasonably incurred by such indemnified party in connection with investigating
or defending any such action or claim. Notwithstanding the provisions of this
subsection (e), no Underwriter shall be required to contribute any amount in
excess of the amount by which the total price at which the Shares underwritten
by it and distributed to the public were offered to the public exceeds the
amount of any damages which such Underwriter has otherwise been required to pay
by reason of such untrue or alleged untrue statement or omission or alleged
omission. No person guilty of fraudulent misrepresentation (within the meaning
of Section 11(f) of the Act) shall be entitled to contribution from any person
who was not guilty of such fraudulent misrepresentation. The Underwriters'
obligations in this subsection (e) to contribute are several in proportion to
their respective underwriting obligations and not joint.



                                     -20-
<PAGE>   21

                (f) The obligations of the Company, ISS and the Selling
Stockholders under this Section 8 shall be in addition to any liability which
the Company and the respective Selling Stockholders may otherwise have and
shall extend, upon the same terms and conditions, to each person, if any, who
controls any Underwriter within the meaning of the Act; and the obligations of
the Underwriters under this Section 8 shall be in addition to any liability
which the respective Underwriters may otherwise have and shall extend, upon the
same terms and conditions, to each officer and director of the Company
(including any person who, with his or her consent, is named in the
Registration Statement as about to become a director of the Company) and to
each person, if any, who controls the Company within the meaning of the Act.

       9.       (a) If any Underwriter shall default in its obligation to
purchase the Shares which it has agreed to purchase hereunder at a Time of
Delivery, you may in your discretion arrange for you or another party or other
parties to purchase such Shares on the terms contained herein. If within
thirty-six hours after such default by any Underwriter you do not arrange for
the purchase of such Shares, then the Company and the Selling Stockholders
shall be entitled to a further period of thirty-six hours within which to
procure another party or other parties satisfactory to you to purchase such
Shares on such terms. In the event that, within the respective prescribed
periods, you notify the Company and the Selling Stockholders that you have so
arranged for the purchase of such Shares, or the Company and the Selling
Stockholders notify you that they have so arranged for the purchase of such
Shares, you or the Company shall have the right to postpone such Time of
Delivery for a period of not more than seven days, in order to effect whatever
changes may thereby be made necessary in the Registration Statement or the
Prospectus, or in any other documents or arrangements, and the Company agrees
to file promptly any amendments to the Registration Statement or the Prospectus
which in your reasonable opinion may thereby be made necessary. The term
"Underwriter" as used in this Agreement shall include any person substituted
under this Section with like effect as if such person had originally been a
party to this Agreement with respect to such Shares.

                (b) If, after giving effect to any arrangements for the
purchase of the Shares of a defaulting Underwriter or Underwriters by you and
the Company and the Selling Stockholders as provided in subsection (a) above,
the aggregate number of such Shares which remains unpurchased does not exceed
one-eleventh of the aggregate number of all the Shares to be purchased at such
Time of Delivery, then the Company and the Selling Stockholders shall have the
right to require each non-defaulting Underwriter to purchase the number of
Shares which such Underwriter agreed to purchase hereunder at such Time of
Delivery and, in addition, to require each non-defaulting Underwriter to
purchase its pro rata share (based on the number of Shares which such
Underwriter agreed to purchase hereunder) of the Shares of such defaulting
Underwriter or Underwriters for which such arrangements have not been made; but
nothing herein shall relieve a defaulting Underwriter from liability for its
default.

                (c) If, after giving effect to any arrangements for the
purchase of the Shares of a defaulting Underwriter or Underwriters by you and
the Company and the Selling Stockholders as provided in subsection (a) above,
the aggregate number of such Shares which remains unpurchased exceeds
one-eleventh of the aggregate number of all the Shares to be purchased at such
Time of Delivery, or if the Company and the Selling Stockholders shall not
exercise the right described in subsection (b) above to require non-defaulting



                                     -21-
<PAGE>   22

Underwriters to purchase Shares of a defaulting Underwriter or Underwriters,
then this Agreement or, with respect to the Second Time of Delivery, the
obligations of the Underwriters to purchase and of the Company and the Selling
Stockholders to sell the Optional Shares, shall thereupon terminate, without
liability on the part of any non-defaulting Underwriter or the Company or the
Selling Stockholders, except for the expenses to be borne by the Company and
the Selling Stockholders and the Underwriters as provided in Section 6 hereof
and the indemnity and contribution agreements in Section 8 hereof; but nothing
herein shall relieve a defaulting Underwriter from liability for its default.

      10.     The respective indemnities, agreements, representations, 
warranties and other statements of the Company and the Selling Stockholders and
the several Underwriters, as set forth in this Agreement or made by or on
behalf of them, respectively, pursuant to this Agreement, shall remain in full
force and effect, regardless of any investigation (or any statement as to the
results thereof) made by or on behalf of any Underwriter or any controlling
person of any Underwriter, or the Company or the Selling Stockholders, or any
officer or director or controlling person of the Company or any controlling
person of any Selling Stockholder, and shall survive delivery of and payment
for the Shares.

      11.     If this Agreement shall be terminated pursuant to Section 9
hereof, neither the Company, nor ISS nor the Selling Stockholders shall then be
under any liability to any Underwriter except as provided in Sections 6 and 8
hereof; but, if for any other reason any Shares are not delivered by or on
behalf of the Company and the Selling Stockholders as provided herein, the
Company and each of the Selling Stockholders pro rata (based on the number of
Shares to be sold by the Company and such Selling Stockholder hereunder) will
reimburse the Underwriters through you for all out-of-pocket expenses approved
in writing by you, including fees and disbursements of counsel, reasonably
incurred by the Underwriters in making preparations for the purchase, sale and
delivery of the Shares not so delivered, but the Company, ISS and the Selling
Stockholders shall then be under no further liability to any Underwriter in
respect of the Shares not so delivered except as provided in Sections 6 and 8
hereof.

      12.     In all dealings hereunder, you shall act on behalf of each of the
Underwriters, and the parties hereto shall be entitled to act and rely upon any
statement, request, notice or agreement on behalf of any Underwriter made or
given by you jointly or by Goldman, Sachs & Co. on behalf of you as the
representatives; and in all dealings with any Selling Stockholder hereunder,
you and the Company shall be entitled to act and rely upon any statement,
request, notice or agreement on behalf of such Selling Stockholder made or
given by any or all of the Attorneys-in-Fact for such Selling Stockholder.

      All statements, requests, notices and agreements hereunder shall be in
writing, and if to the Underwriters shall be delivered or sent by mail, telex
or facsimile transmission to you as the representatives in care of Goldman,
Sachs & Co., 85 Broad Street, New York, New York 10004, Attention: Registration
Department; and if to any Selling Stockholders shall be delivered or sent by
mail, telex or facsimile transmission to counsel for such Selling Stockholder
at its address set forth in Schedule II hereto; and if to the Company shall be
delivered or sent by mail, telex or facsimile transmission to the address of
the Company set forth in the Registration Statement, Attention: Secretary;
provided, however, that any notice to an Underwriter pursuant to Section 8(c)
hereof shall be delivered or sent by mail, telex or facsimile transmission to
such Underwriter at its address set forth in its Underwriters' Questionnaire,
or telex constituting such Questionnaire, which address will be supplied to the
Company by you upon request. Any such statements, requests, notices or
agreements shall take effect upon receipt thereof.

      13.     This Agreement shall be binding upon, and inure solely to the
benefit of, the Underwriters, the Company and the Selling Stockholders and, to
the extent provided in Sections 8 and 10 hereof, the officers and directors of
the Company and each person who controls the Company, any Selling



                                     -22-
<PAGE>   23

Stockholder or any Underwriter, and their respective heirs, executors,
administrators, successors and assigns, and no other person shall acquire or
have any right under or by virtue of this Agreement. No purchaser of any of the
Shares from any Underwriter shall be deemed a successor or assign by reason
merely of such purchase.

      14.     Time shall be of the essence of this Agreement. As used herein,
the term "business day" shall mean any day when the Commission's office in
Washington, D.C. is open for business.

      15.     THIS AGREEMENT SHALL BE GOVERNED BY AND CONSTRUED IN ACCORDANCE
WITH THE LAWS OF THE STATE OF NEW YORK.

      16.     This Agreement may be executed by any one or more of the parties
hereto in any number of counterparts, each of which shall be deemed to be an
original, but all such counterparts shall together constitute one and the same
instrument.

      If the foregoing is in accordance with your understanding, please sign
and return to us eight counterparts hereof, and upon the acceptance hereof by
you, on behalf of each of the Underwriters, this letter and such acceptance
hereof shall constitute a binding agreement among each of the Underwriters, the
Company and each of the Selling Stockholders. It is understood that your
acceptance of this letter on behalf of each of the Underwriters is pursuant to
the authority set forth in a form of Agreement among Underwriters, the form of
which shall be submitted to the Company and



                                     -23-
<PAGE>   24

the Selling Stockholders for examination upon request, but without warranty on
your part as to the authority of the signers thereof.

                                 Very truly yours,

                                 ISS Group, Inc.


                                 By: 
                                    ------------------------------------------
                                    Name:
                                    Title:

                                 Internet Security Systems, Inc.


                                 By: 
                                    ------------------------------------------
                                    Name:
                                    Title:

                                    Christopher W. Klaus  Thomas E. Noonan
                                    Kevin J. O'Connor     Alex Bogaerts
                                    Lin Ja Hong           Richard Macchia
                                    M. Thomas McNeight    H. Keith Cooley
                                    Glenn M. McGonnigle   Nancy Blair
                                    Charles Meyers        Patrick J.D. Taylor


                                 By: 
                                    ..........................................
                                    Name:
                                    Title:
                                    As Attorney-in-Fact acting on behalf of
                                    each of the Selling Stockholders named in
                                    Schedule II to this Agreement. 

Accepted as of the date hereof:

Goldman, Sachs & Co.
Dain Rauscher Wessels, a division of Dain Rauscher Incorporated
Warburg Dillon Read LLC, a subsidiary of UBS AG 
BancBoston Robertson Stephens Inc.


By:
   ......................................
   (Goldman, Sachs & Co.)
   On behalf of each of the Underwriters
<PAGE>   25

                              SCHEDULE I



                                     -25-
<PAGE>   26


                             SCHEDULE II



                                     -26-
<PAGE>   27

                                                                        ANNEX I



      Pursuant to Section 7(d) of the Underwriting Agreement, the accountants 
shall furnish letters to the Underwriters to the effect that:

            (i)    They are independent certified public accountants with 
         respect to the Company and its subsidiaries within the meaning of the
         Act and the applicable published rules and regulations thereunder;

            (ii)   In their opinion, the financial statements and any
         supplementary financial information and schedules (and, if applicable,
         financial forecasts and/or pro forma financial information) examined
         by them and included in the Prospectus or the Registration Statement
         comply as to form in all material respects with the applicable
         accounting requirements of the Act and the related published rules and
         regulations thereunder; and, if applicable, they have made a review in
         accordance with standards established by the American Institute of
         Certified Public Accountants of the unaudited consolidated interim
         financial statements, selected financial data, pro forma financial
         information, financial forecasts and/or condensed financial statements
         derived from audited financial statements of the Company for the
         periods specified in such letter, as indicated in their reports
         thereon, copies of which have been furnished to the representatives of
         the Underwriters (the "Representatives" and are attached hereto;

            (iii)  They have made a review in accordance with standards
         established by the American Institute of Certified Public Accountants
         of the unaudited condensed consolidated statements of income,
         consolidated balance sheets and consolidated statements of cash flows
         included in the Prospectus as indicated in their reports thereon
         copies of which are attached hereto and on the basis of specified
         procedures including inquiries of officials of the Company who have
         responsibility for financial and accounting matters regarding whether
         the unaudited condensed consolidated financial statements referred to
         in paragraph (vi)(A)(i) below comply as to form in all material
         respects with the applicable accounting requirements of the Act and
         the related published rules and regulations, nothing came to their
         attention that caused them to believe that the unaudited condensed
         consolidated financial statements do not comply as to form in all
         material respects with the applicable accounting requirements of the
         Act and the related published rules and regulations;

            (iv)   They have compared the information in the Prospectus under
         selected captions with the disclosure requirements of Regulation S-K
         and on the basis of limited procedures specified in such letter
         nothing came to their attention as a result of the foregoing
         procedures that caused them to believe that this information does not
         conform in all material respects with the disclosure requirements of
         Items 301, 302, 402 and 503(d), respectively, of Regulation S-K;

            (vi)   On the basis of limited procedures, not constituting an
         examination in accordance with generally accepted auditing standards,
         consisting of a reading of the unaudited financial statements and
         other information referred to below, a reading of the latest available
         interim financial statements of the Company and its subsidiaries,
         inspection of the minute books of the Company and its subsidiaries
         since the date of the latest audited financial statements included in
         the Prospectus, inquiries of officials of the Company and its
         subsidiaries responsible for
<PAGE>   28

         financial and accounting matters and such other inquiries and
         procedures as may be specified in such letter, nothing came to their
         attention that caused them to believe that:

                       (A)    (i) the unaudited consolidated statements of
                  income, consolidated balance sheets and consolidated
                  statements of cash flows included in the Prospectus do not
                  comply as to form in all material respects with the
                  applicable accounting requirements of the Act and the related
                  published rules and regulations, or (ii) any material
                  modifications should be made to the unaudited condensed
                  consolidated statements of income, consolidated balance
                  sheets and consolidated statements of cash flows included in
                  the Prospectus for them to be in conformity with generally
                  accepted accounting principles;

                       (B)    any other unaudited income statement data and 
                  balance sheet items included in the Prospectus do not agree
                  with the corresponding items in the unaudited consolidated
                  financial statements from which such data and items were
                  derived, and any such unaudited data and items were not
                  determined on a basis substantially consistent with the basis
                  for the corresponding amounts in the audited consolidated
                  financial statements included in the Prospectus;

                       (C)    the unaudited financial statements which were not
                  included in the Prospectus but from which were derived any
                  unaudited condensed financial statements referred to in
                  Clause (A) and any unaudited income statement data and
                  balance sheet items included in the Prospectus and referred
                  to in Clause (B) were not determined on a basis substantially
                  consistent with the basis for the audited consolidated
                  financial statements included in the Prospectus;

                       (D)    any unaudited pro forma consolidated condensed
                  financial statements included in the Prospectus do not comply
                  as to form in all material respects with the applicable
                  accounting requirements of the Act and the published rules
                  and regulations thereunder or the pro forma adjustments have
                  not been properly applied to the historical amounts in the
                  compilation of those statements;

                       (E)    as of a specified date not more than five days
                  prior to the date of such letter, there have been any changes
                  in the consolidated capital stock (other than issuances of
                  capital stock upon exercise of options and stock appreciation
                  rights, upon earn-outs of performance shares and upon
                  conversions of convertible securities, in each case which
                  were outstanding on the date of the latest financial
                  statements included in the Prospectus) or any increase in the
                  consolidated long-term debt of the Company and its
                  subsidiaries, or any decreases in consolidated net current
                  assets or stockholders' equity or other items specified by
                  the Representatives, or any increases in any items specified
                  by the Representatives, in each case as compared with amounts
                  shown in the latest balance sheet included in the Prospectus,
                  except in each case for changes, increases or decreases which
                  the Prospectus discloses have occurred or may occur or which
                  are described in such letter; and

                       (F)    for the period from the date of the latest
                  financial statements included in the Prospectus to the
                  specified date referred to in Clause (E) there were any
                  decreases in consolidated net revenues or operating profit or
                  the total or per share amounts of consolidated net income or
                  other items specified by the Representatives, or any
                  increases in any items specified by the Representatives, in
                  each case as compared with the
<PAGE>   29

                  comparable period of the preceding year and with any other
                  period of corresponding length specified by the
                  Representatives, except in each case for decreases or
                  increases which the Prospectus discloses have occurred or may
                  occur or which are described in such letter; and

            (vii)    In addition to the examination referred to in their
         report(s) included in the Prospectus and the limited procedures,
         inspection of minute books, inquiries and other procedures referred to
         in paragraphs (iii) and (vi) above, they have carried out certain
         specified procedures, not constituting an examination in accordance
         with generally accepted auditing standards, with respect to certain
         amounts, percentages and financial information specified by the
         Representatives, which are derived from the general accounting records
         of the Company and its subsidiaries, which appear in the Prospectus,
         or in Part II of, or in exhibits and schedules to, the Registration
         Statement specified by the Representatives, and have compared certain
         of such amounts, percentages and financial information with the
         accounting records of the Company and its subsidiaries and have found
         them to be in agreement.

<PAGE>   1
                                                                    EXHIBIT 10.9

                                      Lease


                                 EMBASSY ROW 600
                          6600 PEACHTREE DUNWOODY ROAD
                             BUILDING 600, SUITE 600
                             ATLANTA, GEORGIA 30328





                                     Between


                      INTERNET SECURITY SYSTEMS, INC. (ISS)
                                    (Tenant)



                                       and



                         CARRAMERICA REALTY CORPORATION
                                   (Landlord)



<PAGE>   2


                                      LEASE

         THIS LEASE (the "Lease") is made as of ________, 19 _______ between
CARRAMERICA REALTY CORPORATION, a Maryland corporation (the "Landlord") and the
Tenant as named in the Schedule below. The term "Project" means the building
(the "Building") known as "Embassy Row 600" and the land (the "Land") located at
6600 Peachtree Dunwoody Road, Atlanta, Georgia 30328. "Premises" means that part
of the Project leased to Tenant described in the Schedule and outlined on
Appendix A.

         The following schedule (the "Schedule") is an integral part of this
Lease. Terms defined in this Schedule shall have the same meaning throughout the
Lease.

                                    SCHEDULE

         1. TENANT: Internet Security Systems, Inc. (ISS), a Georgia corporation
         2. PREMISES: 6600 Peachtree Dunwoody Road, Building 600, Suite 600,
Atlanta, Georgia 30328
         3. RENTABLE SQUARE FEET OF THE PREMISES: 24,481 (See Special
Stipulations #1 - Phased Occupancy)

                  PHASE 1 OF THE PREMISES: 12,240 rentable square feet on Floor
                  6.

                  PHASE 2 OF THE PREMISES: 6,120 rentable square feet on Floor
                  6.

                  PHASE 3 OF THE PREMISES: 6,121 rentable square feet on Floor
                  6.

         4. TENANT'S PROPORTIONATE SHARE: 16.08% (based upon a total of 152,246
rentable square feet in the Building)

         5. SECURITY DEPOSIT: $42,535.74

         6. TENANT'S REAL ESTATE BROKER FOR THIS LEASE: Cushman & Wakefield of
Georgia, Inc.

         7. LANDLORD'S REAL ESTATE BROKER FOR THIS LEASE: N/A

         8. TENANT IMPROVEMENTS, IF ANY: See the Tenant Improvement Agreement
attached hereto as Appendix C.

         9. COMMENCEMENT DATE:

                  The COMMENCEMENT DATE FOR PHASE 1 OF THE PREMISES is to occur
         on January 1, 1999 or the Completion Date (as defined in Appendix C)
         with respect to Phase 1 of the Premises. Landlord and Tenant shall
         execute a Commencement Date Confirmation substantially in the form of
         Appendix E promptly following the Commencement Date for Phase 1 of the
         Premises.

                  The COMMENCEMENT DATE FOR PHASE 2 OF THE PREMISES is to occur
         on April 1, 1999. Landlord and Tenant shall execute a Commencement Date
         Confirmation substantially in the form of Appendix E promptly following
         the Commencement Date for Phase 2 of the Premises.

                  The COMMENCEMENT DATE FOR PHASE 3 OF THE PREMISES is to occur
         on June 1, 1999. Landlord and Tenant shall execute a Commencement Date
         Confirmation substantially in the form of Appendix E promptly following
         the Commencement Date for Phase 2 of the Premises.

         10. TERMINATION DATE/TERM: June 30, 2002
         11. GUARANTOR: N/A
         12. BASE YEAR: 1999

                                       2

<PAGE>   3

         13. BASE RENT:

<TABLE>
<CAPTION>
                                          Per Sq. Ft.                    Annual                    Monthly
                     Period                Base Rent                    Base Rent                 Base Rent
                     ------                ---------                    ---------                 ---------
<S>               <C>                     <C>                          <C>                       <C>
                  1/1/99 - 3/30/99          $20.85                     $255,204.00               $21.267.00
                  4/1/99 - 5/31/99          $20.85                     $382,806.00               $31,900.50
                  6/1/99 - 12/31/99         $20.85                     $510,428.88               $42,535.74
                  1/1/00 - 12/31/00         $21.50                     $526,341.48               $43,861.79
                  1/1/01 - 12/31/01         $22.00                     $538,581.96               $44,881.83
                  1/1/02 - 6/30/02          $22.50                     $550,822.56               $45,901.88
</TABLE>

         1.       LEASE AGREEMENT. On the terms stated in this Lease, Landlord
leases the Premises to Tenant, and Tenant leases the Premises from Landlord, for
the Term beginning on the Commencement Date and ending on the Termination Date
unless extended or sooner terminated pursuant to this Lease.

         2.       RENT.

         A.       Types of Rent. Tenant shall pay the following Rent in the form
of a check to Landlord at the following address:

                  CARRAMERICA REALTY CORPORATION, T/A EMBASSY ROW
                  P.O. Box 198184
                  Atlanta, GA 30384-8184

or by wire transfer as follows:

                  NationsBank, N.A. (South)
                  ABA Number 061-00-0052
                  Account Number 3255807945

or in such other manner as Landlord may notify Tenant:

                  (1) Base Rent in monthly installments in advance, the first
         monthly installment payable concurrently with the execution of this
         Lease and thereafter on or before the first day of each month of the
         Term in the amount set forth on the Schedule.

                  (2) Operating Cost Share Rent in an amount equal to the
         Tenant's Proportionate Share of the excess of Operating Costs for the
         applicable fiscal year of the Lease (the "Excess Operating Costs") over
         the Operating Costs for the Base Year (the "Base Operating Costs"),
         paid monthly in advance in an estimated amount. Definitions of
         Operating Costs and Tenant's Proportionate Share, and the method for
         billing and payment of Operating Cost Share Rent are set forth in
         Sections 2B, 2C and 2D.

                  (3) Tax Share Rent in an amount equal to the Tenant's
         Proportionate Share of the excess of Taxes for the applicable fiscal
         year of this Lease (the "Excess Taxes") over the Taxes for the Base
         Year (the "Base Taxes"), paid monthly in advance in an estimated
         amount. A definition of Taxes and the method for billing and payment of
         Tax Share Rent are set forth in Sections 2B, 2C and 2D.

                  (4) Additional Rent in the amount of all costs, expenses,
         liabilities, and amounts which Tenant is required to pay under this
         Lease, excluding Base Rent, Operating Cost Share Rent, and Tax Share
         Rent, but including any interest for late payment of any item of Rent.


                                       3

<PAGE>   4

                  (5) Rent as used in this Lease means Base Rent, Operating Cost
         Share Rent, Tax Share Rent and Additional Rent. Tenant's agreement to
         pay Rent is an independent covenant, with no right of setoff, deduction
         or counterclaim of any kind.

         B.       Payment of Operating Cost Share Rent and Tax Share Rent.

                  (1) Payment of Estimated Operating Cost Share Rent and Tax
         Share Rent. Landlord shall estimate the Operating Costs and Taxes of
         the Project by April 1 of each fiscal year, or as soon as reasonably
         possible thereafter. Landlord may revise these estimates whenever it
         obtains more accurate information, such as the final real estate tax
         assessment or tax rate for the Project.

                  Within ten (10) days after receiving the original or revised
         estimate from Landlord setting forth (a) an estimate of Operating Costs
         for a particular fiscal year, (b) the Base Operating Costs, and (c) the
         resulting estimate of Excess Operating Costs for such fiscal year,
         Tenant shall pay Landlord one-twelfth (1/12th) of Tenant's
         Proportionate Share of the estimated Excess Operating Costs, multiplied
         by the number of months that have elapsed in the applicable fiscal year
         to the date of such payment including the current month, minus payments
         previously made by Tenant for the months elapsed. On the first day of
         each month thereafter, Tenant shall pay Landlord one-twelfth (1/12th)
         of Tenant's Proportionate Share of this estimate, until a new estimate
         becomes applicable.

                  Within ten (10) days after receiving the original or revised
         estimate from Landlord setting forth (a) an estimate of Taxes for a
         particular fiscal year, (b) the Base Taxes, and (c) the resulting
         estimate of Excess Taxes for such fiscal year, Tenant shall pay
         Landlord one-twelfth (1/12th) of Tenant's Proportionate Share of the
         estimated Excess Taxes, multiplied by the number of months that have
         elapsed in the applicable fiscal year to the date of such payment
         including the current month, minus payments previously made by Tenant
         for the months elapsed. On the first day of each month thereafter,
         Tenant shall pay Landlord one-twelfth (1/12th) of Tenant's
         Proportionate Share of this estimate, until a new estimate becomes
         applicable.

                  (2) Correction of Operating Cost Share Rent. Landlord shall
         deliver to Tenant a report for the previous fiscal year (the "Operating
         Cost Report") by April 1 of each year, or as soon as reasonably
         possible thereafter, setting forth (a) the actual Operating Costs
         incurred, (b) the Base Operating Costs, (c) the amount of Operating
         Cost Share Rent due from Tenant, and (d) the amount of Operating Cost
         Share Rent paid by Tenant. Within twenty (20) days after such delivery,
         Tenant shall pay to Landlord the amount due minus the amount paid. If
         the amount paid exceeds the amount due, Landlord shall apply the excess
         to Tenant's payments of Operating Cost Share Rent next coming due.

                  (3) Correction of Tax Share Rent. Landlord shall deliver to
         Tenant a report for the previous fiscal year (the "Tax Report") by
         April 1 of each year, or as soon as reasonably possible thereafter,
         setting forth (a) the actual Taxes, (b) the Base Taxes, (c) the amount
         of Tax Share Rent due from Tenant, and (d) the amount of Tax Share Rent
         paid by Tenant. Within twenty (20) days after such delivery, Tenant
         shall pay to Landlord the amount due from Tenant minus the amount paid
         by Tenant. If the amount paid exceeds the amount due, Landlord shall
         apply the excess to Tenant's payments of Tax Share Rent next coming
         due.

         C.       Definitions.

                  (1) Included Operating Costs. "Operating Costs" means any
         expenses, costs and disbursements of any kind other than Taxes, paid or
         incurred by Landlord in connection with the management, maintenance,
         operation, insurance, repair and other related activities in connection
         with any part of the Project and of the personal property, fixtures,
         machinery, equipment, systems and apparatus used in connection
         therewith, including the cost of providing those services required to
         be furnished by Landlord under this Lease. Operating Costs shall also
         include the costs of any capital improvements which are intended to
         reduce Operating Costs or improve safety, and those made to keep the
         Project in compliance with governmental requirements applicable from
         time to time (collectively, "Included Capital 

                                       4

<PAGE>   5

         Items"); provided, that the costs of any Included Capital Item shall be
         amortized by Landlord, together with an amount equal to interest at the
         Prime Rate plus one and one-half percent (1.5%) per annum, over the
         estimated useful life of such item and such amortized costs are only
         included in Operating Costs for that portion of the useful life of the
         Included Capital Item which falls within the Term.

                  If the Project is not fully occupied during any portion of any
         fiscal year, Landlord may adjust (an "Equitable Adjustment") Operating
         Costs to equal what would have been incurred by Landlord had the
         Project been fully occupied. This Equitable Adjustment shall apply only
         to Operating Costs which are variable and therefore increase as
         occupancy of the Project increases. Landlord may incorporate the
         Equitable Adjustment in its estimates of Operating Costs.

                  If Landlord does not furnish any particular service whose cost
         would have constituted an Operating Cost to a tenant other than Tenant
         who has undertaken to perform such service itself, Operating Costs
         shall be increased by the amount which Landlord would have incurred if
         it had furnished the service to such tenant.

                  (2)      Excluded Operating Costs. Operating Costs shall not
                           include:

                  (a)      costs of alterations of tenant premises;

                  (b)      costs of capital improvements other than Included
                           Capital Items;

                  (c)      interest and principal payments on mortgages or any
                           other debt costs, or rental payments on any ground
                           lease of the Project;

                  (d)      real estate brokers' leasing commissions;

                  (e)      legal fees, space planner fees and advertising
                           expenses incurred with regard to leasing the Building
                           or portions thereof;

                  (f)      any cost or expenditure for which Landlord is
                           reimbursed, by insurance proceeds or otherwise,
                           except by Operating Cost Share Rent;

                  (g)      the cost of any service furnished to any office
                           tenant of the Project which Landlord does not make
                           available to Tenant;

                  (h)      depreciation (except on any Included Capital Items);

                  (i)      franchise or income taxes imposed upon Landlord,
                           except to the extent imposed in lieu of all or any
                           part of Taxes;

                  (j)      costs of correcting defects in construction of the
                           Building (as opposed to the cost of normal repair,
                           maintenance and replacement expected with the
                           construction materials and equipment installed in the
                           Building in light of their specifications);

                  (k)      legal and auditing fees which are for the benefit of
                           Landlord such as collecting delinquent rents,
                           preparing tax returns and other financial statements,
                           and audits other than those incurred in connection
                           with the preparation of reports required pursuant to
                           Section 2B above;

                  (l)      the wages of any employee for services not related
                           directly to the management, maintenance, operation
                           and repair of the Building; and

                                       5
<PAGE>   6

                  (m)      fines, penalties and interest.

                  (3) Taxes. "Taxes" means any and all taxes, assessments and
         charges of any kind, general or special, ordinary or extraordinary,
         levied against the Project, which Landlord shall pay or become
         obligated to pay in connection with the ownership, leasing, renting,
         management, use, occupancy, control or operation of the Project or of
         the personal property, fixtures, machinery, equipment, systems and
         apparatus used in connection therewith. Taxes shall include real estate
         taxes, personal property taxes, sewer rents, water rents, special or
         general assessments, transit taxes, ad valorem taxes, and any tax
         levied on the rents hereunder or the interest of Landlord under this
         Lease (the "Rent Tax"). Taxes shall also include all fees and other
         costs and expenses paid by Landlord in reviewing any tax and in seeking
         a refund or reduction of any Taxes, whether or not the Landlord is
         ultimately successful.

                  For any year, the amount to be included in Taxes (a) from
         taxes or assessments payable in installments, shall be the amount of
         the installments (with any interest) due and payable during such year,
         and (b) from all other Taxes, shall at Landlord's election be the
         amount accrued, assessed, or otherwise imposed for such year or the
         amount due and payable in such year. Any refund or other adjustment to
         any Taxes by the taxing authority, shall apply during the year in which
         the adjustment is made.

                  Taxes shall not include any net income (except Rent Tax),
         capital, stock, succession, transfer, franchise, gift, estate or
         inheritance tax, except to the extent that such tax shall be imposed in
         lieu of any portion of Taxes.

                  (4) Lease Year. "Lease Year" means each consecutive
         twelve-month period beginning with the Commencement Date, except that
         if the Commencement Date is not the first day of a calendar month, then
         the first Lease Year shall be the period from the Commencement Date
         through the final day of the twelve months after the first day of the
         following month, and each subsequent Lease Year shall be the twelve
         months following the prior Lease Year.

                  (5) Fiscal Year. "Fiscal Year" means the calendar year, except
         that the first fiscal year and the last fiscal year of the Term may be
         a partial calendar year.

         D.       Computation of Base Rent and Rent Adjustments.

                  (1) Prorations. If this Lease begins on a day other than the
         first day of a month, the Base Rent, Operating Cost Share Rent and Tax
         Share Rent shall be prorated for such partial month based on the actual
         number of days in such month. If this Lease begins on a day other than
         the first day, or ends on a day other than the last day, of the fiscal
         year, Operating Cost Share Rent and Tax Share Rent shall be prorated
         for the applicable fiscal year.

                  (2) Default Interest. Any sum due from Tenant to Landlord not
         paid when due shall bear interest from the date due until paid at
         eighteen percent (18%) per annum.

                  (3) Rent Adjustments. The square footage of the Premises and
         the Building set forth in the Schedule are conclusively deemed to be
         the actual square footage thereof, without regard to any subsequent
         remeasurement of the Premises or the Building. If any Operating Cost
         paid in one fiscal year relates to more than one fiscal year, Landlord
         may proportionately allocate such Operating Cost among the related
         fiscal years.

                  (4) Books and Records. Landlord shall maintain books and
         records reflecting the Operating Costs and Taxes in accordance with
         sound accounting and management practices. Tenant and its certified
         public accountant shall have the right to inspect Landlord's records at
         Landlord's office upon at least seventy-two (72) hours' prior notice
         during normal business hours during the ninety (90) days following the
         respective delivery of the Operating Cost Report or the Tax Report. The
         results of any such inspection shall be kept strictly confidential by
         Tenant and its agents, and Tenant and its certified public accountant
         must agree, in their contract for such services, to such
         confidentiality restrictions and shall specifically agree that the
         results shall not be made available to any other tenant of 

                                       6

<PAGE>   7

         the Building. Unless Tenant sends to Landlord any written exception to
         either such report within said ninety (90) day period, such report
         shall be deemed final and accepted by Tenant. Tenant shall pay the
         amount shown on both reports in the manner prescribed in this Lease,
         whether or not Tenant takes any such written exception, without any
         prejudice to such exception. If Tenant makes a timely exception,
         Landlord shall cause its independent certified public accountant to
         issue a final and conclusive resolution of Tenant's exception. Tenant
         shall pay the cost of such certification unless Landlord's original
         determination of annual Operating Costs or Taxes overstated the amounts
         thereof by more than five percent (5%).

                  (5) Miscellaneous. So long as Tenant is in default of any
         obligation under this Lease, Tenant shall not be entitled to any refund
         of any amount from Landlord. If this Lease is terminated for any reason
         prior to the annual determination of Operating Cost Share Rent or Tax
         Share Rent, either party shall pay the full amount due to the other
         within fifteen (15) days after Landlord's notice to Tenant of the
         amount when it is determined. Landlord may commingle any payments made
         with respect to Operating Cost Share Rent or Tax Share Rent, without
         payment of interest.

         3.       PREPARATION AND CONDITION OF PREMISES; POSSESSION AND
SURRENDER OF PREMISES.

         A.       Condition of Premises. Except to the extent of the Tenant
Improvements item on the Schedule, Landlord is leasing the Premises to Tenant
"as is", without any obligation to alter, remodel, improve, repair or decorate
any part of the Premises. Landlord shall cause the Premises to be completed in
accordance with the Tenant Improvement Agreement attached as Appendix C.

         B.       Tenant's Possession. Tenant's taking possession of any portion
of the Premises shall be conclusive evidence that the Premises was in good
order, repair and condition. If Landlord authorizes Tenant to take possession of
any part of the Premises prior to the Commencement Date for purposes of doing
business, all terms of this Lease shall apply to such pre-Term possession,
including Base Rent at the rate set forth for the First Lease Year in the
Schedule prorated for any partial month.

         C.       Maintenance. Throughout the Term, Tenant shall maintain the
Premises in their condition as of the Completion Date, loss or damage caused by
the elements, ordinary wear, and fire and other casualty excepted, and at the
termination of this Lease, or Tenant's right to possession, Tenant shall return
the Premises to Landlord in broom-clean condition. To the extent Tenant fails to
perform either obligation, Landlord may, but need not, restore the Premises to
such condition and Tenant shall pay the cost thereof.

         4.       PROJECT SERVICES.

         Landlord shall furnish services as follows:

         A.       Heating and Air Conditioning. During the normal business hours
of 8:00 a.m. to 6:00 p.m., Monday through Friday, and 8:00 a.m. to 1:00 p.m. on
Saturday, Landlord shall furnish heating and air conditioning to provide a
comfortable temperature, in Landlord's judgment, for normal business operations,
except to the extent Tenant installs equipment which adversely affects the
temperature maintained by the air conditioning system. If Tenant installs such
equipment, Landlord may install supplementary air conditioning units in the
Premises, and Tenant shall pay to Landlord upon demand as Additional Rent the
cost of installation, operation and maintenance thereof.

         Landlord shall furnish heating and air conditioning after business
hours if Tenant provides Landlord reasonable prior notice, and pays Landlord all
then current charges for such additional heating or air conditioning.

         B.       Elevators. Landlord shall provide passenger elevator service
during normal business hours to Tenant in common with Landlord and all other
tenants. Landlord shall provide limited passenger service at other times, except
in case of


                                       7

<PAGE>   8

an emergency. Landlord shall provide freight elevator service at reasonable
hours at Tenant's request, subject to scheduling by the Landlord and payment for
the service by Tenant.

         C.       Electricity. Landlord shall provide sufficient electricity to
operate normal office lighting and equipment. Tenant shall not install or
operate in the Premises any electrically operated equipment or other machinery,
other than business machines and equipment normally employed for general office
use which do not require high electricity consumption for operation, without
obtaining the prior written consent of Landlord. If any or all of Tenant's
equipment requires electricity consumption in excess of that which is necessary
to operate normal office equipment, such consumption (including consumption for
computer or telephone rooms and special HVAC equipment) shall be submetered by
Landlord at Tenant's expense, and Tenant shall reimburse Landlord as Additional
Rent for the cost of its submetered consumption based upon Landlord's average
cost of electricity. Such Additional Rent shall be in addition to Tenant's
obligations pursuant to Section 2A(2) to pay its Proportionate Share of
Operating Costs.

         D.       Water. Landlord shall furnish hot and cold tap water for
drinking and toilet purposes. Tenant shall pay Landlord for water furnished for
any other purpose as Additional Rent at rates fixed by Landlord. Tenant shall
not permit water to be wasted.

         E.       Janitorial Service. Landlord shall furnish janitorial service
as generally provided to other tenants in the Building.

         F.       Interruption of Services. If any of the Building equipment or
machinery ceases to function properly for any cause Landlord shall use
reasonable diligence to repair the same promptly. Landlord's inability to
furnish, to any extent, the Project services set forth in this Section 4, or any
cessation thereof resulting from any causes, including any entry for repairs
pursuant to this Lease, and any renovation, redecoration or rehabilitation of
any area of the Building shall not render Landlord liable for damages to either
person or property or for interruption or loss to Tenant's business, nor be
construed as an eviction of Tenant, nor work an abatement of any portion of
Rent, nor relieve Tenant from fulfillment of any covenant or agreement hereof.
However, in the event that an interruption of the Project services set forth in
this Section 4 causes the Premises to be untenantable for a period of at least
three (3) business days, monthly Rent shall be thereafter abated
proportionately.

         G.       Services Standard. During the Term, Landlord will use
reasonable efforts to cause the Building to be operated and managed in
accordance with the standards of other similar class A, multi-tenant office
buildings (using a so-called basket approach, and not by reference to any one
specific office building) now located within the central perimeter submarket of
Atlanta, Georgia (bounded on the west by Roswell Road and I-285, on the east by
Chamblee Dunwoody Road and I-285, on the north by Northridge Road, and on the
south by the Glenridge Connector; the "Geographic Area"), provided that Landlord
shall not be obligated to incur capital expenditures not reimbursable as
Operating Costs under this Lease in order to comply with such agreement, and
provided further that nothing contained in this sentence is intended to or shall
be construed to require Landlord to provide any services other than those
expressly set forth in this Lease, and provided further, electrical, heat, air
conditioning and janitorial service shall be deemed to satisfy the requirements
set forth in this sentence if such services satisfy the applicable standards set
forth in this Lease.

         5.       ALTERATIONS AND REPAIRS.

         A.       Landlord's Consent and Conditions.

         Tenant shall not make any improvements or alterations to the Premises
(the "Work") without in each instance submitting plans and specifications for
the Work to Landlord and obtaining Landlord's prior written consent unless (a)
the cost thereof is less than $25,000.00, (b) such Work does not impact the base
structural components or systems of the Building, (c) such Work will not impact
any other tenant's premises, and (d) such Work is not visible from outside the
Premises. Tenant shall pay Landlord's standard charge of $500.00 for review of
the plans and all other items submitted by Tenant. Landlord will be deemed to be
acting reasonably in withholding its consent for any Work which (a) impacts the
base structural components or systems of the Building, (b) impacts any other
tenant's premises, or (c) is visible from outside the Premises.

                                       8

<PAGE>   9


         Tenant shall pay for the cost of all Work. All Work shall become the
property of Landlord upon its installation, except for Tenant's trade fixtures
and for items which Landlord requires Tenant to remove at Tenant's cost at the
termination of the Lease pursuant to Section 3E.

         The following requirements shall apply to all Work:

                  (1)      Prior to commencement, Tenant shall furnish to
         Landlord building permits, certificates of insurance satisfactory to
         Landlord, and, at Landlord's request, security for payment of all
         costs.

                  (2)      Tenant shall perform all Work so as to maintain peace
         and harmony among other contractors serving the Project and shall avoid
         interference with other work to be performed or services to be rendered
         in the Project.

                  (3)      The Work shall be performed in a good and workmanlike
         manner, meeting the standard for construction and quality of materials
         in the Building, and shall comply with all insurance requirements and
         all applicable governmental laws, ordinances and regulations
         ("Governmental Requirements").

                  (4)      Tenant shall perform all Work so as to minimize or
         prevent disruption to other tenants, and Tenant shall comply with all
         reasonable requests of Landlord in response to complaints from other
         tenants.

                  (5)      Tenant shall perform all Work in compliance with
         Landlord's "Policies, Rules and Procedures for Construction Projects"
         in effect at the time the Work is performed.

                  (6)      Tenant shall permit Landlord to supervise all Work.
         Landlord may charge a supervisory fee not to exceed five percent (5%)
         of labor, material, and all other costs of the Work, if Landlord's
         employees or contractors perform the Work.

                  (7)      Upon completion, Tenant shall furnish Landlord with
         contractor's affidavits and full and final statutory waivers of liens,
         as-built plans and specifications, and receipted bills covering all
         labor and materials, and all other close-out documentation required in
         Landlord's "Policies, Rules and Procedures for Construction Projects".

         B.       Damage to Systems. If any part of the mechanical, electrical
or other systems in the Premises shall be damaged, Tenant shall promptly notify
Landlord, and Landlord shall repair such damage. Landlord may also at any
reasonable time make any repairs or alterations which Landlord deems necessary
for the safety or protection of the Project, or which Landlord is required to
make by any court or pursuant to any Governmental Requirement. Tenant shall at
its expense make all other repairs necessary to keep the Premises, and Tenant's
fixtures and personal property, in good order, condition and repair; to the
extent Tenant fails to do so, Landlord may make such repairs itself. The cost of
any repairs made by Landlord on account of Tenant's default, or on account of
the misuse or neglect by Tenant or its invitees, contractors or agents anywhere
in the Project, shall become Additional Rent payable by Tenant on demand.

         C.       No Liens. Tenant has no authority to cause or permit any lien
or encumbrance of any kind to affect Landlord's interest in the Project; any
such lien or encumbrance shall attach to Tenant's interest only. If any
mechanic's lien shall be filed or claim of lien made for work or materials
furnished to Tenant, then Tenant shall at its expense within ten (10) days
thereafter either discharge or contest the lien or claim. If Tenant contests the
lien or claim, then Tenant shall (i) within such ten (10) day period, provide
Landlord adequate security for the lien or claim, (ii) contest the lien or claim
in good faith by appropriate proceedings that operate to stay its enforcement,
and (iii) pay promptly any final adverse judgment entered in any such
proceeding. If Tenant does not comply with these requirements, Landlord may
discharge the lien or claim, and the amount paid, as well as attorney's fees and
other expenses incurred by Landlord, shall become Additional Rent payable by
Tenant on demand.

                                       9

<PAGE>   10


         D.       Ownership of Improvements. All Work as defined in this Section
5, partitions, hardware, equipment, machinery and all other improvements and all
fixtures except trade fixtures, constructed in the Premises by either Landlord
or Tenant, (i) shall become Landlord's property upon installation without
compensation to Tenant, unless Landlord consents otherwise in writing, and (ii)
shall at Landlord's option either (a) be surrendered to Landlord with the
Premises at the termination of the Lease or of Tenant's right to possession, or
(b) be removed in accordance with Subsection 5E below (unless Landlord at the
time it gives its consent to the performance of such construction expressly
waives in writing the right to require such removal).

         E.       Removal at Termination. Upon the termination of this Lease or
Tenant's right of possession Tenant shall remove from the Project its trade
fixtures, furniture, moveable equipment and other personal property, any
improvements which Landlord elects shall be removed by Tenant pursuant to
Section 5D, and any improvements to any portion of the Project other than the
Premises. Tenant shall repair all damage caused by the installation or removal
of any of the foregoing items. If Tenant does not timely remove such property,
then Tenant shall be conclusively presumed to have, at Landlord's election (i)
conveyed such property to Landlord without compensation or (ii) abandoned such
property, and Landlord may dispose of or store any part thereof in any manner at
Tenant's sole cost, without waiving Landlord's right to claim from Tenant all
expenses arising out of Tenant's failure to remove the property, and without
liability to Tenant or any other person. Landlord shall have no duty to be a
bailee of any such personal property. If Landlord elects abandonment, Tenant
shall pay to Landlord, upon demand, any expenses incurred for disposition.

         6.       USE OF PREMISES. Tenant shall use the Premises only for
general office purposes. Tenant shall not allow any use of the Premises which
will negatively affect the cost of coverage of Landlord's insurance on the
Project. Tenant shall not allow any inflammable or explosive liquids or
materials to be kept on the Premises. Tenant shall not allow any use of the
Premises which would cause the value or utility of any part of the Premises to
diminish or would interfere with any other Tenant or with the operation of the
Project by Landlord. Tenant shall not permit any nuisance or waste upon the
Premises, or allow any offensive noise or odor in or around the Premises.

         If any governmental authority shall deem the Premises to be a "place of
public accommodation" under the Americans with Disabilities Act or any other
comparable law as a result of Tenant's use, Tenant shall either modify its use
to cause such authority to rescind its designation or be responsible for any
alterations, structural or otherwise, required to be made to the Building or the
Premises under such laws.

         7.       GOVERNMENTAL REQUIREMENTS AND BUILDING RULES. Tenant shall
comply with all Governmental Requirements applying to its use of the Premises.
Tenant shall also comply with all reasonable rules established for the Project
from time to time by Landlord. The present rules and regulations are contained
in Appendix B. Failure by another tenant to comply with the rules or failure by
Landlord to enforce them shall not relieve Tenant of its obligation to comply
with the rules or make Landlord responsible to Tenant in any way. Landlord shall
use reasonable efforts to apply the rules and regulations uniformly with respect
to Tenant and tenants in the Building under leases containing rules and
regulations similar to this Lease. In the event of alterations and repairs
performed by Tenant, Tenant shall comply with the provisions of Section 5 of
this Lease and also Landlord's "Policies, Rules and Regulations for Construction
Projects".

         8.       WAIVER OF CLAIMS; INDEMNIFICATION; INSURANCE.

         A. Waiver of Claims. To the extent permitted by law, Tenant waives any
claims it may have against Landlord or its officers, directors, employees or
agents for business interruption or damage to property sustained by Tenant as
the result of any act or omission of Landlord.

         To the extent permitted by law, Landlord waives any claims it may have
against Tenant or its officers, directors, employees or agents for loss of rents
(other than Rent) or damage to property sustained by Landlord as the result of
any act or omission of Tenant.

                                       10

<PAGE>   11


         B.       Indemnification. Tenant shall indemnify, defend and hold
harmless Landlord and its officers, directors, employees and agents against any
claim by any third party for injury to any person or damage to or loss of any
property occurring in the Project and arising from the use of the Premises
(unless caused by the willful misconduct or gross negligence of Landlord) or
from any other act or omission or negligence of Tenant or any of Tenant's
employees or agents. Tenant's obligations under this section shall survive the
termination of this Lease.

         Landlord shall indemnify, defend and hold harmless Tenant and its
officers, directors, employees and agents against any claim by any third party
for injury to any person or damage to or loss of any property occurring in the
Project and arising from any other act or omission or negligence of Landlord or
any of Landlord's employees or agents.
Landlord's obligations under this section shall survive the termination of this
Lease.

         C.       Tenant's Insurance. Tenant shall maintain insurance as
follows, with such other terms, coverages and insurers, as Landlord shall
reasonably require from time to time:

                  (1)      Commercial General Liability Insurance, with (a)
         Contractual Liability including the indemnification provisions
         contained in this Lease, (b) a severability of interest endorsement,
         (c) limits of not less than One Million Dollars ($1,000,000) combined
         single limit per occurrence and not less than Two Million Dollars
         ($2,000,000) in the aggregate for bodily injury, sickness or death, and
         property damage, and umbrella coverage of not less than Three Million
         Dollars ($3,000,000).

                  (2)      Property Insurance against "All Risks" of physical
         loss covering the replacement cost of all improvements, fixtures and
         personal property. Tenant waives all rights of subrogation, and
         Tenant's property insurance shall include a waiver of subrogation in
         favor of Landlord.

                  (3)      Workers' compensation or similar insurance in form
         and amounts required by law, and Employer's Liability with not less
         than the following limits:

<TABLE>
                        <S>                                <C>     
                        Each Accident                      $500,000
                        Disease--Policy Limit              $500,000
                        Disease--Each Employee             $500,000
</TABLE>

                  Such insurance shall contain a waiver of subrogation provision
         in favor of Landlord and its agents.

         Tenant's insurance shall be primary and not contributory to that
carried by Landlord, its agents, or mortgagee. Landlord, and if any, Landlord's
building manager or agent and ground lessor shall be named as additional
insureds as respects to insurance required of the Tenant in Section 8C(1). The
company or companies writing any insurance which Tenant is required to maintain
under this Lease, as well as the form of such insurance, shall at all times be
subject to Landlord's approval, and any such company shall be licensed to do
business in the state in which the Building is located. Such insurance companies
shall have a A.M. Best rating of A VI or better.

         Tenant shall cause any contractor of Tenant performing work on the
Premises to maintain insurance as follows, with such other terms, coverages and
insurers, as Landlord shall reasonably require from time to time:

                  (1)      Commercial General Liability Insurance, including
         contractor's liability coverage, contractual liability coverage,
         completed operations coverage, broad form property damage endorsement,
         and contractor's protective liability coverage, to afford protection
         with limits, for each occurrence, of not less than One Million Dollars
         ($1,000,000) with respect to personal injury, death or property damage.

                  (2)      Workers' compensation or similar insurance in form
         and amounts required by law, and Employer's Liability with not less
         than the following limits:

                                       11

<PAGE>   12

<TABLE>
                        <S>                                <C>     
                        Each Accident                      $500,000
                        Disease--Policy Limit              $500,000
                        Disease--Each Employee             $500,000
</TABLE>

                  Such insurance shall contain a waiver of subrogation provision
         in favor of Landlord and its agents.

         Tenant's contractor's insurance shall be primary and not contributory
to that carried by Tenant, Landlord, their agents or mortgagees. Tenant and
Landlord, and if any, Landlord's building manager or agent, mortgagee or ground
lessor shall be named as additional insured on Tenant's contractor's insurance
policies.

         D.       Insurance Certificates. Tenant shall deliver to Landlord
certificates evidencing all required insurance no later than five (5) days prior
to the Commencement Date and each renewal date. Each certificate will provide
for thirty (30) days prior written notice of cancellation to Landlord and
Tenant.

         E.       Landlord's Insurance. Landlord shall maintain "All-Risk"
property insurance at replacement cost, including loss of rents, on the
Building, and Commercial General Liability insurance policies covering the
common areas of the Building, each with such terms, coverages and conditions as
are normally carried by reasonably prudent owners of properties similar to the
Project. With respect to property insurance, Landlord and Tenant mutually waive
all rights of subrogation, and the respective "All-Risk" coverage property
insurance policies carried by Landlord and Tenant shall contain enforceable
waiver of subrogation endorsements.

         9.       FIRE AND OTHER CASUALTY.

         A.       Termination. If a fire or other casualty causes substantial
damage to the Building or the Premises, Landlord shall engage a registered
architect to certify within one (1) month of the casualty to both Landlord and
Tenant the amount of time needed to restore the Building and the Premises to
tenantability, using standard working methods. If the time needed exceeds nine
(9) months from the date of damage occurrence, or two (2) months therefrom if
the restoration would begin during the last nine (9) months of the Lease, then
in the case of the Premises, either Landlord or Tenant may terminate this Lease,
and in the case of the Building, Landlord may terminate this Lease, by notice to
the other party within ten (10) days after the notifying party's receipt of the
architect's certificate. The termination shall be effective thirty (30) days
from the date of the notice and Rent shall be paid by Tenant to that date, with
an abatement for any portion of the Premises which has been untenantable after
the casualty.

         B.       Restoration. If a casualty causes damage to the Building or
the Premises but this Lease is not terminated for any reason, then subject to
the rights of any mortgagees or ground lessors, Landlord shall obtain the
applicable insurance proceeds and diligently restore the Building and the
Premises subject to current Governmental Requirements. Tenant shall replace its
damaged improvements, personal property and fixtures. Rent shall be abated on a
per diem basis during the restoration for any portion of the Premises which is
untenantable, except to the extent that Tenant's negligence caused the casualty.

         10.      EMINENT DOMAIN. If a part of the Project is taken by eminent
domain or deed in lieu thereof which is so substantial that the Premises cannot
reasonably be used by Tenant for the operation of its business, then either
party may terminate this Lease effective as of the date of the taking. If any
substantial portion of the Project is taken without affecting the Premises, then
Landlord may terminate this Lease as of the date of such taking. Rent shall
abate from the date of the taking in proportion to any part of the Premises
taken. The entire award for a taking of any kind shall be paid to Landlord, and
Tenant shall have no right to share in the award. All obligations accrued to the
date of the taking shall be performed by the party liable to perform said
obligations, as set forth herein.

                                       12

<PAGE>   13

         11.      RIGHTS RESERVED TO LANDLORD.

         Landlord may exercise at any time any of the following rights
respecting the operation of the Project without liability to the Tenant of any
kind:

         A.       Name. To change the name or street address of the Building or
the suite number(s) of the Premises.

         B.       Signs. To install and maintain any signs on the exterior and
in the interior of the Building, and to approve at its sole discretion, prior to
installation, any of Tenant's signs in the Premises visible from the common
areas or the exterior of the Building.

         C.       Window Treatments. To approve, at its discretion, prior to
installation, any shades, blinds, ventilators or window treatments of any kind,
as well as any lighting within the Premises that may be visible from the
exterior of the Building or any interior common area.

         D.       Keys. To retain and use at any time passkeys to enter the
Premises or any door within the Premises. Tenant shall not alter or add any lock
or bolt.

         E.       Access. To have access to inspect the Premises, and to perform
its obligations, or make repairs, alterations, additions or improvements, as
permitted by this Lease.

         F.       Preparation for Reoccupancy.  Intentionally Omitted.

         G.       Heavy Articles. To approve the weight, size, placement and
time and manner of movement within the Building of any safe, central filing
system or other heavy article of Tenant's property. Tenant shall move its
property entirely at its own risk.

         H.       Show Premises. To show the Premises to prospective purchasers,
tenants, brokers, lenders, investors, rating agencies or others at any
reasonable time, provided that Landlord gives prior notice to Tenant and does
not materially interfere with Tenant's use of the Premises.

         I.       Relocation of Tenant. Intentionally Omitted.

         J.       Use of Lockbox. To designate a lockbox collection agent for
collections of amounts due Landlord. In that case, the date of payment of Rent
or other sums shall be the date of the agent's receipt of such payment or the
date of actual collection if payment is made in the form of a negotiable
instrument thereafter dishonored upon presentment. However, Landlord may reject
any payment for all purposes as of the date of receipt or actual collection by
mailing to Tenant within 21 days after such receipt or collection a check equal
to the amount sent by Tenant.

         K.       Repairs and Alterations. To make repairs or alterations to the
Project and in doing so transport any required material through the Premises, to
close entrances, doors, corridors, elevators and other facilities in the
Project, to open any ceiling in the Premises, or to temporarily suspend services
or use of common areas in the Building. Landlord may perform any such repairs or
alterations during ordinary business hours so long as such work does not
materially interfere with Tenant's business, except that Tenant may require any
Work in the Premises to be done after business hours if Tenant pays Landlord for
overtime and any other expenses incurred. Landlord may do or permit any work on
any nearby building, land, street, alley or way.

         L.       Landlord's Agents. If Tenant is in default under this Lease,
possession of Tenant's funds or negotiation of Tenant's negotiable instrument by
any of Landlord's agents shall not waive any breach by Tenant or any remedies of
Landlord under this Lease.

                                       13

<PAGE>   14


         M.       Building Services. To install, use and maintain through the
Premises, pipes, conduits, wires and ducts serving the Building, provided that
such installation, use and maintenance does not unreasonably interfere with
Tenant's use of the Premises.

         N.       Other Actions. To take any other action which Landlord deems
reasonable in connection with the operation, maintenance or preservation of the
Building.

         12.      TENANT'S DEFAULT.

         Any of the following shall constitute a default by Tenant:

         A.       Rent Default. Tenant fails to pay any Rent when due, and in
the case of only the first two (2) such failures in any 12 consecutive months,
such failure continues for five (5) days from the date of Landlord's notice;

         B.       Assignment/Sublease or Hazardous Substances Default. Tenant
defaults in its obligations under Section 17 Assignment and Sublease or Section
28 Hazardous Substances;

         C.       Other Performance Default. Tenant fails to perform any other
obligation to Landlord under this Lease, and, in the case of only the first
failure during the Term of this Lease with respect to a particular provision,
this failure continues for ten (10) days after written notice from Landlord,
except that if Tenant begins to cure its failure within the ten (10) day period
but cannot reasonably complete its cure within such period, then, so long as
Tenant continues to diligently attempt to cure its failure, the ten (10) day
period shall be extended to sixty (60) days, or such lesser period as is
reasonably necessary to complete the cure;

         D.       Credit Default.  One of the following credit defaults occurs:

                  (1)      Tenant commences any proceeding under any law
         relating to bankruptcy, insolvency, reorganization or relief of debts,
         or seeks appointment of a receiver, trustee, custodian or other similar
         official for the Tenant or for any substantial part of its property, or
         any such proceeding is commenced against Tenant and either remains
         undismissed for a period of thirty days or results in the entry of an
         order for relief against Tenant which is not fully stayed within seven
         days after entry;

                  (2)      Tenant becomes insolvent or bankrupt, does not
         generally pay its debts as they become due, or admits in writing its
         inability to pay its debts, or makes a general assignment for the
         benefit of creditors;

                  (3)      Any third party obtains a levy or attachment under
         process of law against Tenant's leasehold interest.

         E.       Vacation or Abandonment Default. Tenant vacates or abandons
the Premises and any Rent is past due.

         13.      LANDLORD REMEDIES.

         A.       Termination of Lease or Possession. If Tenant defaults,
Landlord may elect by notice to Tenant either to terminate this Lease or to
terminate Tenant's possession of the Premises without terminating this Lease. In
either case, Tenant shall immediately vacate the Premises and deliver possession
to Landlord, and Landlord may repossess the Premises and may, at Tenant's sole
cost, remove any of Tenant's signs and any of its other property, without
relinquishing its right to receive Rent or any other right against Tenant.
Tenant shall remain liable for the payment of all Rent accruing after any writ
of possession as to the Premises is issued to Landlord.

         B.       Lease Termination Damages. If Landlord terminates the Lease, 
Tenant shall pay to Landlord all Rent due on or before the date of termination,
plus Landlord's reasonable estimate of the aggregate Rent that would have been
payable from the date of termination through the Termination Date, reduced by
the rental value of the Premises calculated as of the date of 

                                       14

<PAGE>   15

termination for the same period, taking into account anticipated vacancy prior
to reletting, reletting expenses and market concessions, both discounted to
present value at the rate of five percent (5%) per annum. If Landlord shall
relet any part of the Premises for any part of such period before such present
value amount shall have been paid by Tenant or finally determined by a court,
then the amount of Rent payable pursuant to such reletting (taking into account
vacancy prior to reletting and any reletting expenses or concessions) shall be
deemed to be the reasonable rental value for that portion of the Premises relet
during the period of the reletting.

         C.       Possession Termination Damages. If Landlord terminates 
Tenant's right to possession without terminating the Lease and Landlord takes
possession of the Premises itself, Landlord may relet any part of the Premises
for such Rent, for such time, and upon such terms as Landlord in its sole
discretion shall determine, without any obligation to do so prior to renting
other vacant areas in the Building. Any proceeds from reletting the Premises
shall first be applied to the expenses of reletting, including redecoration,
repair, alteration, advertising, brokerage, legal, and other reasonably
necessary expenses. If the reletting proceeds after payment of expenses are
insufficient to pay the full amount of Rent under this Lease, Tenant shall pay
such deficiency to Landlord monthly upon demand as it becomes due. Any excess
proceeds shall be retained by Landlord.

         D.       Landlord's Remedies Cumulative. All of Landlord's remedies 
under this Lease shall be in addition to all other remedies Landlord may have at
law or in equity. Waiver by Landlord of any breach of any obligation by Tenant
shall be effective only if it is in writing, and shall not be deemed a waiver of
any other breach, or any subsequent breach of the same obligation. Landlord's
acceptance of payment by Tenant shall not constitute a waiver of any breach by
Tenant, and if the acceptance occurs after Landlord's notice to Tenant, or
termination of the Lease or of Tenant's right to possession, the acceptance
shall not affect such notice or termination. Acceptance of payment by Landlord
after commencement of a legal proceeding or final judgment shall not affect such
proceeding or judgment. Landlord may advance such monies and take such other
actions for Tenant's account as reasonably may be required to cure or mitigate
any default by Tenant. Tenant shall immediately reimburse Landlord for any such
advance, and such sums shall bear interest at the default interest rate until
paid.

         E.       WAIVER OF TRIAL BY JURY. EACH PARTY WAIVES TRIAL BY JURY IN 
THE EVENT OF ANY LEGAL PROCEEDING BROUGHT BY THE OTHER IN CONNECTION WITH THIS
LEASE. EACH PARTY SHALL BRING ANY ACTION AGAINST THE OTHER IN CONNECTION WITH
THIS LEASE IN A FEDERAL OR STATE COURT LOCATED IN GEORGIA, CONSENTS TO THE
JURISDICTION OF SUCH COURTS, AND WAIVES ANY RIGHT TO HAVE ANY PROCEEDING
TRANSFERRED FROM SUCH COURTS ON THE GROUND OF IMPROPER VENUE OR INCONVENIENT
FORUM.

         F.       Litigation Costs. In any judgment where a party is proven to 
be in breach of this Lease Agreement, the losing party shall pay the prevailing
party's reasonable attorneys' fees and other costs in enforcing this Lease,
whether in litigation or arbitration.

         14.      SURRENDER. Upon termination of this Lease or Tenant's right to
possession, Tenant shall return the Premises to Landlord in good order and
condition, ordinary wear and casualty damage excepted. If Landlord requires
Tenant to remove any alterations, then Tenant shall remove the alterations in a
good and workmanlike manner and restore the Premises to its condition prior to
their installation.

         15.      HOLDOVER. Tenant shall have no right to holdover possession of
the Premises after the expiration or termination of this Lease without
Landlord's prior written consent, which consent may be withheld in Landlord's
sole and absolute discretion. If Tenant retains possession of any part of the
Premises after the Term, Tenant shall become a month-to-month tenant for the
entire Premises upon all of the terms of this Lease as might be applicable to
such month-to-month tenancy, except that Tenant shall pay all of Base Rent,
Operating Cost Share Rent and Tax Share Rent at one hundred and fifty percent
(150%) of the rate in effect immediately prior to such holdover, computed on a
monthly basis for each full or partial month Tenant remains in possession.
Tenant shall also pay Landlord all of Landlord's direct damages resulting from
Tenant's holdover. No acceptance of Rent or other payments by Landlord under
these holdover provisions shall operate as a waiver of Landlord's right to
regain possession or any other of Landlord's remedies. See Special Stipulations
6.


                                       15

<PAGE>   16

         16.      SUBORDINATION TO GROUND LEASES AND MORTGAGES.

         A.       Subordination and Non-Disturbance. This Lease shall be 
subordinate to any present or future ground lease or mortgage respecting the
Project, and any amendments to such ground lease or mortgage, at the election of
the ground lessor or mortgagee as the case may be, effected by notice to Tenant
in the manner provided in this Lease. The subordination shall be effective upon
such notice, but at the request of Landlord or ground lessor or mortgagee,
Tenant shall within ten (10) days of the request, execute and deliver to the
requesting party any reasonable documents provided to evidence the
subordination. Any mortgagee has the right, at its option, to subordinate its
mortgage to the terms of this Lease, without notice to, nor the consent of,
Tenant. At any time that the project is made subject to any ground lease or
mortgage, Landlord shall use reasonable efforts to cause the mortgagee or ground
lessor to deliver to Tenant a non-disturbance agreement reasonably acceptable to
Tenant, providing that so long as Tenant is not in default under this Lease
after the expiration of any applicable notice and cure periods, Tenant may
remain in possession of the Premises under the terms of this Lease, even if the
ground lessor should terminate the ground lease or if the mortgagee or its
successor should acquire Landlord's title to the Project.

         B.       Termination of Ground Lease or Foreclosure of Mortgage. If any
ground lease is terminated or mortgage foreclosed or deed in lieu of foreclosure
given and the ground lessor, mortgagee, or purchaser at a foreclosure sale shall
thereby become the owner of the Project, Tenant shall attorn to such ground
lessor or mortgagee or purchaser without any deduction or setoff by Tenant, and
this Lease shall continue in effect as a direct lease between Tenant and such
ground lessor, mortgagee or purchaser. The ground lessor or mortgagee or
purchaser shall be liable as Landlord only during the time such ground lessor or
mortgagee or purchaser is the owner of the Project. At the request of Landlord,
ground lessor or mortgagee, Tenant shall execute and deliver within ten (10)
days of the request any document furnished by the requesting party to evidence
Tenant's agreement to attorn.

         C.       Security Deposit. Any ground lessor or mortgagee shall be
responsible for the return of any security deposit by Tenant only to the extent
the security deposit is received by such ground lessor or mortgagee.

         D.       Notice and Right to Cure. The Project is subject to any ground
lease and mortgage identified with name and address of ground lessor or
mortgagee in Appendix D to this Lease (as the same may be amended from time to
time by written notice to Tenant). Tenant agrees to send by registered or
certified mail to any ground lessor or mortgagee identified either in such
Appendix or in any later notice from Landlord to Tenant a copy of any notice of
default sent by Tenant to Landlord. If Landlord fails to cure such default
within the required time period under this Lease, but ground lessor or mortgagee
begins to cure within ten (10) days after such period and proceeds diligently to
complete such cure, then ground lessor or mortgagee shall have such additional
time as is necessary to complete such cure, including any time necessary to
obtain possession if possession is necessary to cure, and Tenant shall not begin
to enforce its remedies so long as the cure is being diligently pursued.

         E.       Definitions. As used in this Section 16, "mortgage" shall 
include "deed of trust" and/or "trust deed" and "mortgagee" shall include
"beneficiary" and/or "trustee", "mortgagee" shall include the mortgagee of any
ground lessee, and "ground lessor", "mortgagee", and "purchaser at a foreclosure
sale" shall include, in each case, all of its successors and assigns, however
remote.

         17.      ASSIGNMENT AND SUBLEASE.

         A.       In General. Tenant shall not, without the prior consent of 
Landlord in each case, (i) make or allow any assignment or transfer, by
operation of law or otherwise, of any part of Tenant's interest in this Lease,
(ii) grant or allow any lien or encumbrance, by operation of law or otherwise,
upon any part of Tenant's interest in this Lease, (iii) sublet any part of the
Premises, or (iv) permit anyone other than Tenant and its employees to occupy
any part of the Premises. Tenant shall remain primarily liable for all of its
obligations under this Lease, notwithstanding any assignment or transfer. No
consent granted by Landlord shall be deemed to be a consent to any subsequent
assignment or transfer, lien or encumbrance, sublease or occupancy. Tenant shall
pay all of Landlord's attorneys' fees and other expenses incurred in connection
with any consent requested by Tenant or in reviewing any proposed assignment or
subletting. Any assignment or transfer, grant of lien or encumbrance, or
sublease or occupancy without Landlord's prior written consent shall be void. If
Tenant shall assign this Lease or sublet the Premises in its 

                                       16

<PAGE>   17

entirety any rights of Tenant to renew this Lease, extend the Term or to lease
additional space in the Project shall be extinguished thereby and will not be
transferred to the assignee or subtenant, all such rights being personal to the
Tenant named herein.

         B.       Landlord's Consent. Landlord will not unreasonably withhold 
its consent to any proposed assignment or subletting. It shall be reasonable for
Landlord to withhold its consent to any assignment or sublease if (i) Tenant is
in default under this Lease, (ii) during the initial ninety (90) days of
Tenant's effort to market the Premises for sublease, the proposed assignee or
sublessee is a tenant in the Project or an affiliate of such a tenant or a party
that Landlord has identified as a prospective tenant in the Project, (iii) the
nature of business, and character of the proposed assignee or subtenant are not
reasonably satisfactory to Landlord, (iv) in the reasonable judgment of Landlord
the purpose for which the assignee or subtenant intends to use the Premises (or
a portion thereof) is not in keeping with Landlord's standards for the Building
or are in violation of the terms of this Lease or any other leases in the
Project, (v) the proposed assignee or subtenant is a government entity. The
foregoing shall not exclude any other reasonable basis for Landlord to withhold
its consent.

         C.       Procedure. Tenant shall notify Landlord of any proposed 
assignment or sublease at least thirty (30) days prior to its proposed effective
date. The notice shall include the name and address of the proposed assignee or
subtenant, its corporate affiliates in the case of a corporation and its
partners in a case of a partnership, an execution copy of the proposed
assignment or sublease, and sufficient information to permit Landlord to
determine the financial responsibility and character of the proposed assignee or
subtenant. As a condition to any effective assignment of this Lease, the
assignee shall execute and deliver in form satisfactory to Landlord at least
fifteen (15) days prior to the effective date of the assignment, an assumption
of all of the obligations of Tenant under this Lease. As a condition to any
effective sublease, subtenant shall execute and deliver in form satisfactory to
Landlord at least fifteen (15) days prior to the effective date of the sublease,
an agreement to comply with all of Tenant's obligations under this Lease, and at
Landlord's option, an agreement (except for the economic obligations which
subtenant will undertake directly to Tenant) to attorn to Landlord under the
terms of the sublease in the event this Lease terminates before the sublease
expires.

         D.       Change of Management or Ownership.

                  (1) Any transfer of the direct or indirect power to affect the
management or policies of Tenant or direct or indirect change in 25% or more of
the ownership interest in Tenant (any of the foregoing in this Subsection D
being herein sometimes referred to as an "Ownership Transfer") shall constitute
an assignment of this Lease. Notwithstanding the foregoing in this Subsection D
to the contrary if Tenant shall be a corporation whose stock is publicly traded
on a nationally recognized securities exchange (including the NASDAQ
over-the-counter market), then, except with respect to an Ownership Transfer in
connection with the merger or consolidation of Tenant and except with respect to
an Ownership Transfer in connection with the sale of all or substantially all of
the assets of Tenant, any Ownership Transfer shall not be deemed to be an
assignment of this Lease. In any event, any Ownership Transfer in connection
with the merger or consolidation of Tenant or in connection with the sale of all
or substantially all of the assets of Tenant shall constitute an assignment of
this Lease.

                  (2) Notwithstanding the foregoing, if no default on the part
of Tenant has occurred and is continuing, Tenant may assign this Lease to an
entity into which Tenant is merged or consolidated or to an entity to which
substantially all of Tenant's assets are transferred, without first obtaining
Landlord's written consent, if Tenant notifies Landlord prior to the proposed
transaction, providing information satisfactory to Landlord in order to
determine the net worth both of the successor entity and of Tenant immediately
prior to such assignment, and showing the net worth of the successor to be at
least equal to the net worth of Tenant.

         E.       Excess Payments. If Tenant shall assign this Lease or sublet 
any part of the Premises to any entity that is not an Affiliate of Tenant for
consideration in excess of the pro-rata portion of Rent applicable to the space
subject to the assignment or sublet, then Tenant shall pay to Landlord as
Additional Rent 50% of any such excess (net of Tenant's Transfer Costs, as
defined below) immediately upon receipt. "Tenant's Transfer Costs" means the
outstanding balance from time to time of the sum of the following items: (1) the
cost of any additional tenant improvements required for the assignment of this
Lease or the subleasing of such portion of the Premises paid by Tenant; (2)
reasonable leasing commissions paid by Tenant in connection with the assignment
or sublease to the transferee, not to exceed the amount of such commissions
customarily payable with respect to 


                                       17

<PAGE>   18

the leasing of office space in the Geographic Area; (3) rent abatements and
other reasonable concessions granted by Tenant in connection with such
assignment or sublease; and (4) reasonable marketing expenses paid directly by
Tenant to assign this Lease or sublease the space (to the extent not included in
a brokerage commission paid by Tenant).

         F.       Recapture. Landlord may, by giving written notice to Tenant 
within ten (10) business days after receipt of Tenant's notice of assignment or
subletting, terminate this Lease with respect to the space described in Tenant's
notice, as of the effective date of the proposed assignment or sublease and all
obligations under this Lease as to such space shall expire except as to any
obligations that expressly survive any termination of this Lease.

         18.      CONVEYANCE BY LANDLORD. If Landlord shall at any time transfer
its interest in the Project or this Lease, Landlord shall be released of any
obligations occurring after such transfer, except the obligation to return to
Tenant any security deposit not delivered to its transferee, and Tenant shall
look solely to Landlord's successors for performance of such obligations. This
Lease shall not be affected by any such transfer.

         19.      ESTOPPEL CERTIFICATE. Each party shall, within ten (10) days 
of receiving a request from the other party, execute, acknowledge in recordable
form, and deliver to the other party or its designee a certificate stating,
subject to a specific statement of any applicable exceptions, that the Lease as
amended to date is in full force and effect, that the Tenant is paying Rent and
other charges on a current basis, and that to the best of the knowledge of the
certifying party, the other party has committed no uncured defaults and has no
offsets or claims. The certifying party may also be required to state the date
of commencement of payment of Rent, the Commencement Date, the Termination Date,
the Base Rent, the current Operating Cost Share Rent and Tax Share Rent
estimates, the status of any improvements required to be completed by Landlord,
the amount of any security deposit, and such other matters as may be reasonably
requested. Failure to deliver such statement within the time required shall be
conclusive evidence against the non-certifying party that this Lease, with any
amendments identified by the requesting party, is in full force and effect, that
there are no uncured defaults by the requesting party, that not more than one
month's Rent has been paid in advance, that the non-certifying party has not
paid any security deposit, and that the non-certifying party has no claims or
offsets against the requesting party.

         20.      SECURITY DEPOSIT. Tenant shall deposit with Landlord on the 
date of this Lease, security for the performance of all of its obligations in
the amount set forth on the Schedule. If Tenant defaults under this Lease,
Landlord may use any part of the Security Deposit to make any defaulted payment,
to pay for Landlord's cure of any defaulted obligation, or to compensate
Landlord for any loss or damage resulting from any default. To the extent any
portion of the deposit is used, Tenant shall within five (5) days after demand
from Landlord restore the deposit to its full amount. Landlord may keep the
Security Deposit in its general funds and shall not be required to pay interest
to Tenant on the deposit amount. If Tenant shall perform all of its obligations
under this Lease and return the Premises to Landlord at the end of the Term,
Landlord shall return all of the remaining Security Deposit to Tenant within
thirty (30) days after the end of the Term. The Security Deposit shall not serve
as an advance payment of Rent or a measure of Landlord's damages for any default
under this Lease.

         If Landlord transfers its interest in the Project or this Lease,
Landlord may transfer the Security Deposit to its transferee. Upon such
transfer, Landlord shall have no further obligation to return the Security
Deposit to Tenant, and Tenant's right to the return of the Security Deposit
shall apply solely against Landlord's transferee.

         21.      FORCE MAJEURE. Landlord shall not be in default under this 
Lease to the extent Landlord is unable to perform any of its obligations on
account of any strike or labor problem, energy shortage, governmental
pre-emption or prescription, national emergency, or any other cause of any kind
beyond the reasonable control of Landlord ("Force Majeure").

         22.      TENANT'S PERSONAL PROPERTY AND FIXTURES. In addition to any
statutory lien, Tenant hereby grants to Landlord a lien against and a security
interest in all of Tenant's personal property and fixtures now or hereafter
located within the Premises as security for performance of all of Tenant's
obligations under this Lease. Tenant may replace such personal property and
fixtures with items of equal or better quality, but shall not otherwise remove
them from the Premises without the consent of Landlord until all of the
obligations of Tenant under this Lease have been performed. This Lease
constitutes a security agreement creating a security interest in such property
in favor of Landlord, subject only to the liens of existing 


                                       18

<PAGE>   19

creditors, and Landlord may at any time file this Lease as a financing statement
under the Uniform Commercial Code of the state in which the Project is located.
Alternatively, if requested to do so by Landlord, Tenant shall execute and
deliver to Landlord within ten (10) days of such request a Form UCC-1 Financing
Statement wherein Landlord is the secured party and Tenant is the Debtor.

         23.      NOTICES. All notices, consents, approvals and similar
communications to be given by one party to the other under this Lease, shall be
given in writing, mailed or personally delivered as follows:

         A.       Landlord.  To Landlord as follows:

                  CARRAMERICA REALTY CORPORATION
                  1600 Parkwood Circle, Suite 150
                  Atlanta, Georgia 30339
                  Attn:  Market Officer

                  with a copy to:

                  CarrAmerica Realty Corporation
                  1850 K Street, Suite 500
                  Washington, D.C. 20006
                  Attn:  Lease Administration

or to such other person at such other address as Landlord may designate by
notice to Tenant.

         B.       Tenant.  To Tenant as follows:

                  Internet Security Systems, Inc.
                  6600 Peachtree Dunwoody Road
                  Building 600, Suite 600
                  Atlanta, Georgia 30328

or to such other person at such other address as Tenant may designate by notice
to Landlord.

         Mailed notices shall be sent by United States certified or registered
mail, or by a reputable national overnight courier service, postage prepaid.
Mailed notices shall be deemed to have been given on the earlier of actual
delivery or three (3) business days after posting in the United States mail in
the case of registered or certified mail, and one business day in the case of
overnight courier.

         24.      QUIET POSSESSION. So long as Tenant shall perform all of its
obligations under this Lease, Tenant shall enjoy peaceful and quiet possession
of the Premises against any party claiming through the Landlord.

         25.      REAL ESTATE BROKER. Tenant represents to Landlord that Tenant
has not dealt with any real estate broker with respect to this Lease except for
any broker(s) listed in the Schedule, and no other broker is in any way entitled
to any broker's fee or other payment in connection with this Lease. Tenant shall
indemnify and defend Landlord against any claims by any other broker or third
party for any payment of any kind in connection with this Lease.

         26.      MISCELLANEOUS.

         A.       Successors and Assigns. Subject to the limits on Tenant's 
assignment contained in Section 17, the provisions of this Lease shall be
binding upon and inure to the benefit of all successors and assigns of Landlord
and Tenant.

                                       19

<PAGE>   20

         B.       Date Payments Are Due. Except for payments to be made by 
Tenant under this Lease which are due upon demand or are due in advance (such as
Base Rent). Tenant shall pay to Landlord any amount for which Landlord renders a
statement of account within ten days of Tenant's receipt of Landlord's
statement.

         C.       Meaning of "Landlord", "Re-Entry, "including" and "Affiliate".
The term "Landlord" means only the owner of the Project and the lessor's
interest in this Lease from time to time. The words "re-entry" and "re-enter"
are not restricted to their technical legal meaning. The words "including" and
similar words shall mean "without limitation." The word "affiliate" shall mean a
person or entity controlling, controlled by or under common control with the
applicable entity. "Control" shall mean the power directly or indirectly, by
contract or otherwise, to direct the management and policies of the applicable
entity.

         D.       Time of the Essence. Time is of the essence of each provision
of this Lease.

         E.       No Option. This document shall not be effective for any 
purpose until it has been executed and delivered by both parties; execution and
delivery by one party shall not create any option or other right in the other
party.

         F.       Severability. The unenforceability of any provision of this 
Lease shall not affect any other provision.

         G.       Governing Law. This Lease shall be governed in all respects by
the laws of the state in which the Project is located, without regard to the
principles of conflicts of laws.

         H.       Lease Modification. Tenant agrees to modify this Lease in any
way requested by a mortgagee which does not cause increased expense to Tenant or
otherwise materially adversely affect Tenant's interests under this Lease.

         I.       No Oral Modification. No modification of this Lease shall be
effective unless it is a written modification signed by both parties.

         J.       Landlord's Right to Cure. If Landlord breaches any of its
obligations under this Lease, Tenant shall notify Landlord in writing and shall
take no action respecting such breach so long as Landlord promptly begins to
cure the breach and diligently pursues such cure to its completion. Landlord may
cure any default by Tenant; any expenses incurred shall become Additional Rent
due from Tenant on demand by Landlord.

         K.       Captions. The captions used in this Lease shall have no effect
on the construction of this Lease.

         L.       Authority. Landlord and Tenant each represents to the other 
that it has full power and authority to execute and perform this Lease.

         M.       Landlord's Enforcement of Remedies. Landlord may enforce any 
of its remedies under this Lease either in its own name or through an agent.

         N.       Entire Agreement. This Lease, together with all Appendices,
constitutes the entire agreement between the parties. No representations or
agreements of any kind have been made by either party which are not contained in
this Lease.

         O.       Landlord's Title. Landlord's title shall always be paramount 
to the interest of the Tenant, and nothing in this Lease shall empower Tenant to
do anything which might in any way impair Landlord's title.

         P.       Light and Air Rights. Landlord does not grant in this Lease 
any rights to light and air in connection with Project. Landlord reserves to
itself, the Land, the Building below the improved floor of each floor of the
Premises, the Building above the ceiling of each floor of the Premises, the
exterior of the Premises and the areas on the same floor outside the Premises,
along with the areas within the Premises required for the installation and
repair of utility lines and other items required to serve other tenants of the
Building.


                                       20

<PAGE>   21

         Q.       Singular and Plural. Wherever appropriate in this Lease, a 
singular term shall be construed to mean the plural where necessary, and a
plural term the singular. For example, if at any time two parties shall
constitute Landlord or Tenant, then the relevant term shall refer to both
parties together.

         R.       No Recording by Tenant. Tenant shall not record in any public
records any memorandum or any portion of this Lease.

         S.       Exclusivity. Landlord does not grant to Tenant in this Lease 

any exclusive right except the right to occupy its Premises.

         T.       No Construction Against Drafting Party. The rule of 
construction that ambiguities are resolved against the drafting party shall not
apply to this Lease.

         U.       Survival. All obligations of Landlord and Tenant under this 
Lease shall survive the termination of this Lease.

         V.       Rent Not Based on Income. No rent or other payment in respect
of the Premises shall be based in any way upon net income or profits from the
Premises. Tenant may not enter into or permit any sublease or license or other
agreement in connection with the Premises which provides for a rental or other
payment based on net income or profit.

         W.       Building Manager and Service Providers. Landlord may perform 
any of its obligations under this Lease through its employees or third parties
hired by the Landlord.

         X.       Late Charge and Interest on Late Payments. Without limiting
the provisions of Section 12A, if Tenant fails to pay any installment of Rent or
other charge to be paid by Tenant pursuant to this Lease within five (5)
business days after the same becomes due and payable, then Tenant shall pay a
late charge equal to the greater of five percent (5%) of the amount of such
payment or $250. In addition, interest shall be paid by Tenant to Landlord on
any late payments of Rent from the date due until paid at the rate provided in
Section 2D(2). Such late charge and interest shall constitute Additional Rent
due and payable by Tenant to Landlord upon the date of payment of the delinquent
payment referenced above.

         Y.       Tenant's Financial Statements. Within ten (10) days after 
Landlord's written request therefor, Tenant shall deliver to Landlord the
current audited annual and quarterly financial statements of Tenant, and annual
audited financial statements of the two (2) years prior to the current year's
financial statements, each with an option of a certified public accountant and
including a balance sheet and profit and loss statement, all prepared in
accordance with generally accepted accounting principles consistently applied.

         27.      UNRELATED BUSINESS INCOME. If Landlord is advised by its 
counsel at any time that any part of the payments by Tenant to Landlord under
this Lease may be characterized as unrelated business income under the United
States Internal Revenue Code and its regulations, then Tenant shall enter into
any amendment proposed by Landlord to avoid such income, so long as the
amendment does not require Tenant to make more payments or accept fewer services
from Landlord, than this Lease provides.

         28.      HAZARDOUS SUBSTANCES. Tenant shall not cause or permit any
Hazardous Substances to be brought upon, produced, stored, used, discharged or
disposed of in or near the Project unless Landlord has consented to such storage
or use in its sole discretion. "Hazardous Substances" include those hazardous
substances described in the Comprehensive Environmental Response, Compensation
and Liability Act of 1980, as amended, 42 U.S.C. Section 9601 et seq., the
Resource Conservation and Recovery Act, as amended, 42 U.S.C. Section 6901 et
seq., any other applicable federal, state or local law, and the regulations
adopted under these laws. If any lender or governmental agency shall require
testing for Hazardous Substances in the Premises, Tenant shall pay for such
testing.

         29.      EXCULPATION. Landlord shall have no personal liability under
this Lease; its liability shall be limited to its interest in the Project, and
shall not extend to any other property or assets of the Landlord. In no event
shall any officer, 

                                       21


<PAGE>   22

director, employee, agent, shareholder, partner, member or beneficiary of
Landlord be personally liable for any of Landlord's obligations hereunder.

         IN WITNESS WHEREOF, the parties hereto have executed this Lease.

                                  LANDLORD:

                                  CarrAmerica Realty Corporation, a Maryland
                                  corporation

                                  By:
                                     ----------------------------------------
                                  Print Name:
                                             --------------------------------
                                  Print Title:
                                             --------------------------------
                                  Date:
                                        -------------------------------------

                                  TENANT:

                                  Internet Security Systems, Inc., a Georgia
                                  corporation

                                  By:
                                     ----------------------------------------
                                  Print Name:
                                             --------------------------------
                                  Print Title:
                                             --------------------------------
                                  Date:
                                        -------------------------------------

                                                          [CORPORATE SEAL]

                                       22
<PAGE>   23
                                   APPENDIX A

                              PLAN OF THE PREMISES




                                  Appendix A
                                       1
<PAGE>   24

                                   APPENDIX B

                             RULES AND REGULATIONS

         1.       Tenant shall not place anything, or allow anything to be
placed near the glass of any window, door, partition or wall which may, in
Landlord's judgment, appear unsightly from outside of the Project.

         2.       The Project directory shall be available to Tenant solely to
display names and their location in the Project, which display shall be as
directed by Landlord.

         3.       The sidewalks, halls, passages, exits, entrances, elevators
and stairways shall not be obstructed by Tenant or used by Tenant for any
purposes other than for ingress to and egress from the Premises. Tenant shall
lend its full cooperation to keep such areas free from all obstruction and in a
clean and sightly condition and shall move all supplies, furniture and
equipment as soon as received directly to the Premises and move all such items
and waste being taken from the Premises (other than waste customarily removed
by employees of the Building) directly to the shipping platform at or about the
time arranged for removal therefrom. The halls, passages, exits, entrances,
elevators, stairways, balconies and roof are not for the use of the general
public and Landlord shall, in all cases, retain the right to control and
prevent access thereto by all persons whose presence in the judgment of
Landlord, reasonably exercised, shall be prejudicial to the safety, character,
reputation and interests of the Project. Neither Tenant nor any employee or
invitee of Tenant shall go upon the roof of the Project.

         4.       The toilet rooms, urinals, wash bowls and other apparatuses
shall not be used for any purposes other than that for which they were
constructed, and no foreign substance of any kind whatsoever shall be thrown
therein, and to the extent caused by Tenant or its employees or invitees, the
expense of any breakage, stoppage or damage resulting from the violation of
this rule shall be borne by Tenant.

         5.       Tenant shall not cause any unnecessary janitorial labor or
services by reason of Tenant's carelessness or indifference in the preservation
of good order and cleanliness.

         6.       Tenant shall not install or operate any refrigerating,
heating or air conditioning apparatus, or carry on any mechanical business
without the prior written consent of Landlord; use the Premises for housing,
lodging or sleeping purposes; or permit preparation or warming of food in the
Premises (warming of coffee and individual meals with employees and guests
excepted). Tenant shall not occupy or use the Premises or permit the Premises
to be occupied or used for any purpose, act or thing which is in violation of
any Governmental Requirement or which may be dangerous to persons or property.

         7.       Tenant shall not bring upon, use or keep in the Premises or
the Project any kerosene, gasoline or inflammable or combustible fluid or
material, or any other articles deemed hazardous to persons or property, or use
any method of heating or air conditioning other than that supplied by Landlord.

         8.       Landlord shall have sole power to direct electricians as to
where and how telephone and other wires are to be introduced. No boring or
cutting for wires is to be allowed without the consent of Landlord. The
location of telephones, call boxes and other office equipment affixed to the
Premises shall be subject to the approval of Landlord.

         9.       No additional locks shall be placed upon any doors, windows
or transoms in or to the Premises without the prior written consent of
Landlord. Tenant shall not change existing locks or the mechanism thereof. Upon
termination of the lease, Tenant shall deliver to Landlord all keys and passes
for offices, rooms, parking lot and toilet rooms which shall have been
furnished Tenant.

                  In the event of the loss of keys so furnished, Tenant shall
pay Landlord therefor. Tenant shall not make, or cause to be made, any such
keys and shall order all such keys solely from Landlord and shall pay Landlord
for any keys in addition to the two sets of keys originally furnished by
Landlord for each lock.



                                  Appendix B
                                       1
<PAGE>   25

         10.      Tenant shall not install linoleum, tile, carpet or other
floor covering so that the same shall be affixed to the floor of the Premises
in any manner except as approved by Landlord.

         11.      No furniture, packages, supplies, equipment or merchandise 
will be received in the Project or carried up or down in the freight elevator,
except between such hours and in such freight elevator as shall be designated
by Landlord. Tenant shall not take or permit to be taken in or out of other
entrances of the Building, or take or permit on other elevators, any item
normally taken in or out through the trucking concourse or service doors or in
or on freight elevators.

         12.      Tenant shall cause all doors to the Premises to be closed and
securely locked and shall turn off all utilities, lights and machines before
leaving the Project at the end of the day.

         13.      Without the prior written consent of Landlord, Tenant shall
not use the name of the Project or any picture of the Project in connection
with, or in promoting or advertising the business of, Tenant, except Tenant may
use the address of the Project as the address of its business.

         14.      Tenant shall cooperate fully with Landlord to assure the most
effective operation of the Premises' or the Project's heating and air
conditioning, and shall refrain from attempting to adjust any controls, other
than room thermostats installed for Tenant's use. Tenant shall keep corridor
doors closed.

         15.      Tenant assumes full responsibility for protecting the
Premises from theft, robbery and pilferage, which may arise from a cause other
than Landlord's negligence, which includes keeping doors locked and other means
of entry to the Premises closed and secured.

         16.      Peddlers, solicitors and beggars shall be reported to the
office of the Project or as Landlord otherwise requests.

         17.      Tenant shall not advertise the business, profession or
activities of Tenant conducted in the Project in any manner which violates the
letter or spirit of any code of ethics adopted by any recognized association or
organization pertaining to such business, profession or activities.

         18.      No bicycle or other vehicle and no animals or pets shall be
allowed in the Premises, halls, freight docks, or any other parts of the
Building except that blind persons may be accompanied by "seeing eye" dogs.
Tenant shall not make or permit any noise, vibration or odor to emanate from
the Premises, or do anything therein tending to create, or maintain, a
nuisance, or do any act tending to injure the reputation of the Building.

         19.      Tenant acknowledges that Building security problems may occur
which may require the employment of extreme security measures in the day-to-day
operation of the Project.

         Accordingly:

                  (a)      Landlord may, at any time, or from time to time, or
for regularly scheduled time periods, as deemed advisable by Landlord and/or
its agents, in their sole discretion, require that persons entering or leaving
the Project or the Property identify themselves to watchmen or other employees
designated by Landlord, by registration, identification or otherwise.

                  (b)      Tenant agrees that it and its employees will
cooperate fully with Project employees in the implementation of any and all
security procedures.

                  (c)      Such security measures shall be the sole
responsibility of Landlord, and Tenant shall have no liability for any action
taken by Landlord in connection therewith, it being understood that Landlord is
not required to provide any security procedures and shall have no liability for
such security procedures or the lack thereof.



                                   Appendix B
                                       2
<PAGE>   26

         20.      Tenant shall not do or permit the manufacture, sale,
purchase, use or gift of any fermented, intoxicating or alcoholic beverages
without obtaining written consent of Landlord.

         21.      Tenant shall not disturb the quiet enjoyment of any other
tenant.

         22.      Tenant shall not provide any janitorial services or cleaning
without Landlord's written consent and then only subject to supervision of
Landlord and at Tenant's sole responsibility and by janitor or cleaning
contractor or employees at all times satisfactory to Landlord.

         23.      Landlord may retain a pass key to the Premises and be
allowed admittance thereto at all times to enable its representatives to
examine the Premises from time to time and to exhibit the same and Landlord may
place and keep on the windows and doors of the Premises at any time signs
advertising the Premises for Rent.

         24.      No equipment, mechanical ventilators, awnings, special shades
or other forms of window covering shall be permitted either inside or outside
the windows of the Premises without the prior written consent of Landlord, and
then only at the expense and risk of Tenant, and they shall be of such shape,
color, material, quality, design and make as may be approved by Landlord.

         25.      Tenant shall not during the term of this Lease canvas or
solicit other tenants of the Building for any purpose.

         26.      Tenant shall not install or operate any phonograph, musical
or sound- producing instrument or device, radio receiver or transmitter, TV
receiver or transmitter, or similar device in the Building, nor install or
operate any antenna, aerial, wires or other equipment inside or outside the
Building, nor operate any electrical device from which may emanate electrical
waves which may interfere with or impair radio or television broadcasting or
reception from or in the Building or elsewhere, without in each instance the
prior written approval of Landlord. The use thereof, if permitted, shall be
subject to control by Landlord to the end that others shall not be disturbed.

         27.      Tenant shall promptly remove all rubbish and waste from the
Premises.

         28.      Tenant shall not exhibit, sell or offer for sale, Rent or
exchange in the Premises or at the Project any article, thing or service,
except those ordinarily embraced within the use of the Premises specified in
Section 6 of this Lease, without the prior written consent of Landlord.

         29.      Tenant shall list all furniture, equipment and similar
articles Tenant desires to remove from the Premises or the Building and deliver
a copy of such list to Landlord and procure a removal permit from the Office of
the Building authorizing Building employees to permit such articles to be
removed.

         30.      Tenant shall not overload any floors in the Premises or any
public corridors or elevators in the Building.

         31.      Tenant shall not do any painting in the Premises, or mark,
paint, cut or drill into, drive nails or screws into, or in any way deface any
part of the Premises or the Building, outside or inside, without the prior
written consent of Landlord.

         32.      Whenever Landlord's consent, approval or satisfaction is
required under these Rules, then unless otherwise stated, any such consent,
approval or satisfaction must be obtained in advance, such consent or approval
may be granted or withheld in Landlord's sole discretion, and Landlord's
satisfaction shall be determined in its sole judgment.

         33       Tenant and its employees shall cooperate in all fire drills
conducted by Landlord in the Building.



                                   Appendix B
                                       3
<PAGE>   27

                                   APPENDIX C

                          TENANT IMPROVEMENT AGREEMENT

                  1.       INITIAL IMPROVEMENTS. Landlord shall cause to be
performed the improvements (the "Initial Improvements") in the Premises in
accordance with plans and specifications approved by Tenant and Landlord (the
"Plans"), which Plans shall be initialed by Landlord and Tenant and attached
hereto by November 20, 1998 or the Commencement Date of this Lease shall be
January 1, 1999 and all conditions set forth in Paragraph 4. below shall be
null and void. The Initial Improvements shall be performed at the Tenant's
cost, subject to the Landlord's Contribution (hereinafter defined).

         Landlord shall cause the Plans to be prepared, at Tenant's cost, by a
registered professional architect. Tenant hereby agrees that the Plans for the
Initial Improvements shall comply with all applicable Governmental
Requirements. Landlord's approval of any of the Plans (or any modifications or
changes thereto) shall not impose upon Landlord or its agents or
representatives any obligation with respect to the design of the Initial
Improvements or the compliance of such Initial Improvements or the Plans with
applicable Governmental Requirements.

         Landlord shall select a contractor to perform the construction of the
Initial Improvements. Landlord shall use commercially reasonable efforts to
cause the Initial Improvements to be substantially completed, except for minor
"Punch List" items, on or before the Commencement Date specified in the
Schedule to the Lease, subject to Tenant Delay (as defined in Section 4 hereof)
and Force Majeure.

         Landlord, or an agent of Landlord, shall provide project management
services in connection with the construction of the Initial Improvements and
the Change Orders (hereinafter defined). Such project management services shall
be performed, at Tenant's cost, for a fee of five percent (5%) of all costs
related to the preparation of the Plans and the construction of the Initial
Improvements and the Change Orders.

         2.       CHANGE ORDERS. If, prior to the Commencement Date, Tenant
shall require improvements or changes (individually or collectively, "Change
Orders") to the Premises in addition to, revision of or substitution for the
Initial Improvements, Tenant shall deliver to Landlord for its approval plans
and specifications for such Change Orders. If Landlord does not approve of the
plans for Change Orders, Landlord shall advise Tenant of the revisions
required. Tenant shall revise and redeliver the plans and specifications to
Landlord within five (5) business days of Landlord's advice or Tenant shall be
deemed to have abandoned its request for such Change Orders. Tenant shall pay
for all preparations and revisions of plans and specifications, and the
construction of all Change Orders, subject to Landlord's Contribution.

         3.       LANDLORD'S CONTRIBUTION. Landlord shall contribute an amount
up to $146,886.00 ("Landlord's Contribution") toward the costs incurred for the
Initial Improvements and Change Orders. Landlord has no obligation to pay for
costs of the Initial Improvements or Change Orders in excess of Landlord's
Contribution. If the cost of the Initial Improvements and/or Change Orders
exceeds the Landlord's Contribution, Tenant shall pay such overage to Landlord
prior to commencement of construction of the Initial Improvements and/or Change
Orders. If Landlord's Contribution exceeds the cost of the Initial Improvements
and Change Orders, then Landlord shall credit such excess against the monthly
installments of Base Rent first due and payable after the Commencement Date.

         4.       COMMENCEMENT DATE DELAY. Commencement Date shall be delayed
until the Initial Improvements have been substantially completed (the
"Completion Date"), except to the extent that the delay shall be caused by any
one or more of the following (a "Tenant Delay"):

                  (a)      Tenant's request for Change Orders whether or not 
any such Change Orders are actually performed; or

                  (b)      Contractor's performance of any Change Orders; or



                                  Appendix C
                                       1
<PAGE>   28

                  (c)      Tenant's request for materials, finishes or 
installations requiring unusually long lead times; or

                  (d)      Tenant's delay in reviewing, revising or approving
plans and specifications beyond the periods set forth herein; or

                  (e)      Tenant's delay in providing information critical to
the normal progression of the project. Tenant shall provide such information as
soon as reasonably possible, but in no event longer than one week after receipt
of such request for information from the Landlord; or

                  (f)      Tenant's delay in making payments to Landlord for
costs of the Initial Improvements and/or Change Orders in excess of the
Landlord's Contribution; or

                  (g)      Any other act or omission by Tenant, its agents,
contractors or persons employed by any of such persons.

If the Commencement Date is delayed for any reason, then Landlord shall cause
Landlord's Architect to certify the date on which the Initial Improvements
would have been completed but for such Tenant Delay, or were in fact completed
without any Tenant Delay. Notwithstanding anything herein to the contrary, the
only Commencement Date which is subject to delays shall be the Phase I
Commencement Date. Phase II and Phase III Commencement Dates shall commence
without being subject to the conditions of this paragraph 4.

         5.       ACCESS BY TENANT PRIOR TO COMMENCEMENT OF TERM. Landlord at
its discretion may permit Tenant and its agents to enter the Premises prior to
the Commencement Date to prepare the Premises for Tenant's use and occupancy.
Any such permission shall constitute a license only, conditioned upon Tenant's:

         (a)      working in harmony with Landlord and Landlord's agents,
contractors, workmen, mechanics and suppliers and with other tenants and
occupants of the Building;

         (b)      obtaining in advance Landlord's approval of the contractors
proposed to be used by Tenant and depositing with Landlord in advance of any
work (i) security satisfactory to Landlord for the completion thereof, and (ii)
the contractor's affidavit for the proposed work and the waivers of lien from
the contractor and all subcontractors and suppliers of material; and

         (c)      furnishing Landlord with such insurance as Landlord may
require against liabilities which may arise out of such entry.

         Landlord shall have the right to withdraw such license for any reason
upon twenty-four (24) hours' written notice to Tenant. Landlord shall not be
liable in any way for any injury, loss or damage which may occur to any of
Tenant's property or installations in the Premises prior to the Commencement
Date. Tenant shall protect, defend, indemnify and save harmless Landlord from
all liabilities, costs, damages, fees and expenses arising out of the
activities of Tenant or its agents, contractors, suppliers or workmen in the
Premises or the Building. Any entry and occupation permitted under this Section
shall be governed by Section 5 and all other terms of the Lease.

         6.       MISCELLANEOUS. Terms used in this Appendix C shall have the
meanings assigned to them in the Lease. The terms of this Appendix C are
subject to the terms of the Lease.



                                  Appendix C
                                       2
<PAGE>   29

                                   APPENDIX D

                   MORTGAGES CURRENTLY AFFECTING THE PROJECT



                                      NONE




                                  Appendix D
                                       1
<PAGE>   30

                                   APPENDIX E

                         COMMENCEMENT DATE CONFIRMATION


Landlord:         CarrAmerica Realty Corporation, a Georgia corporation

Tenant:           ____________________, a _____________

         This Commencement Date Confirmation is made by Landlord and Tenant
pursuant to that certain Lease dated as of _________, 199__ (the "Lease") for
certain premises known as Suite ____ in the building commonly known as
[PROPERTY NAME] (the "Premises"). This Confirmation is made pursuant to Item 9
of the Schedule to the Lease.

         1.       Lease Commencement Date, Termination Date. Landlord and
Tenant hereby agree that the Commencement Date of the Lease is _____________,
199__, and the Termination Date of the Lease is __________________, ________.

         2.       Acceptance of Premises. Tenant has inspected the Premises
and affirms that the Premises is acceptable in all respects in its current "as
is" condition.

         3.       Incorporation. This Confirmation is incorporated into the
Lease, and forms an integral part thereof. This Confirmation shall be construed
and interpreted in accordance with the terms of the Lease for all purposes.

                         TENANT:

                                    
                                                    a
                         -------------------------,   ------------------------


                          By:
                             -------------------------------------------------
                          Name:
                               -----------------------------------------------
                          Title:
                                ----------------------------------------------


                         LANDLORD:

                         CarrAmerica Realty Corporation, a Georgia corporation


                         By:
                            --------------------------------------------------
                         Name
                             -------------------------------------------------
                         Title:
                               -----------------------------------------------



                                  Appendix E
                                       1
<PAGE>   31

                                   APPENDIX F

                              SPECIAL STIPULATIONS


1.       EARLY OCCUPANCY. Tenant may begin its move into the Premises in
December, 1998; provided Tenant does not interfere with any construction.
During December, 1998, Tenant shall be liable for all Terms set forth in this
Lease except Rent.

2.       PHASED OCCUPANCY. Landlord and Tenant agree in good faith that
Tenant's use of the Premises during the Phased Occupancy shall approximately
meet the square footage amounts reflected in Paragraph 3 of the Schedule.

3.       PARKING. Notwithstanding anything to the contrary set forth herein,
parking shall be on-site, adequately lit and free of charge.

         A.       As used herein, the term "Parking Spaces" shall mean 86
parking spaces in the initial Premises located in the Building such Parking
Spaces to be located on the Land associated with the Building, all of which
shall be non-designated spaces. Tenant and its agents, employees, contractors,
invitees and licensees may not use additional parking spaces without the prior
written consent of Landlord. Tenant and its agents, employees, contractors,
invitees or licensees shall not interfere with the rights of Landlord or others
entitled to similar use of the parking facilities. If Tenant's use is in excess
of the allotted Parking Spaces, then such use shall be an immediate event of
default and Landlord may use all of its rights and remedies under the Lease
including its right to immediately terminate this Lease.

         B.       All parking facilities furnished by Landlord shall be subject
to the reasonable and control and management of Landlord, who may, from time to
time, establish, modify and enforce reasonable rules and regulations with
respect thereto, provided that there shall be no charge to Tenant or its
employees or invitees for use of the Parking Spaces during the Term, except in
connection with Operating Costs (including exterior lighting) and except for
the reasonable cost of any access cards. Landlord further reserves the right to
change or reconfigure the parking facilities and designate the parking spaces
therein, to construct or repair any portion thereof, and to restrict or
eliminate the use of any parking areas and do such other acts in and to such
areas as Landlord deems necessary or desirable without such actions being
deemed an eviction of Tenant or a disturbance of Tenant's use of the Premises
and without Landlord being deemed in default hereunder; provided, however, the
number of Parking Spaces as set forth in Section (a) above shall be maintained
throughout the Term.

         C.       If parking spaces are not assigned pursuant to the terms of
this Lease, Landlord reserves the right at any time to assign parking spaces,
and Tenant shall thereafter be responsible to insure that its employees park in
the designated areas. Landlord shall not be liable for any damage of any nature
to, or any theft of vehicles, or contents thereof, in or about such parking
facility.

4.       SIGNAGE. It is expressly understood and agreed that Tenant shall have
the right to install signage at the Project, upon and subject to the terms and
conditions set forth in this Special Stipulation 1 below.

         A.       Monument Signage Rights. Landlord shall procure and install a
monument type sign (the "Monument Sign") on the Land for the non-exclusive use
of Tenant, in a location to be decided by Landlord. Tenant shall have the right
to procure, and Landlord shall install and maintain, all at Tenant's sole cost
and expense, Tenant's lettering/sign on the Monument Sign (the "Tenant's
Monument Signage"), upon and subject to the following terms and conditions.

                  (a)      All costs and expenses in connection with the
procurement, installation, insuring, maintenance and removal of Tenant's
Monument Signage shall be the responsibility of Tenant;

                  (b)      Tenant's Monument Signage shall comply with all
Legal Requirements and Tenant and Landlord, at Tenant's cost shall obtain any
required consents or permits from any applicable Governmental Authority;



                                  Appendix F
                                       1

<PAGE>   32

                  (c)      Tenant's Monument Signage shall be located on the
Monument Sign in the area approved by Landlord, which approval shall not be
unreasonably withheld, and the exact manner of installation, design, size,
color, lettering, location and illumination of the Monument Sign and Tenant's
Monument Signage shall be subject to the prior written approval of Landlord
(such approval not to be unreasonably withheld). Without limiting the
generality of the foregoing, the Monument Sign and Tenant's Monument Signage
shall not adversely affect or conflict with in any way the Embassy Row
entrances or Embassy Row development identification(s);

                  (d)      Tenant shall have the right to maintain Tenant's
Monument Signage on the Monument Sign only for so long as this Lease remains in
full force and effect, and Tenant and/or its Affiliates are collectively
leasing 20,000 or more rentable square feet in the Building and subleasing
40,000 or more rentable square feet in the Project. In addition to the
foregoing conditions, the rights granted to Tenant in this subsection A are
personal to the Tenant named herein and may not be transferred to any assignee
or subtenant that is not an Affiliate of Tenant unless Landlord otherwise
agrees in writing to permit the assignment of such signage rights to the
permitted assignee of the Lease or any permitted sublessee. Landlord covenants
that it will not unreasonably withhold its consent to such assignment of the
signage rights; provided, however, if the assignee or sublessee is a
Governmental entity, Landlord may withhold its consent in its sole, arbitrary
and absolute discretion. Tenant shall, at its sole cost and expense, promptly
remove the Tenant's Monument Signage and repair any damage to the Monument
Sign, the Building, the Land and/or any other portion of the Project caused by
or resulting from such removal if the above conditions do not continue to be
satisfied. In the event Tenant fails to so remove such Tenant's Monument
Signage or repair such damage, Landlord may remove same and made such repairs
at Tenant's cost and Tenant shall pay Landlord on demand as additional Rent the
cost of such removal and repairs. The Monument Sign shall remain the property
of Landlord upon the expiration or earlier termination of this Lease.

         B.       Georgia 400 Monument Sign. In the event that the Metropolitan
Atlanta Rapid Transit authority ("MARTA") grants to Landlord a written easement
in recordable form (the "MARTA Easement") to install, maintain, repair, replace
and use a monument type sign on the real property owned by MARTA that is
adjacent to land owned by Landlord and to Georgia Highway 400 (the "MARTA
Monument Sign"), then, subject to the provisions of the MARTA Easement, Tenant
shall have the right to procure, and the Landlord shall install and maintain,
all at Tenant's sole cost and expense, Tenant's lettering/sign on the MARTA
Monument Sign (the "Tenant's MARTA Monument Signage"), upon and subject to the
following terms and conditions:

                  (a)      Tenant rights under this subsection B are not
exclusive. The area of coverage of Tenant's MARTA Monument Signage on the MARTA
Monument Sign shall not exceed 50% of the total area available for signage on
the MARTA Monument Sign as determined by Landlord in its reasonable discretion.
Landlord agrees that the position of Tenant's MARTA Monument Signage on the
MARTA Monument Sign shall be on the lower half portion of the MARTA Monument
Sign. If during the Term of this Lease, Landlord executes a Lease with another
Tenant for premises containing at least 48,000 square feet, then upon
Landlord's written notice, Tenant's signage rights hereunder shall be reduced
from 50% to 25% and the position of Tenant's signage shall generally be on the
middle to lower half portion of such sign. All costs and expenses in connection
with the procurement, installation, insuring, maintenance and removal of
Tenant's MARTA Monument Signage shall be the responsibility of Tenant;

                  (b)      Tenant's MARTA Monument Signage shall comply with
the provisions of the MARTA Easement and with all Legal Requirements, and
Tenant and Landlord, at Tenant's cost,- shall obtain any required consents or
permits from any applicable governmental Authority;

                  (c)      Tenant's MARTA Monument Signage shall be located on
the MARTA Monument Sign in the area approved by Landlord, which approval shall
not be unreasonably withheld, and the exact manner of installation, design,
size, color, lettering, location and illumination of the MARTA Monument Sign
and Tenant's MARTA Monument Signage shall be subject to the prior written
approval of Landlord (such approval shall not be unreasonably withheld).
Landlord agrees that the position of Tenant's MARTA Monument Signage on the
MARTA Monument Sign shall generally be on the middle to lower half portion of
the MARTA Monument Sign. Notwithstanding the foregoing, it shall be deemed
reasonable for Landlord to withhold



                                  Appendix F
                                       2

<PAGE>   33

its approval if Tenant's plans do not comply with the provisions of, or
otherwise breach the provisions of, the MARTA Easement;

                  (d)      Tenant shall have the right to maintain Tenant's
MARTA Monument Signage on the MARTA Monument Sign only for so long as (i) the
MARTA Easement remains in effect, (ii) this Lease remains in full force and
effect, and (iii) Tenant and/or its Affiliates are leasing 20,000 or more
rentable square feet in the Building and subleasing 40,000 or more rentable
square feet in the Project. In addition to the foregoing conditions, the rights
granted to Tenant in this subsection B are personal to the Tenant named herein
and may not be transferred to any assignee or subtenant that is not an
Affiliate of Tenant unless Landlord otherwise agrees in writing to permit the
assignment of such signage rights to the permitted assignee of the Lease or any
permitted sublessee. Landlord covenants that it will not unreasonably withhold
its consent to such assignment of the signage rights; provided, however, if the
assignee or sublessee is a Governmental Entity, Landlord may withhold its
consent in its sole, arbitrary and absolute discretion. Tenant shall, at its
sole cost and expense, promptly remove the Tenant's MARTA Monument Signage and
repair any damage to the MARTA Monument Sign, MARTA'S land and/or any other
portion of the Project caused by or resulting from such removal if the above
conditions do not continue to be satisfied. In the event Tenant fails to so
remove such Tenant's MARTA Monument Signage or repair such damage, Landlord may
remove same and made such repairs at Tenant's cost and Tenant shall pay
Landlord on demand as additional Rent the cost of such removal and repairs. The
MARTA Monument Sign shall remain the property of Landlord upon the expiration
or earlier termination of this Lease.

5.       LANDLORD FEES. Notwithstanding anything herein to the contrary, 
Landlord shall not charge Tenant a supervisory fee for installation of phone or
data cabling which are contracted between Tenant and third party vendors.

6.       LEASE EXTENSION. Tenant shall have a one-time right to extend the
Lease Term for an additional ninety (90) days ("Extension Period") provided it
gives Landlord written notice at least ninety (90) days prior to the expiration
of the Original Term. For the Extension Period, all terms and conditions as set
forth in this Lease shall apply except the monthly Rent due shall be equal to
one hundred and fifteen percent (115%) of the prevailing monthly Rent being
paid in the last year of this original Lease Agreement.



                                  Appendix F
                                       3

<PAGE>   34

                               TABLE OF CONTENTS


<TABLE>
<CAPTION>

                                                                                                      Page
                                                                                                      ----

<S>      <C>                                                                                          <C>
1.       LEASE AGREEMENT                                                                                 3

2.       RENT                                                                                            3
         A.       Types of Rent                                                                          3
                  (1)      Base Rent                                                                     3
                  (2)      Operating Cost Share Rent                                                     3
                  (3)      Tax Share Rent                                                                3
                  (4)      Additional Rent                                                               3
                  (5)      Rent                                                                          4
         B.       Payment of Operating Cost Share Rent and Tax Share Rent                                4
                  (1)      Payment of Estimated Operating Cost Share Rent
                           and Tax Share Rent                                                            4
                  (2)      Correction of Operating Cost Share Rent                                       4
                  (3)      Correction of Tax Share Rent                                                  4
         C.       Definitions                                                                            4
                  (1)      Included Operating Costs                                                      4
                  (2)      Excluded Operating Costs                                                      5
                  (3)      Taxes                                                                         6
                  (4)      Lease Year                                                                    6
                  (5)      Fiscal Year                                                                   6
         D.       Computation of Base Rent and Rent Adjustments                                          6
                  (1)      Prorations.                                                                   6
                  (2)      Default Interest.                                                             6
                  (3)      Rent Adjustments.                                                             6
                  (4)      Books and Records.                                                            6
                  (5)      Miscellaneous.                                                                7

3.       PREPARATION AND CONDITION OF PREMISES
         POSSESSION AND SURRENDER OF PREMISES                                                            7
         A.       Condition of Premises.                                                                 7
         B.       Tenant's Possession.                                                                   7
         C.       Maintenance.                                                                           7

4.       PROJECT SERVICES                                                                                7
         A.       Heating and Air Conditioning                                                           7
         B.       Elevators                                                                              7
         C.       Electricity                                                                            8
         D.       Water                                                                                  8
         E.       Janitorial Service                                                                     8
         F.       Interruption of Services                                                               8

5.       ALTERATIONS AND REPAIRS                                                                         8
         A.       Landlord's Consent and Conditions.                                                     8
         B.       Damage to Systems.                                                                     9
         C.       No Liens.                                                                              9
         D.       Ownership of Improvements.                                                            10
         E.       Removal at Termination.                                                               10

6.       USE OF PREMISES                                                                                10

7.       GOVERNMENTAL REQUIREMENTS AND BUILDING RULES.                                                  10
</TABLE>

<PAGE>   35

                               TABLE OF CONTENTS


<TABLE>
<CAPTION>
                                                                                                      Page
                                                                                                      ----

<S>      <C>                                                                                          <C>
8.       WAIVER OF CLAIMS; INDEMNIFICATION; INSURANCE.                                                  10
         A.       Waiver of Claims.                                                                     10
         B.       Indemnification.                                                                      11
         C.       Tenant's Insurance.                                                                   11
         D.       Insurance Certificates.                                                               12
         E.       Landlord's Insurance.                                                                 12

9.       FIRE AND OTHER CASUALTY                                                                        12
         A.       Termination.                                                                          12
         B.       Restoration.                                                                          12

10.      EMINENT DOMAIN.                                                                                12

11.      RIGHTS RESERVED TO LANDLORD.                                                                   13
         A.       Name                                                                                  13
         B.       Signs.                                                                                13
         C.       Window Treatments.                                                                    13
         D.       Keys                                                                                  13
         E.       Access                                                                                13
         F.       Preparation for Reoccupancy                                                           13
         G.       Heavy Articles                                                                        13
         H.       Show Premises                                                                         13
         I.       Relocation of Tenant                                                                  13
         J.       Use of Lockbox                                                                        13
         K.       Repairs and Alterations                                                               13
         L.       Landlord's Agents                                                                     13
         M.       Building Services.                                                                    14
         N.       Other Actions.                                                                        14

12.      TENANT'S DEFAULT.                                                                              14
         A.       Rent Default.                                                                         14
         B.       Assignment/Sublease or Hazardous Substances Default.                                  14
         C.       Other Performance Default.                                                            14
         D.       Credit Default.                                                                       14
         E.       Vacation or Abandonment Default.                                                      14

13.      LANDLORD REMEDIES                                                                              14
         A.       Termination of Lease or Possession.                                                   14
         B.       Lease Termination Damages.                                                            14
         C.       Possession Termination Damages.                                                       15
         D.       Landlord's Remedies Cumulative.                                                       15
         E.       WAIVER OF TRIAL BY JURY.                                                              15
         F.       Litigation Costs.                                                                     15

14.      SURRENDER.                                                                                     15

15.      HOLDOVER.                                                                                      15

16.      SUBORDINATION TO GROUND LEASES AND MORTGAGES                                                   16
         A.       Subordination                                                                         16
</TABLE>

<PAGE>   36

                               TABLE OF CONTENTS


<TABLE>
<CAPTION>
                                                                                                      Page
                                                                                                      ----

<S>      <C>                                                                                          <C>
         B.       Termination of Ground Lease or Foreclosure of Mortgage                                16
         C.       Security Deposit                                                                      16
         D.       Notice and Right to Cure                                                              16
         E.       Definitions.                                                                          16

17.      ASSIGNMENT AND SUBLEASE.                                                                       16
         A.       In General.                                                                           16
         B.       Landlord's Consent.                                                                   17
         C.       Procedure.                                                                            17
         D.       Change of Management or Ownership.                                                    17
         E.       Excess Payments.                                                                      17
         F.       Recapture.                                                                            18

18.      CONVEYANCE BY LANDLORD                                                                         18

19.      ESTOPPEL CERTIFICATE                                                                           18

20.      SECURITY DEPOSIT                                                                               18

21.      FORCE MAJEURE                                                                                  18

22.      TENANT'S PERSONAL PROPERTY AND FIXTURES                                                        18

23.      NOTICES                                                                                        19
         A.       Landlord.                                                                             19
         B.       Tenant.                                                                               19

24.      QUIET POSSESSION                                                                               19

25.      REAL ESTATE BROKER                                                                             19

26.      MISCELLANEOUS                                                                                  19
         A.       Successors and Assigns.                                                               19
         B.       Date Payments Are Due.                                                                20
         C.       Meaning of "Landlord", "Re-Entry, "including" and "Affiliate".                        20
         D.       Time of the Essence.                                                                  20
         E.       No Option.                                                                            20
         F.       Severability.                                                                         20
         G.       Governing Law.                                                                        20
         H.       Lease Modification.                                                                   20
         I.       No Oral Modification.                                                                 20
         J.       Landlord's Right to Cure.                                                             20
         K.       Captions.                                                                             20
         L.       Authority.                                                                            20
         M.       Landlord's Enforcement of Remedies.                                                   20
         N.       Entire Agreement.                                                                     20
         O.       Landlord's Title.                                                                     20
         P.       Light and Air Rights.                                                                 20
         Q.       Singular and Plural.                                                                  21
         R.       No Recording by Tenant.                                                               21
         S.       Exclusivity.                                                                          21
</TABLE>

<PAGE>   37

                               TABLE OF CONTENTS

<TABLE>
<CAPTION>
                                                                                                      Page
                                                                                                      ----

<S>      <C>                                                                                          <C>

         T.       No Construction Against Drafting Party.                                               21
         U.       Survival.                                                                             21
         V.       Rent Not Based on Income.                                                             21
         W.       Building Manager and Service Providers.                                               21
         X.       Late Charge and Interest on Late Payments.                                            21
         Y.       Tenant's Financial Statements                                                         21

27.      UNRELATED BUSINESS INCOME                                                                      21

28.      HAZARDOUS SUBSTANCES                                                                           21

29.      EXCULPATION                                                                                    22
</TABLE>


APPENDIX A - PLAN OF THE PREMISES
APPENDIX B - RULES AND REGULATIONS
APPENDIX C - TENANT IMPROVEMENT AGREEMENT
APPENDIX D - MORTGAGES CURRENTLY AFFECTING THE PROJECT
APPENDIX E - COMMENCEMENT DATE CONFIRMATION
APPENDIX F - SPECIAL STIPULATIONS



<PAGE>   1

                                                                    EXHIBIT 21.1

                        Subsidiaries of the Registrant.

1.  Internet Security Systems, Inc. (Georgia).

2.  Internet Security Systems K.K. (Japan).

3.  ISS Group Ltd. (United Kingdon).

4.  ISS Investments Holding, Inc. (Delaware).

<PAGE>   1
                                                                    EXHIBIT 23.1



                        CONSENT OF INDEPENDENT AUDITORS


We consent to the reference to our firm under the caption "Experts" and to the 
use of our reports dated January 15, 1999 in the Registration Statement (Form 
S-1) and related Prospectus of ISS Group, Inc. dated January 29, 1999.


                                                           /s/ Ernst & Young LLP


Atlanta, Georgia
January 29, 1999

<PAGE>   1

                                                                    EXHIBIT 23.2

                        CONSENT OF INDEPENDENT AUDITORS

     We consent to the reference to our firm under the caption "Experts" and to 
the use of our report dated October 16, 1998, in the Registration Statement 
(Form S-1 No. 333-00000) and related Prospectus of ISS Group, Inc's for the 
registration of 2,400,000 shares of its common stock.


                                       /s/  Ernst & Young


Reading, England
January 29, 1999


<TABLE> <S> <C>

<ARTICLE> 5
<LEGEND>
THIS SCHEDULE CONTAINS SUMMARY FINANCIAL INFORMATION EXTRACTED FROM THE
CONSOLIDATED FINANCIAL STATEMENTS OF ISS GROUP, INC. FOR THE TWELVE MONTHS ENDED
DECEMBER 31, 1998 AND IS QUALIFIED IN ITS ENTIRETY BY REFERENCE TO SUCH
FINANCIAL STATEMENTS.
</LEGEND>
<MULTIPLIER> 1
       
<S>                             <C>
<PERIOD-TYPE>                   YEAR
<FISCAL-YEAR-END>                          DEC-31-1998
<PERIOD-START>                             JAN-01-1998
<PERIOD-END>                               DEC-31-1998
<CASH>                                          52,632
<SECURITIES>                                         0
<RECEIVABLES>                                   12,586
<ALLOWANCES>                                       287
<INVENTORY>                                          0
<CURRENT-ASSETS>                                65,961
<PP&E>                                           5,672
<DEPRECIATION>                                   1,655
<TOTAL-ASSETS>                                  78,021
<CURRENT-LIABILITIES>                           11,572
<BONDS>                                              0
                                0
                                          0
<COMMON>                                            17
<OTHER-SE>                                      66,298
<TOTAL-LIABILITY-AND-EQUITY>                    78,021
<SALES>                                              0
<TOTAL-REVENUES>                                35,929
<CGS>                                                0
<TOTAL-COSTS>                                   42,335
<OTHER-EXPENSES>                                     0
<LOSS-PROVISION>                                     0
<INTEREST-EXPENSE>                                  16
<INCOME-PRETAX>                                 (4,040)
<INCOME-TAX>                                        62
<INCOME-CONTINUING>                             (4,102)
<DISCONTINUED>                                       0
<EXTRAORDINARY>                                      0
<CHANGES>                                            0
<NET-INCOME>                                    (4,102)
<EPS-PRIMARY>                                     (.28)
<EPS-DILUTED>                                     (.28)
        

</TABLE>


© 2022 IncJournal is not affiliated with or endorsed by the U.S. Securities and Exchange Commission