ISS GROUP INC
10-K, 2000-03-30
PREPACKAGED SOFTWARE
Previous: ESSEX PORTFOLIO LP, 10-K405, 2000-03-30
Next: GOLFGEAR, NT 10-K, 2000-03-30



<PAGE>   1

- --------------------------------------------------------------------------------
- --------------------------------------------------------------------------------
                                 UNITED STATES
                       SECURITIES AND EXCHANGE COMMISSION
                             WASHINGTON, D.C. 20549
                             ---------------------

                                   FORM 10-K

<TABLE>
<C>               <S>
   (MARK ONE)
      [X]         ANNUAL REPORT PURSUANT TO SECTION 13 OR 15(D) OF THE
                  SECURITIES EXCHANGE ACT OF 1934
                  FOR THE FISCAL YEAR ENDED DECEMBER 31, 1999
                                               OR
      [  ]        TRANSITION REPORT PURSUANT TO SECTION 13 OR 15(D) OF
                  THE SECURITIES EXCHANGE ACT OF 1934
                  FOR THE TRANSITION PERIOD FROM ____________TO ____________
</TABLE>

                         Commission file number 0-23655
                                ISS GROUP, INC.
             (Exact Name of Registrant as Specified in Its Charter)

<TABLE>
<S>                                              <C>
                    DELAWARE                                        58-2362189
        (State or other jurisdiction of                (I.R.S. Employer Identification No.)
         incorporation or organization)

          6600 PEACHTREE-DUNWOODY ROAD                                30328
           300 EMBASSY ROW, SUITE 500                               (Zip code)
                ATLANTA, GEORGIA
    (Address of principal executive offices)
</TABLE>

       Registrant's telephone number, including area code: (678) 443-6000
          Securities registered pursuant to Section 12(b) of the Act:

<TABLE>
<CAPTION>
                                                                       NAME OF EACH EXCHANGE
                 TITLE OF EACH CLASS                                    ON WHICH REGISTERED
                 -------------------                                   ---------------------
<S>                                                    <C>
                         None                                                   None
</TABLE>

          Securities registered pursuant to Section 12(g) of the Act:
                         COMMON STOCK, $0.001 PAR VALUE
                                (Title of Class)
    Indicate by check mark whether the Registrant (1) has filed all reports
required to be filed by Section 13 or 15(d) of the Securities Exchange Act of
1934 during the preceding 12 months (or for such shorter period that the
Registrant was required to file such reports), and (2) has been subject to such
filing requirements for the past 90 days.

                              Yes  [X]      No  [ ]

    Indicate by check mark if disclosure of delinquent filers pursuant to Item
405 of Regulation S-K is not contained herein, and will not be contained, to the
best of Registrant's knowledge, in definitive proxy or information statements
incorporated by reference in Part III of this Form 10-K or any amendment to this
Form 10-K.  [ ]

    The aggregate market value of the voting stock held by non-affiliates of the
Registrant, based upon the closing sale price of Common Stock on March 24, 2000
as reported on the Nasdaq National Market, was approximately $3.9 billion
(affiliates being, for these purposes only, directors, executive officers and
holders of more than 5% of the Registrant's Common Stock).

    As of March 24, 2000, the Registrant had 41,766,717 outstanding shares of
Common Stock.
                      DOCUMENTS INCORPORATED BY REFERENCE
    Portions of the Proxy Statement for the Registrant's 2000 Annual Meeting of
Stockholders are incorporated by reference into Part III of this Form 10-K.
- --------------------------------------------------------------------------------
- --------------------------------------------------------------------------------
<PAGE>   2

                                     PART I

ITEM 1.  BUSINESS

                                    BUSINESS

OVERVIEW

     We are a leading global provider of security management solutions for
protecting e-business. Our Adaptive Security Management approach to information
security protects distributed computing environments, such as internal corporate
networks, inter-company networks and electronic commerce environments, from
attacks, misuse and security policy violations, while ensuring the
confidentiality, privacy, integrity and availability of proprietary information.
We deliver an end-to-end security management solution through our SAFEsuite
security management platform coupled with around-the-clock remote security
monitoring through our industry-leading managed security services offerings,
consulting and education services.

     Our SAFEsuite family of products is a critical element of an active
Internet and networking security program within today's world of global
connectivity, enabling organizations to proactively monitor, detect and respond
to risks to enterprise information. We currently provide remote management of
the industry's best-of-breed security technology including firewalls, VPNs,
anti-virus and URL filtering software, security assessment and intrusion
detection systems.

     ISS is a trusted security provider to its customers, protecting digital
assets and ensuring the availability, confidentiality and integrity of computer
systems and information critical to e-business success. ISS' lifecycle security
management solutions' protect more than five thousand customers including 21 of
the 25 largest US commercial banks, 9 of the 10 largest telecommunications
companies and over 35 government agencies. We also have established strategic
relationships with industry leaders, including Check Point, GTE, IBM, MCI
WorldCom (Embratel), iXL, BellSouth, Microsoft, Nortel and Nokia to enable
worldwide distribution of our core monitoring technology.

INDUSTRY BACKGROUND

     Network computing has evolved from client/server-based local area networks
to distributed computing environments based on the integration of inter-company
wide area networks via the Internet. The proliferation and growth of corporate
intranets and the increasing importance of electronic commerce have dramatically
increased the openness of computer networks, with the Internet becoming a widely
accepted platform for many business-to-business, or B2B, and direct-to-customer,
or B2C, transactions. International Data Corporation ("IDC") estimates that the
number of Internet users will grow from 132 million in 1999 (up from 97 million
in 1998) to 320 million in 2002, and that the value of electronic commerce
transactions will grow from $67 billion to $426 billion over the same period.
Additionally, it estimates that the number of devices accessing the Web will
increase from 120 million in 1998 to 515 million in 2002. To capitalize on these
trends, organizations of all sizes and types are increasingly connecting their
enterprise networks to the Internet to facilitate and support strategic business
objectives, often called "e-business" in the popular press, including:

     - business process re-engineering -- both inter- and intra-company
       processes -- on a massive scale;

     - "buy-side" activities such as supply chain partner integration; on-line
       purchasing and the use of digital marketplaces

     - "sell-side" activities such as web-based customer self-service which is
       access to account information and delivery schedules, integrated,
       closed-loop marketing; auction and dynamic pricing systems to clear
       excess inventory fast, and

     - secure messaging (via virtual private networks) for telecommuters and
       widely disbursed workforces.

     With the increased use of the Internet by businesses and consumers,
organizations increasingly network their key systems in order to reduce costs
and increase revenues. For example, businesses can implement supply chain
management applications through standards enabled by the Internet. To optimize
the supply

                                        1
<PAGE>   3

chain, businesses use the Internet to provide suppliers with access to sensitive
internal information, such as engineering designs, product development plans,
raw material inventories and product schedules. Organizations also strengthen
their ties with customers through "corporate Internet portals" that provide
comprehensive information for purchasing products, checking order status and
managing customer billings. This increased level of access provided by open
systems carries with it the risk of unauthorized access to and use of sensitive
information or malicious disruptions of important information-exchange systems.

THE NEED FOR NETWORK SECURITY

     Although open computing environments have many business advantages and
businesses are depending on them more and more, their accessibility and the
relative anonymity of users make these systems, and the integrity of the
information that is stored on them, vulnerable to security threats. Open systems
present inviting opportunities for computer hackers, curious or disgruntled
employees, contractors and competitors to compromise or destroy sensitive
information within the system or to otherwise disrupt the normal operation of
the system. In addition, open computing environments are complex and typically
involve a variety of hardware, operating systems and applications supplied by a
multitude of vendors, making these networks difficult to manage, monitor and
protect from unauthorized access. Each new addition of operating system
software, applications or hardware products to the distributed computing
environment may introduce a vast number of new vulnerabilities and security
risks. To adequately secure a network, information technology, or information
technology, managers must have the resources to not only correctly configure the
security measures in each system, but also to understand the risks created by
any change to existing systems on the network. This situation is made worse by
the limited supply of personnel knowledgeable in information security issues.
And as more and more executives drive their businesses on-line, the need for
network and information security gets greater and the shortages and lack of
skills get more acute. With high profile "denial of service" attacks on web
sites like YAHOO and CNN.com, security has moved to the forefront, and sometimes
the front page, as a critical piece of the enabling infrastructure of doing
business on-line. Executives must understand and manage the risks involved when
integrating their systems with the systems of suppliers and customers to achieve
strategic objectives. According to the annual Information
Week/PricewaterhouseCoopers LLP 1999 Global Information Security Survey of
information technology managers and professionals, 64% of those surveyed who are
associated with sites selling products or services on the Web reported at least
one security breach in the past year. In addition, sites integrated with
supply-chain network or enterprise resource planning applications reported
security violations 10% more often than sites without such applications. In a
separate PricewaterhouseCoopers survey of chief executive officers, 84% cited
security concerns as a barrier to deployment of information technology
initiatives. Despite the convenience and the compelling economic incentives for
the use of Internet-protocol networks, they cannot reach their full potential as
a platform for global communication and commerce until organizations can
implement an effective platform to manage information risk.

     Historically, organizations with sophisticated, well-funded information
systems departments have responded to perceived security threats by implementing
passive point tools, such as encryption, firewall, authentication and other
technologies designed to protect individual components of their internal
networks from unauthorized use or outside attacks. These technologies address
some security concerns, but are often ineffective because:

     - encryption protects information during transmission; however, it does not
       typically protect information at either the source or the destination;

     - a firewall, which controls the flow of data between an internal network
       and outside networks or the Internet, is necessary for rudimentary access
       control, but must be regularly reconfigured to accommodate new business
       applications, users and business partners on the network. Thus, firewalls
       can be left vulnerable to hackers and others seeking to compromise
       network integrity and fail to protect against improper use by authorized
       users;

     - operating system security mechanisms, such as user authentication,
       passwords and multi-level access rights, can prevent unauthorized access
       by internal and external users. However, deployment issues

                                        2
<PAGE>   4

       such as easily guessed passwords or default accounts left on newly
       installed devices diminish the effectiveness of these measures.

     Passive point tools do not address the fundamental issue that the inherent
utility of open systems is itself the source of their vulnerability. This
conflict between the benefits of open systems and the risks of their
unauthorized use or disruption has not been widely recognized or addressed by
passive security tools.

     Many organizations have developed security policies that define the
appropriate use of network resources, establish the proper configuration of
network services, operating systems and applications and describe the actions to
be taken if there is an attack on the network. These security policies attempt
to define the organization's acceptable level of risk. Organizations, however,
have not had the systems to automatically enforce and implement such policies
across their entire information technology infrastructure. Without such systems,
the dynamic nature of enterprise networks causes the organization's actual
security practice to diverge from the stated security policy, potentially
exposing the organization to additional unanticipated risks.

     To be effective, passive point tools need to be coordinated through
enterprise-wide systems that automatically evaluate and eliminate the
vulnerabilities and threats. Direct observation of vulnerabilities and threats
can allow an organization to define and automatically enforce an integrated,
enterprise-wide information risk management process that can be managed
centrally and implemented on a distributed basis. Any security solution must be:

     - easy to use by both management and the organization's existing
       information technology personnel or service provider;

     - compatible with existing security technologies as well as be flexible
       enough to incorporate new technologies; and

     - able to provide a comprehensive and accurate picture of security issues
       across the organization's entire distributed network such that the
       managers of the system trust the objectivity of the security system in
       monitoring, detecting and responding to vulnerabilities and threats.
       These challenges are magnified tremendously when one begins to consider
       the challenges faced by many less sophisticated and under-manned MIS
       organizations. These groups, trying to support business initiatives
       focused on taking advantage of the Internet, have great difficulty
       staying abreast of the fast-moving and complex security technology
       landscape.

THE ISS SOLUTION

     The enormous potential benefits of "e-business" have driven the Internet
into the "main stream" and with it, the need for security. However, "main
stream" organizations -- unlike our early customers -- are not necessarily
interested in managing information security themselves. Instead, we believe they
want to concentrate on their core business competence and purchase security as a
turnkey solution. For this market-driven reason, we have dramatically increased
our emphasis on providing total lifecycle security solutions and have entered
the managed security services market.

     In 1999, we adopted British Standard 7799, or BS7799. BS7799 is a blueprint
for wrapping various interpretations of information security policy management
into one unified methodology. The British Standard divides security policy into
a five-step, cyclical process: (1) assess, (2) design, (3) deploy, (4)
manage/support and (5) educate. Our customer life cycle methodology, based on
BS7799, permeates our approach to providing total solutions to our customers.
Our implementation of BS7799 consists of the following:

     Assess. (Where Are We?)  Many companies do not know what information
resides on their network. They do not know where it is located, who has access
to it or what would be the cost to them if the information were compromised in
any way. During this phase of the life cycle, our experts identify all of a
customer's network devices and resources and establish valuations for all groups
of data on the customer's network. The value of assessment lies in turning
general descriptions of security needs and network structures into

                                        3
<PAGE>   5

measurable sets of data that we use to design verifiable security policy and
information technology infrastructure.

     Design. (Where Do We Need to Be?)  In this phase of the life cycle, our
teams convert the data gathered during the assessment phase into lists of
information security solutions, deployment locations, implementation strategies
and configuration guidelines for each network device or security application.
When the solution road map is complete, our customer has a security policy,
accompanied by a plan for deploying it and concrete metrics for measuring
compliance.

     Deploy. (How Do We Get There?)  During this period, our experts test and
install the devices and security applications into the customer's production
environment. Deployment is the place where many organizations traditionally
concentrate their security efforts, giving short shrift to the other stages.
Such a narrow view of network security can easily lead to inefficient or
inadequate protection. Our comprehensive perspective on information security
ensures that the security management solution reaches the breadth of the
customer's needs, while simultaneously providing a cost-effective framework for
future growth.

     Manage and Support. (How Do We Maintain and Improve?)  At this stage, a
customer can either choose to run an in-house security management solution, or
outsource information security through our managed security services. This
ongoing stage is where our experts measure performance data from the information
security infrastructure against the goals stated in the security policy mapped
out earlier. Non-compliant systems and events trigger specific actions, as
stated in the policy. These include a re-evaluation of the policy and a restart
of the policy generation process.

     Education. (How Do We Enhance our Understanding?)  Education is a critical
component of the customer life cycle methodology. This ongoing effort to raise
awareness of the need for information security at the executive, management,
administrator and end-user levels cuts across all the steps listed above. It
includes both continuing training for administrators in emerging threats to
their systems and awareness among end users of the benefits of working within
the security architecture.

     Our dynamic, process-driven lifecycle approach to enterprise-wide
information risk management relies on the principles of monitoring, detection
and response to the ever-changing vulnerabilities in and threats to the hardware
products, operating systems and applications that comprise every network system.
We designed our SAFEsuite family of products to enable an organization to
centrally define and manage an information risk policy for its existing network
system infrastructure, including all Internet protocol-enabled devices. Our
solutions provide the ability to visualize, measure and analyze real-time
security vulnerabilities and control threats across the entire enterprise
computing infrastructure, keeping the organization's information technology
personnel informed of changing risk conditions and automatically making
adjustments as necessary. Through custom policies or by using our "best
practice" templates, our customers can minimize security risks without closing
off their networks to the benefits of open computing environments and the
Internet.

     Our solutions reach beyond the traditional approaches to network security
and are predicated on a proactive, risk management-based approach to enterprise
security that links security practice and security policy through a continuous
improvement process:

     - continuously monitoring network, system and user activity and configuring
       devices, systems and applications on the network;

     - detecting security risks in network traffic and within systems;

     - responding to security threats to minimize risks; and

     - analyzing and reporting dynamic risk conditions and response actions and
       updating security policies.

  Comprehensive Enterprise Security Solution

     We combine the above principles with our extensive knowledge of network,
system and application vulnerabilities and threats to provide scalable security
solutions. Our SAFEsuite family of products provides a comprehensive network and
system security framework. In addition, we sell our products individually as

                                        4
<PAGE>   6

solutions for a particular function. We also offer a broad range of professional
services to assist in the development and enforcement of an effective security
policy and to facilitate the deployment and use of our software. Our solutions
are interoperable with a broad range of platforms and complement the products of
leading security and network management vendors. They provide a single point of
management and control for an enterprise-wide security policy. In this manner,
our SAFEsuite family of products serves as a critical enhancement to traditional
passive point tools, such as encryption, firewalls and authentication. We have
designed our products to be easily installed, configured, managed and updated by
a system administrator through an intuitive graphical user interface without
interrupting or affecting network operation. The software automatically
identifies systems and activities that do not comply with a customer's policies,
and provides a critical feedback mechanism for adjusting the security levels of
networked systems based upon its findings. Our products generate
easy-to-understand reports ranging from executive-level trend analysis to
detailed step-by-step instructions for eliminating security risks.

  The X-Force

     Because there are few information technology professionals specifically
trained in network and system security issues, we have assembled a senior
research and development team composed of security experts who are dedicated to
understanding new vulnerabilities and real-time threats and attacks, and
developing solutions to address these security issues. The team is known in the
industry as the "X-Force" and represents one of our competitive advantages.
Because of the collective knowledge and experience of the members of the
X-Force, we believe that they comprise one of the largest and most sophisticated
groups of information technology security experts currently researching
vulnerability and threat science. Organizations such as CERT (Computer Emergency
Response Team), the FBI and leading technology companies routinely consult the
X-Force on network security issues. Through the X-Force, we maintain a
proprietary and comprehensive knowledge base of computer exploits and attack
methods, including what we believe is the most extensive publicly available
collection of Windows NT vulnerabilities and threats in existence. To respond to
an ever-changing risk profile, the X-Force continually updates this knowledge
base with the latest network vulnerability information, which aids in the design
of new products and product enhancements.

STRATEGY

     Our objective is to be the leader in security management for the Internet.
This means providing information risk management systems that proactively
protect the integrity and security of enterprise-wide information systems from
vulnerabilities, misuse, attacks and other information risks. This is regardless
of whether the system is run "in-house" by the management information systems
organization or is outsourced to ISS for remote 24-by-7 management and
monitoring. We focus on developing innovative and automated software and service
solutions to provide customers with a comprehensive framework for protecting
their networks and systems by monitoring for vulnerabilities and real-time
threats. Our solutions allow customers to enforce "best practice" network and
system security policies. Key elements of our strategy include:

  Continue Our Leadership Position in Security Technology

     We intend to maintain and enhance our technological leadership in the
enterprise security market by hiring additional network and Internet security
experts, broadening our proprietary knowledge base, continuing to invest in
product development and product enhancements and acquiring innovative companies
and technologies that complement our solutions. By remaining independent of
other providers of system software, applications and hardware and by solidifying
our position as a best-of-breed provider of monitoring, detection and response
software, we believe that customers and potential customers will view us as the
firm of choice for establishing and maintaining effective security practices and
policies.

  Establish Leadership in Managed Security Services

     During 1999, we extended our market leadership position with the August
acquisition of Netrex, Inc., a pioneer and leading provider of remote, security
monitoring services. The Managed Security Services

                                        5
<PAGE>   7

(MSS) we acquired are designed for businesses that need security but do not have
the time, internal resources or expertise to effectively protect networked
systems and information through an in-house solution.

     This acquisition enables us to deliver end-to-end security management
solutions by extending our market-leading SAFEsuite security management platform
into around-the-clock managed services. In return, our customers now can entrust
their security to ISS experts who monitor and manage their networks 24 hours a
day, seven days a week, 365 days a year.

     International Data Corp. (IDC) projects that demand for managed security
services will reach more than $2.2 billion annually by 2003, with a compounded
growth rate of 45 percent. As e-business continues to penetrate the economy,
security management will come to be viewed as an essential system on the
network, just as network and systems management and storage management are
today. We're poised to take advantage of this inevitability.

  Expand Domestic Sales Channels

     We intend to increase the distribution and visibility of our products by
expanding our regional direct sales program and increasing our market coverage
through the establishment of additional indirect channels with key managed
service providers, Internet service providers, systems integrators, resellers,
OEMs and other channel partners. We believe that a multi-channel sales approach
will build customer awareness of the need for our products and enable us to more
rapidly build market share across a wide variety of industries.

  Enhance and Promote Professional Services Capabilities

     We establish long-term relationships with our customers by serving as a
"trusted advisor" in addressing network security issues. To continue to fulfill
this responsibility to our customers, we are expanding our professional services
capabilities. These capabilities will allow us to maximize the return on
investment we've made in standardizing on BS7799. As previously mentioned,
BS7799 is a blueprint for wrapping various interpretations of information
security policy management into one unified methodology. It is our customer life
cycle methodology, built on this standard, that permeates our approach to
providing total solutions to our customers and provides them with effective
information risk management solutions. By providing professional services, we
also can heighten customer awareness about network security issues, which
creates opportunities for us to sell new products or product enhancements to our
existing customers.

  Expand International Operations

     We plan to continue to aggressively expand our international operations to
address the rapid global adoption of distributed computing environments. Many
foreign countries do not have laws recognizing network intrusion or misuse as a
crime or the resources to enforce such laws if they do exist. As a consequence,
we believe that organizations in such countries will have greater need for
effective security solutions. We currently maintain international offices in
Australia, Belgium, Brazil, Canada, England, France, Germany, Japan and Mexico
and plan to expand in those regions where businesses, governments and other
institutional users are using distributed networks and the Internet for their
mission-critical needs.

PRODUCT ARCHITECTURE

     The SAFEsuite family of products applies our information security
methodology through a flexible architecture designed to be integrated with
existing security and network system infrastructures. Our SAFEsuite products
enhance the effectiveness of passive point tools by monitoring them for threats
and vulnerabilities and responding with actions that align customers' security
practices and policies. SAFEsuite complements network and security management
frameworks by providing information required for informed decisions to minimize
security risks while maintaining the desired level of network functionality.
Thus, our products provide a risk management-based approach to security with
scalable deployment of best-of-breed products and integrated enterprise-wide
implementations.

                                        6
<PAGE>   8

     The SAFEsuite product architecture includes a policy management interface
that lets customers choose among "best practice" templates or policies that
establish the acceptable level of risk appropriate for their networks. Our
individual products then automatically verify compliance with the chosen policy
in terms of actual system configuration and network activity. Graphical reports
describe the deviations from the established policy, including the measures
required to reduce the risk.

     This product architecture allows all the SAFEsuite technologies to connect
directly into common standards, providing comprehensive security reports for the
entire enterprise. To ensure communication confidentiality between individual
SAFEsuite components and to prevent their misuse, SAFEsuite components use RSA
encryption algorithms, which have become de facto encryption standards, among
other encryption technologies. The SAFEsuite Security Knowledge Base, a database
containing information about the devices and security risks on a customer's
network, utilizes open database connectivity, or ODBC, interface and allows
customers to select their preferred database such as Informix, Microsoft SQL
Server, Oracle, Sybase or any ODBC-compliant database for data storage. The
various SAFEsuite products consolidate security data, enabling users to quickly
determine their risk profiles and respond. In addition, SAFEsuite products
provide automated decision support by assessing priorities and providing a
graphical representation of important security risk data sets. This feature
allows key decision-makers to prioritize their program strategies for effective
deployment of resources to minimize security risks.

     Each SAFEsuite product can be deployed as a stand-alone, best-of-breed
solution to meet the needs of the local administrator or departmental user.
Enterprise-level users can analyze security risk conditions for the entire
network through support for remote, multi-level management consoles and the
SAFEsuite Security Knowledge Base. The SAFEsuite Security Knowledge Base allows
the customer to address vulnerabilities and threats, thereby minimizing network
security risk and associated costs. SAFEsuite's frequent updates integrate the
latest identified security vulnerabilities and threats into the operations of an
existing product installation.

                                        7
<PAGE>   9

PRODUCTS

     The following table lists our current offering of SAFEsuite products, and
includes a brief description of each product's functionality and current list
prices (dollar amounts are for the indicated scope of use, with prices
discounted for larger networks):

<TABLE>
<CAPTION>

                                                                                                  INTRODUCTION
                                 DESCRIPTION                    SCOPE         U.S. LIST PRICE         DATE
<S>                   <C>                                 <C>                 <C>               <C>
- -----------------------------------------------------------------------------------------------------------------
   NETWORK SECURITY VULNERABILITY DETECTION, ANALYSIS AND REPORTING
- -----------------------------------------------------------------------------------------------------------------
 Internet Scanner     Comprehensive security                     50 devices      $  3,495       October 1992
                      assessment for all                       1000 devices        19,945
                      devices on an enterprise                 3000 devices        39,500
                      network
- -----------------------------------------------------------------------------------------------------------------

   INTERNAL SYSTEM SECURITY VULNERABILITY DETECTION, ANALYSIS AND REPORTING
- -----------------------------------------------------------------------------------------------------------------
 System Scanner       Internal security assessment              5 computers      $  3,250       January 1997
                      for server operating systems             30 computers        17,500
                                                              100 computers        50,000
- -----------------------------------------------------------------------------------------------------------------

   DATABASE SECURITY VULNERABILITY DETECTION, ANALYSIS AND RESPONSE
- -----------------------------------------------------------------------------------------------------------------
 Database Scanner     Comprehensive security                      5 servers      $  4,475       December 1998
                      assessment for SQL, Oracle                 10 servers         8,500
                      and Sybase databases                       50 servers        41,250
- -----------------------------------------------------------------------------------------------------------------

   NETWORK SECURITY THREAT AND MISUSE DETECTION, ANALYSIS AND RESPONSE
- -----------------------------------------------------------------------------------------------------------------
 RealSecure Engine    Real-time attack recognition,                1 engine      $  8,995       December 1996
                      misuse detection and                       10 engines        69,900
                      response for network traffic               25 engines       149,900
- -----------------------------------------------------------------------------------------------------------------

   INTERNAL SYSTEM SECURITY THREAT AND MISUSE DETECTION, ANALYSIS AND RESPONSE
- -----------------------------------------------------------------------------------------------------------------
 RealSecure Agent     Real-time attack recognition,             5 computers      $  3,750       December 1998
                      misuse detection and                     25 computers        15,000
                      response for activities within          100 computers        50,000
                      systems
- -----------------------------------------------------------------------------------------------------------------

   ENTERPRISE INFORMATION RISK MANAGEMENT
- -----------------------------------------------------------------------------------------------------------------
 SAFEsuite Decisions  Decision support system             Small enterprise       $ 25,000       December 1998
                      for information risk                Medium enterprise       100,000
                      management                          Large enterprise        250,000
- -----------------------------------------------------------------------------------------------------------------
</TABLE>

  Internet Scanner

     Internet Scanner quickly identifies security vulnerabilities in a network
and non-compliance with security policy, plus provides appropriate information
for correcting these potential security exposures, through automated and
comprehensive network security vulnerability detection and analysis. Internet
Scanner scans and detects vulnerabilities, prioritizes security risks and
generates an array of meaningful reports ranging from executive-level trend
analysis to detailed step-by-step instructions for eliminating security risks.
Internet Scanner initiates a scan from a workstation placed inside or outside a
corporate firewall. These scans measure the actual implementation of an
organization's security policies. Scans may be as simple as determining the
basic computing services available on the network or as comprehensive as a
thorough testing using the full range of Internet Scanner's vulnerability
database. Internet Scanner's intranet module methodically examines intranet
servers, routers, operating systems and key applications for potential
violations in security policy. The

                                        8
<PAGE>   10

firewall module works through the network to find firewalls and provide an
accurate assessment of their configuration and degree of protection. Finally,
the Web security module locates intranet, extranet and Internet Web servers,
checking them for possible mis-configurations and security weaknesses. The
product uses Smart Scan, a technique that uses the results of prior scans, as
well as current scans of other devices, to provide a more thorough investigation
of each device. After completing their scans, the Internet Scanner modules
return lists of discovered vulnerabilities and prepare in-depth reports to
assist administrators with follow-up and review. We frequently release new
security tests for Internet Scanner via X-Press Updates(TM) which are downloaded
and installed from the ISS World Wide Web site. Internet Scanner also works
cooperatively with the ISS Database Scanner; any new database server that
Internet Scanner discovers can automatically be tested for database weaknesses
by the ISS Database Scanner.

  System Scanner

     System Scanner serves as a security assessment system that helps manage
security risks through comprehensive detection and analysis of operating system,
application and user-controlled security weaknesses. System Scanner identifies
potential security risks by comparing security policy with actual host computer
configurations. Potential vulnerabilities include missing security patches,
dictionary-crackable passwords, inappropriate user privileges, incorrect file
system access rights, unsecure service configurations and suspicious log
activity that might indicate an intrusion. System Scanner stores scanned
operating system configurations, placing an electronic "fingerprint" on
individual hosts. Routine reviews of these records help identify damaged or
maliciously altered systems before they become a security or performance
liability. Furthermore, System Scanner helps restore suspicious or damaged
systems, generating automated fix scripts for file ownerships and permissions.
System Scanner augments its automated policy compliance testing with an
extensive database of vendor patches and other system enhancements. This
powerful built-in knowledge base quickly pinpoints high-risk activity, such as
password sniffing, remote access programs or unauthorized dial-up modems and
remote control software. System Scanner returns a list of discovered
vulnerabilities and prepares in-depth reports to assist administrators with
follow-up and review. System Scanner supports over 25 versions of Unix servers,
as well as Microsoft Windows NT and Windows 2000 servers. Like Internet Scanner,
System Scanner can be updated with new security tests via X-Press Updates
downloaded from the ISS World Wide Web site.

  Database Scanner

     Database Scanner provides security risk assessment for database management
systems. Database Scanner allows a user to establish a database security policy,
audit a database and present a database's security risks and exposures in
easy-to-read reports. Most database security violations occur not because
databases have inherently weak security, but rather because systems are not set
up correctly and security policies are not established and enforced. Even in a
properly configured system, settings can be changed -- either accidentally or
maliciously -- leaving sensitive information at risk. Database Scanner develops,
implements and maintains appropriate database system security strategies,
policies and procedures. It examines database systems for adherence to accepted
operational standards for account creation, access control, account suspensions
and renewals, along with software upgrades, patches and hot fixes. Database
Scanner also measures and manages the security risks in internal applications
utilizing database management systems. The easy to read reports provide detailed
graphical analysis with recommended fixes and promote effective communication of
security risks across departments and levels of management. Database Scanner
supports Microsoft SQL server, Oracle and Sybase database servers.

  RealSecure

     RealSecure is an integrated network- and host-based intrusion detection and
response system. RealSecure's around-the-clock surveillance extends
unobtrusively across the enterprise, allowing administrators to automatically
monitor network traffic and host logs, detect and respond to suspicious activity
and intercept and respond to internal or external host and network abuse before
system security is compromised. RealSecure's multi-point management architecture
allows for rapid enterprise-wide deployment and operation across

                                        9
<PAGE>   11

geographic and organizational boundaries in both Unix and Windows NT
environments. RealSecure's innovative Manager-Engine-Agent architecture provides
flexible deployments to meet the requirements of diverse corporate networks.

     RealSecure Engine.  The RealSecure Engine runs on dedicated workstations to
provide network intrusion detection and response. Each RealSecure Engine
monitors the packet traffic on a specific network segment for attack
signatures -- telltale evidence that an intrusion attempt is taking place.
Recognition occurs in real time and triggers user-definable alarms and responses
as soon as the attack is detected. RealSecure utilizes proprietary technology to
recognize and efficiently manage a large number of attack patterns on high-
speed networks. Additionally, our Adaptive Filtering Algorithm tunes the packet
filter rules in response to network load, allowing the engine to effectively
function during bursts in network traffic. When a RealSecure Engine detects an
attack or misuse, it transmits an alarm to the RealSecure Manager or a
third-party network management console for administrative follow-up and review.
In addition, RealSecure responds immediately by terminating the connection,
sending email or pager alerts, recording the session, reconfiguring select
firewalls or taking other user-definable actions.

     RealSecure Agent.  RealSecure Agent is a host-based complement to
RealSecure Engine. RealSecure Agent analyzes host logs to recognize attacks,
determine whether an attack was successful and provide other forensic
information not available in real time. Based on what is discovered, RealSecure
Agent reacts to prevent further incursions by terminating user processes and
suspending user accounts. It also logs events, sends, alarms and emails and
executes user-defined actions. Each RealSecure Agent installs on a workstation
or host, thoroughly examining that system's logs for telltale patterns of
network misuse and breaches of security. Like RealSecure Engine, RealSecure
Agent sends an alarm to the RealSecure Manager or third-party network management
console when it detects evidence of improper usage. Based on what it discovers,
RealSecure Agent also automatically reconfigures RealSecure Engines and select
firewalls to prevent future incursions.

  SAFEsuite Decisions

     SAFEsuite Decisions is the initial product in our SAFEsuite Enterprise
family of enterprise security management solutions. SAFEsuite Decisions provides
information security decision support services that consolidate and simplify the
task of maintaining complex information security implementations across an
enterprise network environment. SAFEsuite Decisions integrates critical security
data generated by our Internet Scanner, System Scanner, RealSecure and
third-party firewalls, into a closed, automated feedback loop. This information
is condensed into a comprehensive reporting system, enabling timely, focused and
informed decisions for effective information risk management. By automating the
process of collecting, collating, correlating and analyzing data generated by
multiple information security engines and applications. SAFEsuite Decisions
enables managers and administrators to focus security resources where they are
needed most.

MANAGED SECURITY SERVICES

     We provide comprehensive managed security services, or MSS, for
organizations without a compelling reason to develop an in-house information
security solution. MSS allows a company to start with basic security needs at
low cost, then expand as the business grows. Since the security infrastructure
is disbursed across a large managed services customer base, monthly security
costs are minimized while each aspect of the enterprise is secured against
attack and misuse in accordance with the customer's security policy.

     MSS ensures that online assets are being properly protected. MSS is similar
to outsourced security, but if offers unique advantages that make it an ideal
resource for e-business. Instead of separate vendors for security consulting
services, firewalls, anti-virus and intrusion detection, MSS combines these
basic business necessities with thorough information security analysis to
deliver a complete, customized information security solution. MSS delivers key
advantages for both e-business start-ups and established enterprise players with
massive online operations. Since all security operations take place at Network
Operations Centers, clients

                                       10
<PAGE>   12

don't have to worry about hardware, software, staff or operations. Our unique
web-based management console allows client oversight of all security operations,
plus rapid response to changing network conditions.

PROFESSIONAL SERVICES

     We enhance the value of our products by offering professional consulting
services to assure customers' success in establishing, implementing and
maintaining their security policy. We have network security professionals ready
to assist customers with their particular security policy development and
enforcement needs. Our professional services can range from providing network
security resources for overburdened information technology departments to
conducting investigations of serious breaches in security. Our professional
services offerings include:

     - Information Security Analysis and Assessment -- includes enterprise
       security audits, enterprise security assessment and strategy workshops
       and risk assessment analysis

     - Information Security Design Services -- includes security policy and
       configuration guideline development; information security architecture
       design; and risk management process integration

     - Information Security Deployment Services -- security deployment strategy
       workshop; project "Jump-Start" -- hands-on training and assistance with
       deployment and use of ISS' SAFEsuite products; and enterprise deployment
       of ISS' SAFEsuite solutions throughout an enterprise-level organization.

     - Emergency Response Services -- subscription service that helps customers
       avoid security breaches while helping them prepare in case they do
       experience a break-in.

     - Knowledge Services -- the Savant Security Guide provides administrators
       and staff with critical information regarding security of Windows NT and
       Windows 2000.

     We complement our service offerings with a full range of training and
certification programs. These programs include courses in the fundamentals of
security and networking, vulnerability management, threat management and
intrusion detection, public key infrastructures, firewalls and others. Each
course offers the option of certification via standardized examinations. Our
courses are available at our education centers in Atlanta, Detroit, Chicago,
Denver, Miami, New York, San Francisco, Dallas and Washington, DC, as well as at
customer sites with our mobile training labs, and at approved training centers
around the world. These classes address planning, installation and basic
operation of our products in a hands-on, interactive environment. For more
advanced needs, our ISS Certified Engineer training courses cover advanced
topics specific to each SAFEsuite or SAFEsuite Enterprise product. Our training
goes beyond simple "how to" exercises. Upon completion of instructor-led
discussions and exercises, students respond to actual, on-the-job scenarios.
These simulations allow students to apply their new skills to real-world
situations, reinforcing both basic and advanced skills. Our training courses
encompass the complete life cycle of our SAFEsuite products, from installation
and operations to advanced troubleshooting.

PRICING

     We use a range of fee structures to license our products, depending on the
type of product and the intended use. We license our vulnerability detection
products, Internet Scanner, System Scanner and Database Scanner, based on the
number of devices being scanned. The pricing scheme is scalable, providing low
entry points for departmental users without limiting our revenue potential from
customers with large networks. Pricing for our threat detection products,
RealSecure Engine and RealSecure Agent, is based on the number of engines
deployed on the network. Thus, licensing fees for our products are ultimately
determined by the size of the customer's network, as size dictates the number of
devices to be scanned or the number of engines to be deployed. In addition to
license fees, customers virtually always purchase maintenance agreements in
conjunction with their initial purchase of a software license, with annual
maintenance fees typically equal to 20% of the product's license fee.
Maintenance agreements include annually renewable telephone support, product
updates, access to our X-Force Security Alerts and error corrections. Our
continuing research into new security risks and resulting product updates
provide significant ongoing value. As a result, a substantial majority of our
customers renew their maintenance agreements. Customers who use our

                                       11
<PAGE>   13

products to provide information technology consulting services have license
agreements that are based on a revenue sharing model. We have historically sold
fully-paid perpetual licenses with a renewable annual maintenance fee and, more
recently, have licensed our products on a subscription basis, including
maintenance, for one or two year periods and are exploring other alternatives
for customers desiring longer term arrangements or multi-year commitments.

     Our professional services fees are calculated using an hourly standard rate
per consultant that can be discounted based on the scope of the engagement,
market sector and geographical territory. Our security technology training is
generally priced per-student, per-day, based on the course format, technical
content and the amount of "hands-on" exposure provided to the student in either
our classrooms or at the customer's location.

     Managed Security Services include Managed Firewall, Managed Intrusion
Detection and Response, Automated Remote Vulnerability Assessment and several
related offerings. Service pricing is based on a monthly monitoring and
management fee per managed security device for the term of the service
subscription, typically a minimum of 12 months. In addition, we can provide the
customer the security device itself (i.e., firewall, intrusion detection system,
anti-virus gateway, etc.) and in such case there are additional charges for
hardware, software licenses, maintenance, and installation fees.

PRODUCT DEVELOPMENT

     We developed our SAFEsuite products to operate in heterogeneous computing
environments. Products are compatible with other vendors' products across a
broad range of platforms, including HP-UX, IBM AIX, Linux, SGI IRIX, SunOS, Sun
Solaris, Windows 95/98 and Windows NT. We have incorporated a modular design in
our products to permit plug-and-play capabilities, although customers often use
our professional services or our strategic partners to install and configure
products for use in larger or more complex network systems.

     We employ a two-pronged product development strategy to achieve our goal of
providing the most comprehensive security coverage within the monitoring,
detection and response market. First, we continue to develop best-of-breed
security products to address particular network configurations. Such new
products, and our existing products like Internet Scanner, System Scanner and
RealSecure, are updated approximately every four to six months to add new
features, improve functionality and incorporate timely responses to
vulnerabilities and threats that have been added to our vulnerability and threat
database. These updates are usually provided as part of separate maintenance
agreements sold with the product license.

     Second, to complement our existing products and provide more comprehensive
network security coverage, we are expanding our existing SAFEsuite products by
developing additional enterprise-level products. These products will allow
customers to protect their networks by continuously measuring and analyzing the
status of their network's security, and by monitoring and controlling the
security risks in real time across the enterprise network. These SAFEsuite
enterprise products will be interoperable with our existing products, allowing
modular implementation.

     Expenses for product development were $3.9 million, $9.7 million and $20.4
million in 1997, 1998 and 1999, respectively. All product development activities
are conducted at either our principal offices in Atlanta, or at our research and
development facilities in Mountain View, California, Southfield, Michigan and
Reading, England. At December 31, 1999 253 personnel were employed in product
development teams. Our personnel include members of the Computer Security
Institute, Forum for Incident Response and Security Technicians (FIRST), Georgia
Tech Industrial Partners Association, Georgia Tech Information Security Center
and the International Computer Security Association (ICSA), enabling us to
actively participate in the development of industry standards in the emerging
market for network and Internet security systems and products.

                                       12
<PAGE>   14

CUSTOMERS

     As of December 31, 1999, we had licensed versions of our SAFEsuite family
of products to over 5,000 customers. No customer accounted for more than 10% of
our consolidated revenues in 1997, 1998 or 1999. Our target customers include
both public and private sector organizations that utilize Internet protocol-
enabled information systems to facilitate mission-critical processes in their
operations. Our customers represent a broad spectrum of organizations within
diverse sectors, including financial services, technology, telecommunications,
and government and information technology services.

     The following is a list of certain of our customers that have purchased
licenses and services from us with an aggregate price of at least $15,000 and
which we believe are representative of our overall customer base:

<TABLE>
<S>                                 <C>                                 <C>
FINANCIAL SERVICES                  INFORMATION TECHNOLOGY              GOVERNMENT
  Charles Schwab                    SERVICES                            NASA
  First Union                       EDS                                 Salt River Project
  KeyCorp                           KPMG                                U.S. Department of the
  Merrill Lynch                     Perot Systems                       Air Force
  PNC Bank                          PricewaterhouseCoopers              U.S. Department of the
                                    SAIC                                Army
TELECOMMUNICATIONS                  SITA                                U.S. Department of
  America Online                                                        Defense
  Bell Atlantic                     TECHNOLOGY                          U.S. State Department
  GTE Internetworking               Hewlett-Packard
  NETCOM On-Line                    IBM                                 OTHER
     Communications                 Intel                               Lockheed Martin
  Nippon Telephone &                Lucent Technologies                 Merck
     Telegraph                      Microsoft                           REI
                                    NCR
                                    Siemens
                                    VeriSign
                                    Xerox
</TABLE>

SALES AND MARKETING

  Sales Organization

     Our sales organization is divided regionally among the Americas, Europe and
the Asia/Pacific regions. In the Americas, we market our products primarily
through our direct sales organization augmented by our indirect channels,
including security consultants, resellers, OEMs and systems consulting and
integration firms. The direct sales organization for the Americas consists of
regionally based sales representatives and sales engineers and a telesales
organization located in Atlanta. As of December 31, 1999, we maintained sales
offices in the Atlanta, Austin, Boston, Chicago, Cincinnati, Dallas, Denver, Los
Angeles, Minneapolis, Monterrey, Mexico, New York, Palo Alto, Philadelphia,
Portland, San Francisco, Sao Paulo, Brazil, Seattle, Toronto, Canada and
Washington, D.C. metropolitan areas. A dedicated group of professionals in our
Atlanta headquarters covers Latin America. As of December 31, 1999, we employed
approximately 270 people in the Americas direct sales and professional services
organization. The regionally based direct sales representatives focus on
opportunities where we believe we can realize more than $200,000 in revenues per
year.

     In Europe and the Asia/Pacific region, substantially all of our sales occur
through authorized resellers. Internationally, we have established regional
sales offices in Brussels, London, Munich, Paris, Reading, England, Stuttgart,
Sydney and Tokyo. Personnel in these offices are responsible for market
development, including managing our relationships with resellers, assisting them
in winning and supporting key customer accounts and acting as a liaison between
the end user and our marketing and product development organizations. As of
December 31, 1999, approximately 95 employees were located in our European and
Asia/ Pacific regional offices. We expect to continue to expand our field
organization into additional countries in these regions.

                                       13
<PAGE>   15

  Security Partners Program

     We have established a Security Partners Program to train and organize
security consulting practices, Internet service providers, systems integrators
and resellers to match our products with their own complementary products and
services. By reselling SAFEsuite products, Security Partners provide additional
value for specific market and industry segments, while maintaining our ongoing
commitment to quality software and guaranteed customer satisfaction. We have
established three different levels of partnership opportunities:

     - Premier Partners.  Premier Partners are value-added resellers and systems
       integrators with focused security practices. Many Premier Partners are
       experienced in the sales and implementation of leading firewall
       technology, as well as authentication and encryption technologies. These
       partners leverage their expertise with our vulnerability assessment and
       intrusion detection products. Premier Partners receive direct
       distribution of our products, sales training, financial incentives,
       access to our Web site for placing orders and partner-only
       communications, including a link to the ISS Partner Web site.

     - Authorized Partners.  Authorized Partners generally consist of
       organizations that provide security-focused consulting services, but
       elect not to commit to the minimum annual purchase commitments and entry
       fees applicable to Premier Partners. Authorized Partners may purchase
       products directly from us and may access our Web site to place orders and
       receive partner-only communications.

     - Registered Partners.  Unlike Premier Partners and Authorized Partners,
       Registered Partners are not required to maintain an ISS Certified
       Engineer on their staffs. Registered Partners receive partner-only
       communications and may purchase products directly from us, including
       through our online Web order system.

     In addition, we maintain a strategic technology alliance where beneficial
to improve and extend our technology in the following four key areas:

     - Active Response.  Security breaches require rapid response to identify
       and stop threats before they place critical online assets at risk.
       Through these alliances, firewalls, routers, switches, virtual private
       networks and other technologies can be enabled to be reconfigured
       automatically and in real time to break off the attack and prevent future
       penetrations.

     - Lock Down.  Improper configurations can make any technology vulnerable to
       attack and misuse. Our alliances help develop customized templates that
       enable the secure configuration of network devices. With this "lock down"
       functionality, customers can be assured that information security
       products will function as designed and will be securely configured.

     - Decision Support.  Effective security decision-making and planning
       requires timely analysis of enormous amounts of data across disparate
       systems and network devices. Our alliances help enable fast and informed
       enterprise-wide security decisions by collecting, integrating and
       analyzing data from security and network infrastructure products.
       Resulting high value information is routed to network and systems
       management consoles for immediate action.

     - System and Network Management Technology Integration.  Our alliances help
       integrate ISS information security solutions with enterprise system
       management platforms. This integration simplifies the enforcement and
       implementation of security policies across the enterprise leveraging
       existing information technology resources.

  Marketing Programs

     We conduct a number of marketing programs to support the sale and
distribution of our products. These programs are designed to inform existing and
potential end-user customers, OEMs and resellers about the capabilities and
benefits of our products. Marketing activities include:

     - press relations and education;

     - publication of technical and educational articles in industry journals
       and our on-line magazine, ISS Alert;

                                       14
<PAGE>   16

     - participation in industry tradeshows;

     - product/technology conferences and seminars;

     - competitive analysis;

     - sales training;

     - advertising and development and distribution of marketing literature; and

     - maintenance of our Web site.

     A key element of our marketing strategy is to establish our products and
information security methodology as the leading approach for enterprise-wide
security management. We have implemented a multi-faceted program to leverage the
use of our SAFEsuite product family and Managed Security Services to increase
their acceptance through relationships with various channel partners:

     - Strategic Resellers.  Although we have numerous resellers, certain of
       these relationships have generated significant leverage for us in
       targeted markets. Our strategic resellers, which include EDS, IBM,
       Lucent, Siemens and Softbank, provide broad awareness of our brand
       through enhanced marketing activity, access to large sales forces,
       competitive control points and access to larger strategic customer
       opportunities.

     - Consultants.  The use of our products by security consultants not only
       generates revenue from the license sold to the consultant, but also
       provides us with leads to potential end users with a concern for network
       security. Consultants who have generated substantial leads for our sales
       organization include Andersen Consulting, Arthur Andersen, Deloitte
       Touche Tohmatsu International, Ernst & Young, IBM, KPMG Peat Marwick,
       PricewaterhouseCoopers and SAIC Global Integrity.

     - OEMs.  A number of vendors of security products, including Check Point,
       Entrust, Lucent, NCR and Nortel, have signed OEM agreements with us.
       These agreements enable OEMs to incorporate our products into their own
       product offerings to enhance their security features and functionality.
       We receive royalties from OEM vendors and increased acceptance of our
       products under these arrangements, which, in turn, promote sales of our
       other products to the OEM's customers.

     We typically enter into written agreements with our strategic resellers,
consultants, managed service providers, Internet service providers and OEMs.
These agreements generally do not provide for firm dollar commitments from the
strategic parties, but are intended to establish the basis upon which the
parties will work together to achieve mutually beneficial objectives.

ADVISORY BOARD

     We established an Advisory Board in February 1998 to further our sales and
recruiting efforts. The Advisory Board consists solely of:

     John P. Imlay, Jr.  Mr. Imlay is Chairman of Imlay Investments, and serves
     on the board of directors of the Atlanta Falcons, Gartner Group, Metromedia
     International Group, and several other organizations. He was Chairman of
     Dun & Bradstreet Software Services from March 1990 until November 1996.
     Prior to that, Mr. Imlay served as Chairman and Chief Executive Officer of
     Management Science America, a company that was acquired by Dun & Bradstreet
     Software Services.

     Sam Nunn was a member of the Advisory Board until joining the Board of
Directors in October 1999. The Advisory Board members advise us on long-term
strategic growth, including strategies for selling to key industries,
recruitment of board members and other key personnel, and trends in national and
international policy influencing our products and services. We also anticipate
that Advisory Board members will provide high visibility for us at industry
events and will play key roles in leading customer user groups to support our
growth and industry prominence. Members of the Advisory Board meet individually
or as a group with our management from time to time and have historically been
compensated through issuances of common stock or options to acquire common
stock.

                                       15
<PAGE>   17

CUSTOMER SERVICE AND SUPPORT

     We provide ongoing product support services under license agreements.
Maintenance contracts are typically sold to customers for a one-year term at the
time of the initial product license and may be renewed for additional periods.
Under our maintenance agreements with our customers, we provide, without
additional charge, telephone support, documentation and software updates and
error corrections. Customers that do not renew their maintenance agreements but
wish to obtain product updates and new version releases are generally required
to purchase such items from us at market prices. In general, major new product
releases come out annually, minor updates come out every four to six months and
new vulnerability and threat checks come out every two to four weeks. Customers
with current maintenance agreements may download product updates from our Web
site.

     We believe that providing a high level of customer service and technical
support is necessary to achieve rapid product implementation, which, in turn, is
essential to customer satisfaction and continued license sales and revenue
growth. Accordingly, we are committed to continued recruiting and maintenance of
a high-quality technical support team. We provide telephone support to customers
who purchase maintenance agreements along with their product license. A team of
dedicated engineers trained to answer questions on the installation and usage of
the SAFEsuite products provides telephone support from 8:00 a.m. to 8:00 p.m.,
Eastern time, Monday through Friday, from our corporate office in Atlanta. We
provide telephone support 24 hours a day, seven days a week through a callback
procedure to certain customers who pay an additional fee for the service. In the
United States and internationally, our resellers provide telephone support to
their customers with technical assistance from us. For our managed services
security solutions, customer support is available in several offerings up to 24
hours a day, seven days a week for customers electing this coverage. Support is
offered via phone, email or secures web form and includes access to an online
knowledge base as well as direct contact with qualified support personnel.

COMPETITION

     The market for information security, including monitoring, detection and
response solutions and managed security services is intensely competitive, and
we expect competition to increase in the future. We believe that the principal
competitive factors affecting the market for information security include
security effectiveness, manageability, technical features, performance, ease of
use, price, scope of product offerings, professional services capabilities,
distribution relationships and customer service and support. Although we believe
that our solutions generally compete favorably with respect to such factors, we
cannot guarantee that we will compete successfully against current and potential
competitors, especially those with greater financial resources or brand name
recognition. Our chief competitors generally fall within one of four categories:

     - internal information technology departments of our customers and the
       consulting firms that assist them in formulating security systems;

     - relatively smaller software companies offering relatively limited
       applications for network and Internet security and managed security
       services;

     - large companies, including Axent Technologies and Network Associates,
       that sell competitive products and services, as well as other large
       software companies that have the technical capability and resources to
       develop competitive products; and

     - software or hardware companies that could integrate features that are
       similar to our products and services into their own products and
       services.

     Mergers or consolidations among our competitors, or acquisitions of small
competitors by larger companies, would make such combined entities more
formidable competitors to us. Large companies may have advantages over us
because of their longer operating histories, greater name recognition, larger
customer bases or greater financial, technical and marketing resources. As a
result, they may be able to adapt more quickly to new or emerging technologies
and changes in customer requirements. They can also devote greater resources to
the promotion and sale of their products than we can. In addition, these
companies have reduced, and could continue to reduce, the price of their
security monitoring, detection and response products, and/or

                                       16
<PAGE>   18

managed security services, which increases pricing pressures within our market.
We believe that the entry of larger, more established companies into our market
will require these competitors to undertake operations that are currently not
within their core areas of expertise, thus exposing them to significant
uncertainties in the product development process.

     Several companies currently sell software products, such as encryption,
firewall, operating system security and virus detection software that our
customers and potential customers have broadly adopted. Some of these companies
sell products that perform the same functions, or similar functions to, our
products. In addition, vendors of operating system software or networking
hardware may enhance their products to include the same kinds of functions that
our products currently provide. The widespread inclusion in operating system
software or networking hardware of features comparable to our software could
render our products obsolete, particularly if such features are of a high
quality. Even if security functions integrated into operating system software or
networking hardware are more limited than those of our software, a significant
number of customers may accept more limited functionality to avoid purchasing
additional software.

     For the above reasons, we may not be able to compete successfully against
our current and future competitors. Increased competition may result in price
reductions, reduced gross margins and loss of market share.

PROPRIETARY RIGHTS AND TRADEMARK ISSUES

     We rely primarily on copyright and trademark laws, trade secrets,
confidentiality procedures and contractual provisions to protect our proprietary
rights. We have obtained one United States patent and have a patent application
under review. We also believe that the technological and creative skills of our
personnel, new product developments, frequent product enhancements, our name
recognition, our professional services capabilities and delivery of reliable
product maintenance are essential to establishing and maintaining a technology
leadership position. We cannot assure you that our competitors will not
independently develop technologies that are similar to ours. We generally
license our SAFEsuite products to end users in object code (machine-readable)
format. Certain customers have required us to maintain a source-code escrow
account with a third-party software escrow agent, and a failure by us to perform
our obligations under any of the related license and maintenance agreements, or
our insolvency, could conceivably cause the release of our product source code
to such customers. The standard form agreement allows the end user to use our
SAFEsuite products solely on the end user's computer equipment for the end
user's internal purposes, and the end user is generally prohibited from
sublicensing or transferring the products.

     Despite our efforts to protect our proprietary rights, unauthorized parties
may attempt to copy aspects of our products or to obtain and use information
that we regard as proprietary. Policing unauthorized use of our products is
difficult. While we cannot determine the extent to which piracy of our software
products occurs, we expect software piracy to become a persistent problem. In
addition, the laws of some foreign countries do not protect our proprietary
rights to as great an extent as do the laws of the United States and many
foreign countries do not enforce these laws as diligently as U.S. government
agencies and private parties.

EMPLOYEES

     As of December 31, 1999, we had 785 employees, of whom 253 were engaged in
product research and development, 228 were engaged in sales, 55 were engaged in
customer service and support, 152 were engaged in professional services, 35 were
engaged in marketing and business development and 62 were engaged in
administrative functions. We believe that we have good relations with our
employees.

ITEM 2.  PROPERTIES

     Our Atlanta headquarters and research and development facilities consist of
approximately 72,000 square feet of office space occupied pursuant to a lease
and a sublease expiring in June 2002, which provide for minimum annual lease
obligations of approximately $1,240,000. We also lease office space in Chicago,
Illinois, Mountain View, California, Southfield, Michigan, Denver, Colorado, New
York City, San Francisco,

                                       17
<PAGE>   19

California, Washington, D.C., Brussels, London, Paris, Reading, England,
Stuttgart and Tokyo, as well as small executive suites in several United States
cities.

     In November 1999 we signed an eleven and one-half year lease for a new
Atlanta headquarters and research and development facility. This new facility
consists of approximately 240,000 square feet which we anticipate beginning
occupying in varying phases beginning in November 2000. Annual minimum payments
under the lease increase as occupied space increases, with total minimum
payments due under the lease of approximately $64 million over the lease term.

     We believe that our existing facilities and our upcoming new headquarters
are adequate for our current needs and that additional space will be available
as needed.

ITEM 3.  LEGAL PROCEEDINGS

     On July 13, 1999 ISS and Network Associates, Inc. announced that the patent
infringement suit filed by Network Associates, Inc. in July 1998 against
Internet Security Systems, Inc. was resolved to the parties' mutual
satisfaction. The resolution of this previously pending litigation had no
material adverse effect on our business, operating results, or financial
condition.

     Except as noted above, we are not a party to any material legal
proceedings.

ITEM 4.  SUBMISSION OF MATTERS TO A VOTE OF SECURITY HOLDERS

     No matter was submitted to a vote of our shareholders during the fourth
quarter of 1999.

                                       18
<PAGE>   20

                                    PART II

ITEM 5.  MARKET FOR REGISTRANT'S COMMON EQUITY AND RELATED STOCKHOLDER MATTERS

     The Common Stock has been quoted on the Nasdaq National Market under the
symbol "ISSX" since our initial public offering on March 24, 1998. Prior to the
initial public offering, there had been no public market for the Common Stock.
The following table lists the high and low per share sales prices for the Common
Stock as reported by the Nasdaq National Market for the periods indicated
(prices have been adjusted for the 2-for-1 stock split in May 1999):

<TABLE>
<CAPTION>
                           1999:                               HIGH     LOW
                           -----                              ------   ------
<S>                                                           <C>      <C>
First Quarter...............................................  $46.25   $22.19
Second Quarter..............................................   45.00    20.13
Third Quarter...............................................   40.63    20.00
Fourth Quarter..............................................   71.13    26.25
</TABLE>

<TABLE>
<CAPTION>
                           1998:                               HIGH     LOW
                           -----                              ------   ------
<S>                                                           <C>      <C>
First Quarter (from March 24, 1998).........................  $21.25   $18.50
Second Quarter..............................................   28.31    15.81
Third Quarter...............................................   25.25    12.69
Fourth Quarter..............................................   30.31     8.50
</TABLE>

     As of March 24, 2000, there were 41,766,717 shares of the Common Stock
outstanding held by 386 stockholders of record.

     We have not declared or paid cash dividends on our capital stock during the
last two years. The Company currently intends to retain any earnings for use in
its business and does not anticipate paying any cash dividends in the
foreseeable future. The Company's Board of Directors, if any, will determine
future dividends.

     During 1997 and 1998, the Company issued an aggregate of 289,500 shares of
its Common Stock to employees and a director pursuant to exercises of stock
options, with exercise prices ranging from $0.075 to $3.50 per share,
principally under the Company's Restated 1995 Stock Incentive Plan which were
deemed exempt from registration under Section 5 of the Securities Act of 1933 in
reliance upon Rule 701 there under. The recipients of securities in each such
transaction represented their intentions to acquire the securities for
investment only and not with a view to, or for sale in connection with, any
distribution thereof and appropriate legends were affixed to the share
certificates issued in each such transaction.

     The Company issued 2,444,174 shares of its Common Stock as consideration
for all the issued and outstanding stock of Netrex, Inc. on August 30, 1999. The
Company also issued 141,479 shares of its Common Stock in September 1999 as
consideration for all the issued and outstanding stock of NJH Security
Consulting, acquired by the Company in September 1999. As part of the terms of
these acquisitions, the Company filed a shelf registration statement in October
1999 on Form S-3 covering 723,987 shares issued in connection with the
acquisitions of Netrex and NJH. In addition to the issuance of stock pursuant to
stock options in 1997 and 1998, the Company issued (i) 239,988 shares of its
Common Stock as partial consideration for all the issued and outstanding capital
stock of March Information Systems Limited on October 6, 1998, and (ii) 76,000
shares of its Common Stock in exchange for substantially all the assets of
DbSecure, Inc. on October 28, 1998.

                                       19
<PAGE>   21

ITEM 6.  SELECTED CONSOLIDATED FINANCIAL DATA

     The financial data set forth below for each of the three years in the
period ended December 31, 1999, and as of December 31, 1998 and 1999, has been
derived from the audited consolidated financial statements appearing elsewhere
in this Annual Report on Form 10-K. The financial data for the years ended
December 31, 1995 and December 31, 1996, and as of December 31, 1995, 1996, and
1997 has been derived from unaudited financial statements not included herein.
The data should be read in conjunction with the consolidated financial
statements, related notes, and other financial information included herein.

<TABLE>
<CAPTION>
                                                                        YEAR ENDED DECEMBER 31,
                                                            ------------------------------------------------
                                                             1995      1996      1997      1998       1999
                                                            -------   -------   -------   -------   --------
                                                            (AMOUNTS IN THOUSANDS, EXCEPT PER SHARE AMOUNTS)
<S>                                                         <C>       <C>       <C>       <C>       <C>
CONSOLIDATED STATEMENT OF OPERATIONS DATA:
Revenues:
  Product licenses and sales..............................  $ 1,028   $ 6,503   $16,074   $36,908   $ 74,050
  Subscriptions...........................................      296     1,077     4,488    12,037     24,141
  Professional services...................................      672     1,945     4,863     8,143     18,296
                                                            -------   -------   -------   -------   --------
                                                              1,996     9,525    25,425    57,088    116,487
Costs and expenses:
  Cost of revenues........................................      980     2,948     7,275    19,951     37,700
  Research and development................................       97     1,225     3,855     9,655     20,412
  Sales and marketing.....................................      507     4,549    14,096    25,998     43,124
  General and administrative..............................      382     1,704     3,668     6,557      9,230
  Amortization............................................       --        --        --       230        992
  Charges for in-process research and development.........       --        --        --       802         --
  Merger costs............................................       --        --        --        --      2,329
                                                            -------   -------   -------   -------   --------
                                                              1,966    10,426    28,894    63,193    113,787
                                                            -------   -------   -------   -------   --------
Operating income (loss)...................................       30      (901)   (3,469)   (6,105)     2,700
Interest income, net......................................      (12)       28       163     2,274      5,902
Exchange loss.............................................       --        --        --        --       (136)
                                                            -------   -------   -------   -------   --------
Income (loss) before income taxes.........................       18      (873)   (3,306)   (3,831)     8,466
Provision for income taxes................................       --        --        --        62        976
                                                            -------   -------   -------   -------   --------
Net income (loss).........................................  $    18   $  (873)  $(3,306)  $(3,893)  $  7,490
                                                            =======   =======   =======   =======   ========
Basic net income (loss) per share(1)......................  $    --   $ (0.05)  $ (0.18)  $ (0.12)  $   0.19
                                                            =======   =======   =======   =======   ========
Diluted net income (loss) per share(1)....................  $    --   $ (0.05)  $ (0.18)  $ (0.12)  $   0.17
                                                            =======   =======   =======   =======   ========
Weighted average shares:(2)
  Basic...................................................   12,446    18,276    18,399    32,351     39,996
                                                            =======   =======   =======   =======   ========
  Diluted.................................................   12,446    18,276    18,399    32,351     43,691
                                                            =======   =======   =======   =======   ========
Unaudited pro forma net loss per share(1).................                      $ (0.11)  $ (0.11)
                                                                                =======   =======
Unaudited weighted average shares used in unaudited pro
  forma net loss per share calculation(1).................                       29,873    34,963
                                                                                =======   =======
</TABLE>

<TABLE>
<CAPTION>
                                                                              DECEMBER 31,
                                                            ------------------------------------------------
                                                             1995      1996      1997      1998       1999
                                                            -------   -------   -------   -------   --------
                                                                             (IN THOUSANDS)
<S>                                                         <C>       <C>       <C>       <C>       <C>
CONSOLIDATED BALANCE SHEET DATA:
Cash and cash equivalents.................................  $    27   $ 2,051   $ 4,174   $53,056   $ 70,090
Working capital...........................................      168     2,403     1,523    53,157    127,135
Total assets..............................................      673     5,931    13,816    84,724    184,845
Long-term debt, net of current portion....................       --       140       521       710        253
Redeemable, Convertible Preferred Stock...................       --     3,614     8,878        --         --
Stockholders' equity (deficit)............................      275      (620)    4,468    66,505    155,153
</TABLE>

- ---------------

(1) Computed on the basis described in Note 1 of Notes to Consolidated Financial
    Statements.
(2) See Note 10 of Notes to Consolidated Financial Statements for the
    determination of shares used in computing basic and diluted net income
    (loss) per share.

                                       20
<PAGE>   22

ITEM 7.  MANAGEMENT'S DISCUSSION AND ANALYSIS OF FINANCIAL CONDITION AND RESULTS
OF OPERATIONS

     The following discussion should be read in conjunction with the
Consolidated Financial Statements and related Notes thereto included elsewhere
in this document. Except for the historical financial information, the matters
discussed in this document may be considered "forward-looking" statements. Such
statements include declarations regarding our intent, belief or current
expectations. Such forward-looking statements are not guarantees of future
performance and involve a number of risks and uncertainties. Actual results may
differ materially from those indicated by such forward-looking statements as a
result of certain factors, including, but not limited to, those set forth under
the "Risk Factors" heading below.

OVERVIEW

     We are a leading source for e-business security management solutions. Our
Security Management approach to information security protects distributed
computing environments, such as internal corporate networks, inter-company
networks and electronic commerce environments, from attacks, misuse and security
policy violations, while ensuring the confidentiality, privacy, integrity and
availability of proprietary information. We deliver an end-to-end security
management solution through our SAFEsuite security management platform coupled
with around-the-clock remote security monitoring through our managed security
services offerings. Our SAFEsuite family of products is a critical element of an
active Internet and networking security program within today's world of global
connectivity, enabling organizations to proactively monitor, detect and respond
to risks to enterprise information. Our managed security services offerings
currently provide remote management of the industry's best-of-breed security
technology including firewalls, virtual private networks, or VPNs, anti-virus,
URL filtering software, and security assessment and intrusion detection systems.
We focus on serving as the trusted security provider to our customers by
maintaining within our existing products the latest counter-measures to security
risks, creating new innovative products based on our customers' needs and
providing education, consulting and managed security services.

     We generate a majority of our revenues from our SAFEsuite family of
products in the form of perpetual licenses and subscriptions, and sales of
best-of-breed technology products developed by our partners. We recognize
perpetual license revenues from ISS developed products upon delivery of software
or, if the customer has evaluation software, delivery of the software key and
issuance of the related license, assuming that no significant vendor obligations
or customer acceptance rights exist. When payment terms are extended over
periods greater than 12 months, revenue is recognized as such amounts are
billable. Product sales, consisting of software developed by third-party
partners combined in some instances with associated hardware appliances and
partner maintenance services, are recognized upon shipment to the customer. If
maintenance is subcontracted, as with partner maintenance services, the revenue
less the related subcontract expense is recognized when the contract is placed
in service.

     Annual renewable maintenance is a separate component of each perpetual
license agreement for ISS products with revenue recognized ratably over the
maintenance term. Subscription revenues include maintenance, term licenses, and
managed service arrangements. Term licenses allow customers to use our products
and receive maintenance coverage for a specified period, generally 12 months. We
recognize revenues from these term agreements ratably over the subscription
term. Managed services consist of monitoring services of information assets and
systems and are recognized as such services are provided. Professional services
revenues include consulting services and training. Consulting services,
typically billed on a time-and-materials basis, assist in the successful
deployment of our products within customer networks, the development of
customers' security policies and the assessment of security policy decisions. We
recognize such professional services revenues as the related services are
rendered.

     We believe that our total solutions approach will grow all of our revenue
categories. This includes our products and managed services offerings, as well
as maintenance, consulting and education. While we expect the expansion of these
product and service offerings to originate primarily from internal development,
our strategy includes acquiring products, technologies and service capabilities
that fit within our strategy and that potentially accelerate the timing of the
commercial introduction of such products and technologies. Over the

                                       21
<PAGE>   23

last 12 months, we have made four different acquisitions, each of which included
such products, technologies or service capabilities.

     Two of these acquisitions, Netrex, Inc. and NJH Security Consulting
("NJH"), were completed in the third quarter of 1999. Founded in 1992 with a
current services customer base of more than 500 customers, Netrex is a leading
provider of remote, security monitoring services of digital assets. NJH Security
Consulting includes a technology foundation to provide an outsourced solution
for the automatic detection and management of customers' security risks using
ISS software solutions. This technology is being incorporated into our managed
security service offerings. These transactions have been accounted for using the
pooling-of-interests method of accounting. Our consolidated financial statements
have been restated for all periods presented to include the results of Netrex.
The acquisition of NJH was not material to our consolidated operations and
financial position and, therefore, our operating results have not been restated
for this transaction. Our operating results include the results of operations of
NJH since the date of acquisition.

     Our business has been growing rapidly. Although we continue to experience
significant revenue growth, we cannot assure our stockholders that such growth
can be sustained and, therefore, investors should not rely on our past growth as
a predictor of future performance. We expect to continue to expand our domestic
and international sales and marketing operations, increase our investment in
product development, including our proprietary threat and vulnerability database
and managed services capabilities, seek acquisition candidates that will enhance
our products and market share, and improve our internal operating and financial
infrastructure in support of our strategic goals and objectives. All of these
initiatives will increase operating expenses. Thus, our prospects must be
considered in light of the risks and difficulties frequently encountered by
companies in new and rapidly evolving markets. As a result, while we narrowed
our operating losses over the course of 1998 and achieved profitability
throughout 1999, we cannot be certain that we can sustain such profitability.

RESULTS OF OPERATIONS

     The following table sets forth our consolidated historical operating
information, as a percentage of total revenues, for the periods indicated:

<TABLE>
<CAPTION>
                                                              YEAR ENDED DECEMBER 31,
                                                              -----------------------
                                                              1997     1998     1999
                                                              -----    -----    -----
<S>                                                           <C>      <C>      <C>
Product licenses and sales................................     63.2%    64.6%    63.6%
Subscriptions.............................................     17.7     21.1     20.7
Professional services.....................................     19.1     14.3     15.7
                                                              -----    -----    -----
          Total revenues..................................    100.0    100.0    100.0
                                                              -----    -----    -----
Cost of revenues..........................................     28.6     34.9     32.4
Research and development..................................     15.2     16.9     17.5
Sales and marketing.......................................     55.4     45.6     37.0
General and administrative................................     14.4     11.5      7.9
Amortization..............................................       --      0.4      0.9
Charge for in-process research and development............       --      1.4       --
Merger costs..............................................       --       --      2.0
                                                              -----    -----    -----
          Total costs and expenses........................    113.6    110.7     97.7
                                                              -----    -----    -----
Operating income (loss)...................................    (13.6)%  (10.7)%    2.3%
                                                              =====    =====    =====
</TABLE>

REVENUES

     Our total revenues increased from $25.4 million in 1997 to $57.1 million in
1998, and to $116.5 million in 1999. Revenues from product licenses and sales
increased from $16.1 million in 1997 to $36.9 million in 1998, and to $74.1
million in 1999. Historically we have generated most of our revenues from
product licenses and sales, which represented 63% of total revenues in 1997, 65%
in 1998 and 64% in 1999.

                                       22
<PAGE>   24

     Licenses of our SAFEsuite product family represented between 66% and 70% of
product licenses and sales from 1997 through 1999. Our vulnerability assessment
products continued to grow each year in absolute dollars but decreased as a
percent of total revenues, offset by the rapid growth of our RealSecure
intrusion detection products and initial sales of our security management
application, SAFEsuite Decisions, which was introduced in late 1998. Our
revenues from sales of partner software and hardware appliances increased each
year in absolute dollars, while representing between 30% and 34% of overall
product licenses sales and in each period.

     We continued to add significant functionality to our SAFEsuite product
family, providing customers with more powerful and easier to use solutions for
security management across the enterprise. The sales of partner software and
hardware appliances are a part of our total solution approach whereby we
provision partner products to provide a single solution source for our
customers.

     Subscription revenues grew from $4.5 million in 1997 to $12.0 million in
1998, and to $24.1 million in 1999, increasing from 18% to 21% of total revenues
over this period. Subscription revenues consist of maintenance, term licenses of
product usage and managed services.

     Professional services revenue increased from $4.9 million in 1997 to $8.1
million in 1998, and to $18.3 million in 1999, representing 19% in 1997, 14% in
1998 and 16% in 1999 of total revenues. We continue to build our service
capabilities to address the demand from our customers for assessment,
deployment, management and education services.

     Geographically, we derived the majority of our revenues from sales to
customers within North America; however, international operations continued to
be a significant contributor to revenues and a growing percentage of the
business. Revenues from customers outside of North America represented 11% in
1997, 12% in 1998 and 17% in 1999 of total revenues. No customer represented
more than 10% of our total revenues in any of these periods.

COSTS AND EXPENSES

  Cost of revenues

     Cost of revenues consists of several components. Substantially all of the
cost of product licenses and sales represents payments to partners for their
products that we provision to our customers. Costs associated with licensing ISS
products are minor. Costs of product revenues as a percentage of total revenues
decreased from 18% in 1997 to 16% in 1998 and remained at the 16% level in 1999.
The decrease in 1998 was principally the result of improvement in gross margin
on partner product sales.

     Cost of subscription and services includes the cost of our technical
support personnel who provide assistance to customers under maintenance
agreements, the operations center costs of providing managed services and the
costs related to professional services and training. These costs represented 10%
in 1997, 19% in 1998 and 16% in 1999 of total revenues, with the percentage
fluctuation due primarily to initiatives in the professional services area.
Prior to 1998, professional services represent training and implementation
services provided by Netrex. In 1998, we addressed the demand from customers for
consulting services by building an ISS professional services capability. With
that building effort behind us, the cost, as a percentage of revenues, declined
in 1999 as staff utilization improved.

  Research and development

     Research and development expenses consist of salary and related costs of
research and development personnel, including costs for employee benefits, and
depreciation on computer equipment. These costs include those associated with
maintaining and expanding the "X-Force," experts dedicated to counter-
intelligence against hacker threats. X-Force experts focus solely on researching
and publishing information on the latest security risks, providing customers and
the industry at large with critical data and protection measures to address the
latest global security issues. We continue to increase these expenditures, as we
perceive primary research and product development and managed services offerings
as essential ingredients for retaining our leadership position in the market. We
also increased the number of our development personnel

                                       23
<PAGE>   25

focused on our best-of-breed products, enterprise applications, managed services
offerings and research for future product offerings. Accordingly, research and
development expenses increased in absolute dollars from $3.9 million in 1997 to
$9.7 million in 1998, and to $20.4 million in 1999. These costs increased
slightly as a percentage of total revenues, and we expect this percentage to
stabilize in 2000 near the 1999 level.

     We have reflected a charge of $802,000 in our 1998 statement of operations
for identified in-process research and development in connection with our
October 1998 acquisitions of two companies engaged in Microsoft Windows NT, Unix
and database security assessment technologies. The charge was based on a
valuation of products under development using estimated future cash flows,
reduced for the core technology component of such products and the percentage of
product development remaining at the time of acquisition.

  Sales and marketing

     Sales and marketing expenses consist primarily of salaries, travel
expenses, commissions, advertising, maintenance of the our Website, trade show
expenses, costs of recruiting sales and marketing personnel and costs of
marketing materials. Sales and marketing expenses were $14.1 million in 1997,
$26.0 million in 1998 and $43.1 million in 1999. Sales and marketing expenses
increased in total dollars during these periods primarily from our larger
workforce, which has increased each quarter since 1997, both domestically and
internationally. Sales and marketing expenses have decreased as a percentage of
total revenues from 55% in 1997 to 46% in 1998, and to 37% in 1999. The decrease
in sales and marketing expenses as a percentage of total revenues is due to
greater levels of productivity achieved by our sales force. This is due to more
experience in selling our broadening enterprise offering of products and
services and the interest of the marketplace in such offerings. In 2000, our
efforts will include the successful integration of the Netrex sales personnel
and continuing improvement of the quality of our sales force.

  General and administrative

     General and administrative expenses of $3.7 million in 1997, $6.6 million
in 1998 and $9.2 million in 1999, represented approximately 14% in 1997, 12% in
1998 and 8% in 1999 of our total revenues. General and administrative expenses
consist of personnel-related costs for executive, administrative, finance, human
resources, information systems and other support services costs and legal,
accounting and other professional service fees. The increase in these expenses
in absolute dollars is attributable to our effort, through additional employees
and systems, to enhance our management's ability to obtain and analyze
information about our domestic and international operations, as well as the
expansion of our facilities.

     Merger costs of $2.3 million represented the direct out-of-pocket costs
incurred in connection with two acquisitions that were completed in the third
quarter of 1999. These costs are principally investment advisor, legal and
accounting fees. We also incurred amortization expense of $230,000 in 1998 and
$992,000 in 1999 related to goodwill and intangible assets resulting from 1998
acquisitions.

  Interest income, net and exchange loss

     Net interest income increased from $163,000 in 1997 to $2.3 million in
1998, and to $5.9 million in 1999 primarily due to increased amounts of cash
invested in interest-bearing securities. This increase in cash primarily
resulted from the sale of equity securities. The exchange loss of $136,000 in
1999 is a result of fluctuations in currency exchange rates between the U.S.
Dollar and other currencies, primarily the Japanese Yen.

  Income taxes

     We recorded a provision for income taxes of $62,000 in 1998 and $976,000 in
1999. These provisions relate primarily to European operations. Prior to the
merger, Netrex profits were taxed at the shareholder level.

     In 1999, we utilized loss carryforwards to offset tax expense that would
otherwise be recorded on profits from certain operations for 1999. As of
December 31, 1999 substantially all loss carryforwards that would reduce future
income tax expense related to United States operations have been utilized;
however, we have

                                       24
<PAGE>   26

approximately $32 million of carryforwards related to the exercise of stock
options which expire in 2014 and 2015. While income tax expense will be recorded
on any future income before taxes related to United States operations, these
carryforwards will reduce the related income tax payable and their use will be
recorded as additional paid-in-capital. We also have approximately $1.2 million
of net operating loss carryforwards related to certain foreign operations and
approximately $1.3 million of research and development tax credit carryforwards
which expire between 2011 and 2019.

QUARTERLY RESULTS OF OPERATIONS

     The following table sets forth certain unaudited consolidated quarterly
statement of operations data for the eight quarters ended December 31, 1999, as
well as such data expressed as a percentage of our total revenues for the
periods indicated. This data has been derived from unaudited consolidated
financial statements that, in our opinion, include all adjustments (consisting
only of normal recurring adjustments) necessary for a fair presentation of such
information when read in conjunction with our consolidated financial statements
and related notes appearing elsewhere in this document. As a result of our
limited operating history and the risks associated with the new and rapidly
evolving market that we serve, the operating results for any quarter below are
not necessarily indicative of results for any future period.

<TABLE>
<CAPTION>
                                                     1998                                        1999
                                   ----------------------------------------    ----------------------------------------
                                    MAR.       JUNE       SEPT       DEC.       MAR.       JUNE       SEPT       DEC.
                                     31         30         30         31         31         30         30         31
                                   -------    -------    -------    -------    -------    -------    -------    -------
                                                                  (AMOUNTS IN THOUSANDS)
<S>                                <C>        <C>        <C>        <C>        <C>        <C>        <C>        <C>
CONSOLIDATED STATEMENT OF
  OPERATIONS DATA:
Revenues:
  Product and license sales......  $ 6,946    $ 7,865    $8,335     $13,762    $14,458    $17,606    $19,200    $22,786
  Subscriptions..................    2,161      2,597     3,312       3,967      4,883      5,497      6,202      7,559
  Professional services..........    1,370      1,362     2,165       3,246      3,634      4,176      4,599      5,887
                                   -------    -------    ------     -------    -------    -------    -------    -------
                                    10,477     11,824    13,812      20,975     22,975     27,279     30,001     36,232
Costs and expenses:
  Cost of revenues...............    3,604      4,248     4,487       7,612      6,518      9,206      9,856     12,120
  Research and development.......    1,724      1,907     2,616       3,408      4,062      4,785      5,315      6,250
  Sales and marketing............    5,305      6,224     6,511       7,958      9,437     10,161     10,991     12,535
  General and administrative.....    1,443      1,592     1,456       2,066      2,311      2,140      2,105      2,674
  Amortization...................       --         --        --         230        251        248        247        246
  Charge for in-process research
    and development..............       --         --        --         802         --         --         --         --
  Merger costs...................       --         --        --          --         --         --      2,329         --
                                   -------    -------    ------     -------    -------    -------    -------    -------
        Total costs and
          expenses...............   12,076     13,971    15,070      22,076     22,579     26,540     30,843     33,825
                                   -------    -------    ------     -------    -------    -------    -------    -------
Operating income (loss)..........   (1,599)    (2,147)   (1,258)     (1,101)       396        739       (842)     2,407
Interest income, net.............       60        828       730         656        861      1,513      1,640      1,888
Exchange loss....................       --         --        --          --         --         --         --       (136)
                                   -------    -------    ------     -------    -------    -------    -------    -------
Income (loss) before taxes.......   (1,539)    (1,319)     (528)       (445)     1,257      2,252        798      4,159
Provision for income taxes.......       --         --        --          62         81        125        105        665
                                   -------    -------    ------     -------    -------    -------    -------    -------
Net income (loss)................  $(1,539)   $(1,319)   $ (528)    $  (507)   $ 1,176    $ 2,127    $   693    $ 3,494
                                   =======    =======    ======     =======    =======    =======    =======    =======
AS A PERCENTAGE OF TOTAL
  REVENUES:
Revenues:
  Product and license sales......     66.3%      66.5%     60.3%       65.6%      62.9%     64.5%       64.0%      62.9%
  Subscriptions..................     20.6       22.0      24.0        18.9       21.3       20.2       20.7       20.9
  Professional services..........     13.1       11.5      15.7        15.5       15.8       15.3       15.3       16.2
                                   -------    -------    ------     -------    -------    -------    -------    -------
                                     100.0      100.0     100.0       100.0      100.0      100.0      100.0      100.0
Costs and expenses:
  Cost of revenues...............     34.4       35.9      32.5        36.3       28.4       33.8       32.9       33.5
  Research and development.......     16.5       16.1      19.0        16.3       17.7       17.6       17.7       17.2
  Sales and marketing............     50.6       52.6      47.1        37.9       41.1       37.2       36.6       34.6
  General and administrative.....     13.8       13.5      10.5         9.8       10.0        7.8        7.0        7.4
  Amortization...................       --         --        --         1.1        1.1        0.9        0.8        0.7
  Charge for in-process research
    and development..............       --         --        --         3.8         --         --         --         --
  Merger costs...................       --         --        --          --         --         --        7.8         --
                                   -------    -------    ------     -------    -------    -------    -------    -------
        Total costs and
          expenses...............    115.3      118.1     109.1       105.2       98.3       97.3      102.8       93.4
Operating income (loss)..........    (15.3)%    (18.1)%    (9.1)%      (5.2)%      1.7        2.7       (2.8)%      6.6
                                   =======    =======    ======     =======    =======    =======    =======    =======
</TABLE>

                                       25
<PAGE>   27

LIQUIDITY AND CAPITAL RESOURCES

     We have historically financed our operations primarily through the sale of
equity securities, including an initial public offering in 1998.

     In 1999 we met our working capital needs and capital equipment needs with
cash provided by operations. Cash provided by operations in 1999 totaled $11.8
million, resulting primarily from net income of $7.5 million and non-cash
depreciation and amortization expense of $5.0 million.

     Our investing activities of $74.4 million in 1999 included the purchase of
$68.0 million of marketable securities, primarily interest-bearing government
obligations and commercial paper. We also invested in equipment totaling $6.4
million as we provided existing and new personnel with the computer hardware and
software environment necessary to perform their job functions. We expect a
similar level of equipment investment in 2000, assuming continued growth in our
number of employees.

     Our financing activities provided $79.7 million of cash in 1999, which
consisted of net proceeds of $77.4 million from our March 1999 secondary stock
offering, and $3.9 million from the exercise of stock options by our employees.

     At December 31, 1999, we had $126.8 million of cash and cash equivalents
and marketable securities, consisting primarily of United States government
agency securities, money market accounts and commercial paper carrying the
highest investment grade rating. We believe that such cash and cash equivalents
and marketable securities will be sufficient to meet our working capital needs
and capital expenditures for the foreseeable future. We expect to evaluate
possible acquisition and investment opportunities in businesses, products or
technologies that are complementary to ours. Although we have not identified any
specific businesses, products or technologies that we intend to acquire or
invest in, nor are there any current agreements with respect to any such
transactions, from time to time we expect to evaluate such opportunities. In the
event we determine to pursue such opportunities, we may use our available cash
and cash equivalents. Pending such uses, we will continue to invest our
available cash in investment grade, interest-bearing investments.

     Additionally, we have restricted marketable securities of $12.5 million
securing a $10 million letter of credit issued in connection with our commitment
to a long-term lease of our future Atlanta corporate operations.

RISK FACTORS

     Forward-looking statements are inherently uncertain; as they are based on
various expectations and assumptions concerning future events and are subject to
known and unknown risks and uncertainties. Our forward-looking statements should
be considered in light of the following important risk factors. Variations from
our stated intentions or failure to achieve objectives could cause actual
results to differ from those projected in our forward-looking statements. We
undertake no obligation to update publicly any forward-looking statements for
any reason, even if new information becomes available or other events occur in
the future.

  We Have Only Recently Achieved Profitability

     We began operations in 1994 and have only achieved profitability in 1999.
We operate in a new and rapidly evolving market and must, among other things:

     - respond to competitive developments;

     - continue to upgrade and expand our product and services offerings; and

     - continue to attract, retain and motivate our employees.

     We cannot be certain that we will successfully address these risks. As a
result, we cannot assure our investors that we will be able to continue to
operate profitably in the future.

                                       26
<PAGE>   28

  Our Future Operating Results Will Likely Fluctuate Significantly

     As a result of our limited operating history, we cannot predict our future
revenues and operating results. However, we do expect our future revenues and
operating results to fluctuate due to a combination of factors, including:

     - the growth in the acceptance of, and activity on, the Internet and the
       World Wide Web, particularly by corporate, institutional and government
       users;

     - the extent to which the public perceives that unauthorized access to and
       use of online information are threats to network security;

     - the volume and timing of orders, including seasonal trends in customer
       purchasing;

     - our ability to develop new and enhanced products, managed services
       offerings and expand our professional services;

     - foreign currency exchange rates that affect our international operations;

     - product and price competition in our markets; and

     - general economic conditions, both domestically and in our foreign
       markets.

     We increasingly focus our efforts on sales of enterprise-wide security
solutions, which consist of our entire security management software platform and
related professional services, rather than on the sale of component products. As
a result, we expect that each sale may require additional time and effort from
our sales staff. In addition, the revenues associated with particular sales vary
significantly depending on the number of products licensed by a customer, the
number of devices used by the customer and the customer's relative need for our
professional services. Large individual sales, or even small delays in customer
orders, can cause significant variation in our license revenues and results of
operations for a particular period. The timing of large orders is usually
difficult to predict and, like many software companies, many of our customers
typically license most of our products in the last month of a quarter.

     We cannot predict our operating expenses based on our past results.
Instead, we establish our spending levels based in large part on our expected
future revenues. As a result, if our actual revenues in any future period fall
below our expectations, our operating results likely will be adversely affected
because very few of our expenses vary with our revenues. Because of the factors
listed above, we believe that our quarterly and annual revenues, expenses and
operating results likely will vary significantly in the future.

  We Face Intense Competition in Our Market

     The market for network security monitoring, detection and response
solutions is intensely competitive, and we expect competition to increase in the
future. We cannot guarantee that we will compete successfully against our
current or potential competitors, especially those with significantly greater
financial resources or brand name recognition. Our chief competitors generally
fall within one of four categories:

     - internal information technology departments of our customers and the
       consulting firms that assist them in formulating security systems;

     - relatively smaller software companies offering relatively limited
       applications for network and Internet security;

     - large companies, including Axent Technologies and Network Associates,
       that sell competitive products and offerings, as well as other large
       software companies that have the technical capability and resources to
       develop competitive products; and

     - software or hardware companies that could integrate features that are
       similar to our products into their own products.

     Mergers or consolidations among these competitors, or acquisitions of small
competitors by larger companies, would make such combined entities more
formidable competitors to us. Large companies may

                                       27
<PAGE>   29

have advantages over us because of their longer operating histories, greater
name recognition, larger customer bases or greater financial, technical and
marketing resources. As a result, they may be able to adapt more quickly to new
or emerging technologies and changes in customer requirements. They can also
devote greater resources to the promotion and sale of their products than we
can. In addition, these companies have reduced and could continue to reduce, the
price of their security monitoring, detection and response products and managed
security services, which increases pricing pressures within our market.

     Several companies currently sell software products (such as encryption,
firewall, operating system security and virus detection software) that our
customers and potential customers have broadly adopted. Some of these companies
sell products that perform the same functions as some of our products. In
addition, the vendors of operating system software or networking hardware may
enhance their products to include the same kinds of functions that our products
currently provide. The widespread inclusion of comparable features to our
software in operating system software or networking hardware could render our
products obsolete, particularly if such features are of a high quality. Even if
security functions integrated into operating system software or networking
hardware are more limited than those of our software, a significant number of
customers may accept more limited functionality to avoid purchasing additional
software.

     For the above reasons, we may not be able to compete successfully against
our current and future competitors. Increased competition may result in price
reductions, reduced gross margins and loss of market share.

     We Face Rapid Technological Change in Our Industry and Frequent
Introductions of New Products

     Rapid changes in technology pose significant risks to us. We do not control
nor can we influence the forces behind these changes, which include:

     - the extent to which businesses and others seek to establish more secure
       networks;

     - the extent to which hackers and others seek to compromise secure systems;

     - evolving computer hardware and software standards;

     - changing customer requirements; and

     - frequent introductions of new products and product enhancements.

     To remain successful, we must continue to change, adapt and improve our
solutions in response to these and other changes in technology. Our future
success hinges on our ability to both continue to enhance our current line of
products and professional services and to introduce new products and services
that address and respond to innovations in computer hacking, computer technology
and customer requirements. We cannot be sure that we will successfully develop
and market new products that do this. Any failure by us to timely develop and
introduce new products, to enhance our current products or to expand our
professional services capabilities in response to these changes could adversely
affect our business, operating results and financial condition.

     Our products involve very complex technology, and as a consequence, major
new products and product enhancements require a long time to develop and test
before going to market. Because this amount of time is difficult to estimate, we
have had to delay the scheduled introduction of new and enhanced products in the
past and may have to delay the introduction of new products and product
enhancements in the future.

     The techniques computer hackers use to gain unauthorized access to, or to
sabotage, networks and intranets are constantly evolving and increasingly
sophisticated. Furthermore, because new hacking techniques are usually not
recognized until used against one or more targets, we are unable to anticipate
most new hacking techniques. To the extent that new hacking techniques harm our
customers' computer systems or businesses, affected customers may believe that
our products are ineffective, which may cause them or prospective customers to
reduce or avoid purchases of our products.

                                       28
<PAGE>   30

  Risks Associated with Our Global Operations

     The expansion of our international operations includes our presence in
dispersed locations throughout the world, including throughout Europe and the
Asia/Pacific and Latin America regions. Our international presence and expansion
exposes us to risks not present in our U.S. operations, such as:

     - the difficulty in managing an organization spread over various countries
       located across the world;

     - unexpected changes in regulatory requirements in countries where we do
       business;

     - excess taxation due to overlapping tax structures;

     - fluctuations in foreign currency exchange rates; and

     - export license requirements and restrictions on the export of certain
       technology, especially encryption technology and trade restrictions.

     Despite these risks, we believe that we must continue to expand our
operations in international markets to support our growth. To this end, we
intend to establish additional foreign sales operations, expand our existing
offices, hire additional personnel, expand our international sales channels and
customize our products for local markets. If we fail to execute this strategy,
our international sales growth will be limited.

  We Must Successfully Integrate Acquisitions

     We acquired Netrex, Inc. and NJH Security Consulting in 1999. As part of
our growth strategy, we may continue to acquire or make investments in companies
with products, technologies or professional services capabilities complementary
to our solutions. In our recent acquisitions as well as in future acquisitions,
we could encounter difficulties in assimilating new personnel and operations
into our company. These difficulties may disrupt our ongoing business, distract
our management and employees, increase our expenses and adversely affect our
results of operations. These difficulties could also include accounting
requirements, such as amortization of goodwill or in-process research and
development expense. We cannot be certain that we will successfully overcome
these risks with respect to any of our recent or future acquisitions or that we
will not encounter other problems in connection with our recent or any future
acquisitions. In addition, any future acquisitions may require us to incur debt
or issue equity securities. The issuance of equity securities could dilute the
investment of our existing stockholders.

  We Depend on Our Intellectual Property Rights and Use Licensed Technology

     We rely primarily on copyright and trademark laws, trade secrets,
confidentiality procedures and contractual provisions to protect our proprietary
rights. We have obtained one United States patent and have a patent application
under review. We also believe that the technological and creative skills of our
personnel, new product developments, frequent product enhancements, our name
recognition, our professional services capabilities and delivery of reliable
product maintenance are essential to establishing and maintaining our technology
leadership position. We cannot assure you that our competitors will not
independently develop technologies that are similar to ours.

     Despite our efforts to protect our proprietary rights, unauthorized parties
may attempt to copy aspects of our products or to obtain and use information
that we regard as proprietary. Policing unauthorized use of our products is
difficult. While we cannot determine the extent to which piracy of our software
products occurs, we expect software piracy to be a persistent problem. In
addition, the laws of some foreign countries do not protect our proprietary
rights to as great an extent as do the laws of the United States and many
foreign countries do not enforce these laws as diligently as U.S. government
agencies and private parties.

ITEM 7A.  QUANTITATIVE AND QUALITATIVE DISCLOSURES ABOUT MARKET RISK

     We have not entered into any transactions using derivative financial
instruments or derivative commodity instruments and believe that our exposure to
market risk associated with other financial instruments (such as investments)
are not material.

                                       29
<PAGE>   31

ITEM 8.  CONSOLIDATED FINANCIAL STATEMENTS AND SUPPLEMENTARY DATA

     See the index to Consolidated Financial Statements at Item 14

ITEM 9.  CHANGES IN AND DISAGREEMENTS WITH ACCOUNTANTS ON ACCOUNTING AND
FINANCIAL DISCLOSURE

     None.

                                       30
<PAGE>   32

                                    PART III

     Certain information required by Part III is omitted from this Form 10-K
because the Company will file a definitive Proxy Statement pursuant to
Regulation 14A not later than 120 days after the end of the fiscal year covered
by this Form 10-K, and certain information to be included therein is
incorporated herein by reference.

ITEM 10.  DIRECTORS AND EXECUTIVE OFFICERS OF THE REGISTRANT

     The information required by this Item is incorporated by reference to the
Proxy Statement under the sections captioned "Proposal 1 -- Election of
Directors," "Executive Compensation -- Directors and Executive Officers" and
"Compliance with Section 16(a) of the Securities Exchange Act of 1934."

ITEM 11.  EXECUTIVE COMPENSATION

     The information required by this Item is incorporated by reference to the
Proxy Statement under the section captioned "Executive Compensation."

ITEM 12.  SECURITY OWNERSHIP OF CERTAIN BENEFICIAL OWNERS AND MANAGEMENT

     The information required by this Item is incorporated by reference to the
Proxy Statement under the section captioned "Principal Stockholders."

ITEM 13.  CERTAIN RELATIONSHIPS AND RELATED TRANSACTIONS

     The information required by this Item is incorporated by reference to the
Proxy Statement under the section captioned "Executive Compensation -- Certain
Transactions with Management."

                                       31
<PAGE>   33

                                    PART IV

ITEM 14.  EXHIBITS, FINANCIAL STATEMENT SCHEDULES AND REPORTS ON FORM 8-K

     (a) The following documents are filed as part of this Form 10-K:

          1. Consolidated Financial Statements.  The following consolidated
     financial statements of ISS Group, Inc. are filed as part of this Form 10-K
     on the pages indicated:

<TABLE>
<CAPTION>
                                                              PAGE
                                                              ----
<S>                                                           <C>
ISS GROUP, INC.
Report of Independent Auditors..............................   34
Consolidated Balance Sheets as of December 31, 1998 and
  1999......................................................   35
Consolidated Statements of Operations for the Years Ended
  December 31, 1997, 1998 and 1999..........................   36
Consolidated Statements of Stockholders' Equity (Deficit)
  for the Years Ended December 31, 1997, 1998 and 1999......   37
Consolidated Statements of Cash Flows for the Years Ended
  December 31, 1997, 1998 and 1999..........................   38
Notes to Consolidated Financial Statements..................   39
2. Consolidated Financial Statement Schedules:
Schedule II -- Valuation and Qualifying Accounts............   52
</TABLE>

          Schedules other than the one listed above are omitted as the required
     information is inapplicable or the information is presented in the
     consolidated financial statements or related notes.

          3. Exhibits.  The exhibits to this Annual Report on Form 10-K have
     been included only with the copy of this Annual Report on Form 10-K filed
     with the Securities and Exchange Commission. Copies of individual exhibits
     will be furnished to stockholders upon written request to the Company and
     payment of a reasonable fee.

<TABLE>
<CAPTION>
EXHIBIT
NUMBER                            DESCRIPTION OF EXHIBIT
- -------                           ----------------------
<C>       <C>  <S>
 2.1*     --   Stock Purchase Agreement dated October 6, 1998, by and among
               the Company, March Information Systems and its shareholders
               (filed as Exhibit 2.1 to the Company's Current Report on
               Form 8-K dated October 20, 1998).
 3.1*     --   Certificate of Incorporation (filed as Exhibit 3.1 to the
               Company's Registration Statement on Form S-1, Registration
               No. 333-44529 (the "Form S-1").
 3.2*     --   Bylaws (filed as Exhibit 3.2 to the Form S-1).
 4.1*     --   Specimen Common Stock certificate (filed as Exhibit 4.1 to
               the Form S-1).
 4.2      --   See Exhibits 3.1 and 3.2 for provisions of the Certificate
               of Incorporation and Bylaws of the Company defining the
               rights of holders of the Company's Common Stock.
10.1*     --   Restated 1995 Stock Incentive Plan (filed as Exhibit 10.1 to
               the Form S-1).
10.2*     --   Internet Security Systems, Inc. Amended and Restated Rights
               Agreement (filed as Exhibit 10.3 to the Form S-1).
10.3*     --   Stock Exchange Agreement dated December 9, 1997 (filed as
               Exhibit 10.4 to the Form S-1).
10.4*     --   Amended and Restated Agreement Regarding Acceleration of
               Vesting of Future Optionees (filed as Exhibit 10.5 to the
               Form S-1).
10.5*     --   Forms of Non-Employee Director Compensation Agreement,
               Notice of Stock Options Grants and Stock Option Agreement
               (filed as Exhibit 10.6 to the Form S-1).
10.6*     --   Sublease for Atlanta facilities (filed as Exhibit 10.7 to
               the Form S-1).
</TABLE>

                                       32
<PAGE>   34

<TABLE>
<CAPTION>
EXHIBIT
NUMBER                            DESCRIPTION OF EXHIBIT
- -------                           ----------------------
<C>       <C>  <S>
10.7*     --   Form of Indemnification Agreement for directors and certain
               officers (filed as Exhibit 10.8 to the Form S-1).
10.8*     --   Series B Preferred Stock Purchase Agreement (filed as
               Exhibit 10.9 to the Form S-1).
10.9*     --   Sublease for additional Atlanta facilities (filed as Exhibit
               10.9 to the Company's Registration Statement on Form S-1,
               Registration No. 333-71471).
10.10     --   Lease for Atlanta headquarters and research and development
               facility
10.11     --   Restated 1995 Stock Incentive Plan (Amended and Restated
               through January 18, 1999).
21.1      --   Subsidiaries of the Company.
23.1      --   Consent of Ernst & Young LLP.
23.2      --   Consent of PricewaterhouseCoopers LLP
23.3      --   Report of PricewaterhouseCoopers LLP
24.1      --   Power of Attorney, pursuant to which amendments to this
               Annual Report on Form 10-K may be filed, is included on the
               signature page contained in Part IV of the Form 10-K.
27.1      --   Restated Financial Data Schedule (for SEC use only)
</TABLE>

- ---------------

* Incorporated herein by reference to the indicated filing.

     (b) Reports on Form 8-K

     No Reports on Form 8-K were filed in the last quarter of the period covered
by this report.

                                       33
<PAGE>   35

                         REPORT OF INDEPENDENT AUDITORS

Board of Directors
ISS Group, Inc.

     We have audited the accompanying consolidated balance sheets of ISS Group,
Inc. as of December 31, 1999 and 1998, and the related consolidated statements
of operations, stockholders' equity (deficit), and cash flows for each of the
three years in the period ended December 31, 1999. Our audit also included the
financial statement schedule listed in the Index at Item 14(a). These financial
statements and schedule are the responsibility of the Company's management. Our
responsibility is to express an opinion on these financial statements and
schedule based on our audits. We did not audit the 1998 financial statements or
schedule of Netrex, Inc., a wholly owned subsidiary, which statements reflect
total assets constituting 8% and total revenues constituting 37% of the related
consolidated totals. Those statements and schedule were audited by other
auditors whose report has been furnished to us, and our opinion, insofar as it
relates to the 1998 data included for Netrex, Inc., is based solely on the
report of the other auditors.

     We conducted our audits in accordance with auditing standards generally
accepted in the United States. Those standards require that we plan and perform
the audit to obtain reasonable assurance about whether the financial statements
are free of material misstatement. An audit includes examining, on a test basis,
evidence supporting the amounts and disclosures in the financial statements. An
audit also includes assessing the accounting principles used and significant
estimates made by management, as well as evaluating the overall financial
statement presentation. We believe that our audits and the report of other
auditors provide a reasonable basis for our opinion.

     In our opinion, based on our audits and, for 1998, the report of other
auditors, the financial statements referred to above present fairly, in all
material respects, the consolidated financial position of ISS Group, Inc. at
December 31, 1999 and 1998, and the consolidated results of its operations and
its cash flows for each of the three years in the period ended December 31,
1999, in conformity with accounting principles generally accepted in the United
States. Also, in our opinion, based on our audits and the report of the other
auditors, the related financial statement schedule, when considered in relation
to the basic financial statements taken as a whole, presents fairly in all
material respects the information set forth therein.

                                          /s/ Ernst & Young LLP

Atlanta, GA
January 21, 2000

                                       34
<PAGE>   36

                                ISS GROUP, INC.

                          CONSOLIDATED BALANCE SHEETS

<TABLE>
<CAPTION>
                                                                     DECEMBER 31,
                                                              --------------------------
                                                                 1998           1999
                                                              -----------   ------------
<S>                                                           <C>           <C>
                                         ASSETS
Current assets:
  Cash and cash equivalents.................................  $53,056,000   $ 70,090,000
  Marketable securities.....................................           --     56,693,000
  Accounts receivable, less allowance for doubtful accounts
     of $412,000 and $848,000, respectively.................   16,590,000     26,934,000
  Inventory.................................................       48,000        473,000
  Prepaid expenses and other current assets.................      806,000      2,122,000
                                                              -----------   ------------
          Total current assets..............................   70,500,000    156,312,000
Property and equipment:
  Computer equipment........................................    5,706,000     10,108,000
  Office furniture and equipment............................    3,139,000      5,232,000
  Leasehold improvements....................................      565,000        870,000
                                                              -----------   ------------
                                                                9,410,000     16,210,000
  Less accumulated depreciation.............................    3,265,000      7,277,000
                                                              -----------   ------------
                                                                6,145,000      8,933,000
Restricted marketable securities............................           --     12,500,000
Goodwill, less accumulated amortization of $77,000 and
  $396,000, respectively....................................    3,094,000      2,775,000
Other intangible assets, less accumulated amortization of
  $154,000 and $827,000, respectively.......................    4,692,000      4,019,000
Other assets................................................      293,000        306,000
                                                              -----------   ------------
          Total assets......................................  $84,724,000   $184,845,000
                                                              ===========   ============
</TABLE>

<TABLE>
<CAPTION>

<S>                                                           <C>           <C>
                          LIABILITIES AND STOCKHOLDERS' EQUITY
Current liabilities:
  Accounts payable..........................................  $ 3,149,000   $  5,144,000
  Accrued expenses..........................................    4,941,000      6,298,000
  Deferred revenues.........................................    8,333,000     17,155,000
  Current portion of long-term debt and capital lease
     obligations............................................      470,000        580,000
  Other current liabilities.................................      450,000             --
                                                              -----------   ------------
          Total current liabilities.........................   17,343,000     29,177,000
Long-term debt, including capital lease obligations.........      742,000        435,000
Other non-current liabilities...............................      134,000         80,000

Commitments and contingencies

Stockholders' equity:
  Preferred stock; $.001 par value; 20,000,000 shares
     authorized, none issued or outstanding.................           --             --
  Common stock, $.001 par value, 120,000,000 shares
     authorized, 37,169,000 and 40,980,000 shares issued and
     outstanding, respectively..............................       37,000         41,000
  Additional paid-in capital................................   76,152,000    157,467,000
  Deferred compensation.....................................     (662,000)      (288,000)
  Accumulated other comprehensive income....................      142,000        100,000
  Accumulated deficit.......................................   (9,164,000)    (2,167,000)
                                                              -----------   ------------
          Total stockholders' equity........................   66,505,000    155,153,000
                                                              -----------   ------------
          Total liabilities and stockholders' equity........  $84,724,000   $184,845,000
                                                              ===========   ============
</TABLE>

                            See accompanying notes.

                                       35
<PAGE>   37

                                ISS GROUP, INC.

                     CONSOLIDATED STATEMENTS OF OPERATIONS

<TABLE>
<CAPTION>
                                                                  YEAR ENDED DECEMBER 31,
                                                          ---------------------------------------
                                                             1997          1998          1999
                                                          -----------   -----------   -----------
<S>                                                       <C>           <C>           <C>
Revenues:
  Product licenses and sales............................  $16,074,000   $36,908,000   $74,050,000
  Subscriptions.........................................    4,488,000    12,037,000    24,141,000
  Professional services.................................    4,863,000     8,143,000    18,296,000
                                                          -----------   -----------   -----------
                                                           25,425,000    57,088,000   116,487,000
Costs and expenses:
  Cost of revenues:
     Product licenses and sales.........................    4,673,000     8,875,000    18,842,000
     Subscriptions and services.........................    2,602,000    11,076,000    18,858,000
                                                          -----------   -----------   -----------
          Total cost of revenues........................    7,275,000    19,951,000    37,700,000
  Research and development..............................    3,855,000     9,655,000    20,412,000
  Sales and marketing...................................   14,096,000    25,998,000    43,124,000
  General and administrative............................    3,668,000     6,557,000     9,230,000
  Amortization..........................................           --       230,000       992,000
  Charge for in-process research and development........           --       802,000            --
  Merger costs..........................................           --            --     2,329,000
                                                          -----------   -----------   -----------
                                                           28,894,000    63,193,000   113,787,000
                                                          -----------   -----------   -----------
Operating income (loss).................................   (3,469,000)   (6,105,000)    2,700,000
Interest income, net....................................      163,000     2,274,000     5,902,000
Exchange loss...........................................           --            --      (136,000)
                                                          -----------   -----------   -----------
Income (loss) before income taxes.......................   (3,306,000)   (3,831,000)    8,466,000
Provision for income taxes..............................           --        62,000       976,000
                                                          -----------   -----------   -----------
Net income (loss).......................................  $(3,306,000)  $(3,893,000)  $ 7,490,000
                                                          ===========   ===========   ===========
Basic net income (loss) per share of Common Stock.......  $     (0.18)  $     (0.12)  $      0.19
                                                          ===========   ===========   ===========
Diluted net income (loss) per share of Common Stock.....  $     (0.18)  $     (0.12)  $      0.17
                                                          ===========   ===========   ===========
Weighted average shares:
Basic...................................................   18,399,000    32,351,000    39,996,000
                                                          ===========   ===========   ===========
Diluted.................................................   18,399,000    32,351,000    43,691,000
                                                          ===========   ===========   ===========
Unaudited pro forma net loss per share of Common
  Stock.................................................  $     (0.11)  $     (0.11)
                                                          ===========   ===========
Unaudited weighted average number of shares used in
  calculating unaudited pro forma net loss per share of
  Common Stock..........................................   29,873,000    34,963,000
                                                          ===========   ===========
</TABLE>

                            See accompanying notes.

                                       36
<PAGE>   38

                                ISS GROUP, INC.

           CONSOLIDATED STATEMENTS OF STOCKHOLDERS' EQUITY (DEFICIT)
<TABLE>
<CAPTION>
                                                                                           ACCUMULATED      RETAINED
                                         COMMON STOCK        ADDITIONAL                       OTHER         EARNINGS
                                     --------------------     PAID-IN        DEFERRED     COMPREHENSIVE   (ACCUMULATED
                                       SHARES     AMOUNT      CAPITAL      COMPENSATION      INCOME         DEFICIT)
                                     ----------   -------   ------------   ------------   -------------   ------------
<S>                                  <C>          <C>       <C>            <C>            <C>             <C>
Balance at December 31, 1996.......  18,248,000   $18,000   $    168,000    $      --       $     --      $(1,311,000)
  Comprehensive income:
    Net loss.......................          --       --              --           --             --       (3,306,000)
  Accretion related to Redeemable,
    Convertible Preferred Stock....          --       --         (11,000)          --             --               --
  Deferred compensation related to
    stock options..................          --       --         571,000     (571,000)            --               --
  Issuance of Common Stock.........      38,000       --          32,000           --             --               --
                                     ----------   -------   ------------    ---------       --------      -----------
Balance at December 31, 1997.......  18,286,000   18,000         760,000     (571,000)            --       (4,617,000)
  Comprehensive income:
    Net loss.......................          --       --              --           --             --       (3,893,000)
    Translation adjustment.........          --       --              --           --        142,000               --
  Issuance of Common Stock:
    Initial public offering........   6,140,000    6,000      61,525,000
    Conversion of Redeemable,
      Convertible Preferred Stock
      in connection with the
      initial public offering......  11,474,000   12,000       8,866,000
    Exercise of stock options......     810,000    1,000         292,000           --             --               --
    Acquisitions...................     316,000       --       3,901,000           --             --               --
    Issuance to consultant.........       2,000       --          11,000           --             --               --
  Subchapter S distributions of a
    pooled entity..................          --       --              --           --             --         (216,000)
  Buyout of former Subchapter S
    shareholder....................          --       --         (14,000)          --             --         (438,000)
  Deferred compensation related to
    stock options..................          --       --         811,000     (811,000)            --               --
  Amortization of deferred
    compensation...................          --       --              --      720,000             --               --
                                     ----------   -------   ------------    ---------       --------      -----------
Balance at December 31, 1998.......  37,028,000   37,000      76,152,000     (662,000)       142,000       (9,164,000)
  Comprehensive income:
    Net income.....................          --       --              --           --             --        7,490,000
    Translation adjustment.........          --       --              --           --        (42,000)              --
  Issuance of Common Stock:
    Secondary public offering......   2,778,000    3,000      77,361,000           --             --               --
    Exercise of stock options......   1,033,000    1,000       3,948,000           --             --               --
    Pooling-of-interests...........     141,000       --           6,000           --             --          164,000
  Subchapter S distributions of a
    pooled entity..................          --       --              --           --             --         (657,000)
  Amortization of deferred
    compensation...................          --       --              --      374,000             --               --
                                     ----------   -------   ------------    ---------       --------      -----------
Balance at December 31, 1999.......  40,980,000   $41,000   $157,467,000    $(288,000)      $100,000      $(2,167,000)
                                     ==========   =======   ============    =========       ========      ===========

<CAPTION>

                                                         TOTAL
                                     COMPREHENSIVE   STOCKHOLDERS'
                                        INCOME          EQUITY
                                     -------------   -------------
<S>                                  <C>             <C>
Balance at December 31, 1996.......   $        --    $ (1,125,000)
  Comprehensive income:
    Net loss.......................   $(3,306,000)     (3,306,000)
                                      ===========
  Accretion related to Redeemable,
    Convertible Preferred Stock....            --         (11,000)
  Deferred compensation related to
    stock options..................            --              --
  Issuance of Common Stock.........            --          32,000
                                                     ------------
Balance at December 31, 1997.......                    (4,410,000)
  Comprehensive income:
    Net loss.......................    (3,893,000)     (3,893,000)
    Translation adjustment.........       142,000         142,000
                                      -----------
                                      $(3,751,000)
                                      ===========
  Issuance of Common Stock:
    Initial public offering........                    61,531,000
    Conversion of Redeemable,
      Convertible Preferred Stock
      in connection with the
      initial public offering......                     8,878,000
    Exercise of stock options......            --         293,000
    Acquisitions...................            --       3,901,000
    Issuance to consultant.........            --          11,000
  Subchapter S distributions of a
    pooled entity..................            --        (216,000)
  Buyout of former Subchapter S
    shareholder....................            --        (452,000)
  Deferred compensation related to
    stock options..................            --              --
  Amortization of deferred
    compensation...................            --         720,000
                                                     ------------
Balance at December 31, 1998.......            --      66,505,000
  Comprehensive income:
    Net income.....................     7,490,000       7,490,000
    Translation adjustment.........       (42,000)        (42,000)
                                      -----------
                                      $ 7,448,000
                                      ===========
  Issuance of Common Stock:
    Secondary public offering......            --      77,364,000
    Exercise of stock options......            --       3,949,000
    Pooling-of-interests...........            --         170,000
  Subchapter S distributions of a
    pooled entity..................            --        (657,000)
  Amortization of deferred
    compensation...................            --         374,000
                                                     ------------
Balance at December 31, 1999.......                  $155,153,000
                                                     ============
</TABLE>

                            See accompanying notes.

                                       37
<PAGE>   39

                                ISS GROUP, INC.

                      CONSOLIDATED STATEMENTS OF CASH FLOWS

<TABLE>
<CAPTION>
                                                                 YEAR ENDED DECEMBER 31,
                                                         ----------------------------------------
                                                            1997          1998           1999
                                                         -----------   -----------   ------------
<S>                                                      <C>           <C>           <C>
OPERATING ACTIVITIES
Net income (loss)......................................  $(3,306,000)  $(3,893,000)  $  7,490,000
Adjustments to reconcile net income (loss) to net cash
(used in) provided by operating activities:
  Depreciation.........................................      796,000     2,162,000      3,989,000
  Amortization of goodwill and intangibles.............           --       230,000        992,000
  Accretion of discount on marketable securities.......           --            --     (1,176,000)
  Charge for in-process research and development.......           --       802,000             --
  Deferred compensation expense........................           --       720,000        374,000
  Other non-cash expense...............................       46,000       118,000        (47,000)
  Changes in assets and liabilities, excluding the
     effects
     of acquisitions:
       Accounts receivable.............................   (2,801,000)  (10,590,000)   (10,241,000)
       Inventory.......................................      (28,000)      106,000       (425,000)
       Prepaid expenses and other assets...............     (213,000)     (541,000)    (1,312,000)
       Accounts payable and accrued expenses...........    3,767,000     2,679,000      3,303,000
       Deferred revenues...............................    1,727,000     5,299,000      8,822,000
                                                         -----------   -----------   ------------
          Net cash (used in) provided by operating
            activities.................................      (12,000)   (2,908,000)    11,769,000
                                                         -----------   -----------   ------------
INVESTING ACTIVITIES
Acquisitions, net of cash received.....................           --    (5,206,000)            --
Purchases of marketable securities.....................           --            --    (55,517,000)
Purchase of restricted marketable securities...........           --            --    (12,500,000)
Purchases of property and equipment....................   (3,317,000)   (4,166,000)    (6,356,000)
                                                         -----------   -----------   ------------
          Net cash used in investing activities........   (3,317,000)   (9,372,000)   (74,373,000)
                                                         -----------   -----------   ------------
FINANCING ACTIVITIES
Net proceeds from (payments on) long-term debt.........      425,000       161,000       (250,000)
Net borrowings (payments) under line of credit.........      320,000      (320,000)            --
Net proceeds from Redeemable, Convertible Preferred
  Stock issuances......................................    5,253,000            --             --
Payments on long term debt and capital leases..........     (145,000)     (326,000)      (276,000)
Capital transactions of merged entity..................     (402,000)     (318,000)    (1,107,000)
Proceeds from exercise of stock options................           --       292,000      3,949,000
Net proceeds from public offerings.....................           --    61,531,000     77,364,000
Other Common Stock activities..........................        1,000            --             --
                                                         -----------   -----------   ------------
          Net cash provided by financing activities....    5,452,000    61,020,000     79,680,000
                                                         -----------   -----------   ------------
Foreign currency impact on cash........................           --       142,000        (42,000)
                                                         -----------   -----------   ------------
Net increase in cash and cash equivalents..............    2,123,000    48,882,000     17,034,000
Cash and cash equivalents at beginning of year.........    2,051,000     4,174,000     53,056,000
                                                         -----------   -----------   ------------
Cash and cash equivalents at end of year...............  $ 4,174,000   $53,056,000   $ 70,090,000
                                                         ===========   ===========   ============
SUPPLEMENTAL CASH FLOW DISCLOSURE
Interest paid..........................................  $    82,000   $   134,000   $     33,000
                                                         ===========   ===========   ============
Capital lease obligations incurred during the period...           --   $   468,000   $    329,000
                                                         ===========   ===========   ============
Income taxes paid......................................           --            --   $     47,000
                                                         ===========   ===========   ============
</TABLE>

                                       38
<PAGE>   40

                                ISS GROUP, INC.

                   NOTES TO CONSOLIDATED FINANCIAL STATEMENTS
                               DECEMBER 31, 1999

1. SIGNIFICANT ACCOUNTING POLICIES

DESCRIPTION OF BUSINESS

     ISS's business is focused on maintaining the latest security threat and
vulnerability checks within existing products and creating new products and
services that are consistent with ISS's goal of providing security management
solutions. This approach entails continuous security risk monitoring and
response to develop an active and informed network security policy.

     ISS Group, Inc. was incorporated in the State of Delaware on December 8,
1997 to be a holding company for Internet Security Systems, Inc., a Georgia
company incorporated in 1994 to design, market, and sell computer network
security assessment software. In addition, ISS has various other subsidiaries in
the United States, Europe and the Asia/Pacific regions with primary marketing
and sales responsibilities for ISS's products and services in their respective
markets. ISS is organized as, and operates in, a single business segment that
provides products, technical support, managed security services, and consulting
and training services as components of providing security management solutions.

     On March 27, 1998 ISS completed an initial public offering ("IPO") of its
Common Stock. A total of 6,900,000 shares were sold at $11 per share. ISS
completed a second public offering of its Common Stock on March 2, 1999. A total
of 5,178,000 shares were sold at $29.50 per share. The net proceeds of these
offerings to ISS were approximately $138,895,000 and such proceeds will be used
for general corporate purposes. ISS's shares are traded on the NASDAQ National
Market under the ticker symbol "ISSX".

BASIS OF CONSOLIDATION AND FOREIGN CURRENCY TRANSLATIONS

     The consolidated financial statements include the accounts of ISS Group,
Inc. and its subsidiaries ("ISS"). All significant intercompany investment
accounts and transactions have been eliminated in consolidation.

     Assets and liabilities of international operations are translated from the
local currency into U.S. dollars at the approximate rate of currency exchange at
the end of the fiscal period. Translation gains and losses of foreign operations
that use local currencies as the functional currency are included in accumulated
other comprehensive income (loss) as a component of stockholders' equity.
Revenues and expenses are translated at average exchange rates for the period.
Transaction gains and losses arising from exchange rate fluctuations on
transactions denominated in currency other than the local functional currency
are included in results of operations.

USE OF ESTIMATES

     The preparation of financial statements in conformity with generally
accepted accounting principles requires management to make estimates and
assumptions that affect the amounts reported in the financial statements and
accompanying notes. Actual results may differ from those estimates, and such
differences may be material to the consolidated financial statements.

REVENUE RECOGNITION

     ISS recognizes its perpetual license revenue upon (i) delivery of software
or, if the customer has evaluation software, delivery of the software key, and
(ii) issuance of the related license, assuming no significant vendor obligations
or customer acceptance rights exist. For perpetual license agreements, when
payment terms extend over periods greater than twelve months, revenue is
recognized as such amounts are billable. Product sales consist of software
developed by third-party partners, combined in some instances with

                                       39
<PAGE>   41
                                ISS GROUP, INC.

           NOTES TO CONSOLIDATED FINANCIAL STATEMENTS -- (CONTINUED)

1. SIGNIFICANT ACCOUNTING POLICIES -- (CONTINUED)
associated hardware appliances and partner maintenance services. These sales are
recognized upon shipment to the customer.

     Subscriptions revenue includes maintenance, term licenses and managed
services. Annual renewable maintenance is a separate component of perpetual
license agreements for which the revenue is recognized ratably over the
maintenance contract term. Term licenses allow customer use of the product and
maintenance for a specified period, generally twelve months, for which revenues
are also recognized ratably over the contract term. Managed services consist of
security monitoring services of information assets and systems and are
recognized as such services are provided. Professional services revenue,
including consulting and training, are recognized as such services are
performed.

COSTS OF REVENUES

     Costs of revenues include the costs of products and services. Cost of
products represents the cost of product sales, which are incurred upon
recognition of the associated product revenues. Cost of services includes the
cost of ISS's technical support group who provide assistance to customers with
maintenance agreements, the operations center costs of providing managed
services and the costs related to ISS's professional services.

CASH AND CASH EQUIVALENTS

     Cash equivalents include all highly liquid investments with maturity of
three months or less when purchased. Such amounts are stated at cost, which
approximates market value.

MARKETABLE SECURITIES

     ISS's investment in marketable securities consists of debt instruments of
the U.S. Treasury, U.S. government agencies and corporate commercial paper. All
such marketable securities have a maturity of less than one year. These
investments are classified as available-for-sale and reported at fair market
value. The amortized cost of securities classified as available-for-sale is
adjusted for amortization of premiums and accretion of discounts to maturity.
Such amortization is included in interest income. Unrealized gains and losses on
available-for-sale securities were immaterial for 1999. Realized gains and
losses, and declines in value judged to be other-than-temporary are included in
net securities gains (losses) and are included in our results of operations.
There were no securities sold in 1999. Interest and dividends on securities
classified as available-for-sale are included in interest income.

CONCENTRATIONS OF CREDIT RISK

     Financial instruments that potentially subject ISS to significant
concentrations of credit risk consist principally of cash and cash equivalents,
marketable securities and accounts receivable. ISS maintains cash and cash
equivalents in short-term money market accounts with two financial institutions
and short-term, investment grade commercial paper. Marketable securities consist
of United States government agency securities, money market accounts and
investment grade commercial paper. ISS's sales are primarily to companies
located in the United States, Europe, Brazil and the Asia/Pacific regions. ISS
performs periodic credit evaluations of its customer's financial condition and
does not require collateral. Accounts receivable are due principally from large
U.S. companies under stated contract terms. ISS provides for estimated credit
losses at the time of sale, which have not been significant to date.

                                       40
<PAGE>   42
                                ISS GROUP, INC.

           NOTES TO CONSOLIDATED FINANCIAL STATEMENTS -- (CONTINUED)

1. SIGNIFICANT ACCOUNTING POLICIES -- (CONTINUED)
FAIR VALUE OF FINANCIAL INSTRUMENTS

     The carrying amounts reported in the balance sheets for cash and cash
equivalents, marketable securities, accounts receivable and accounts payable
approximate their fair values. The carrying amounts reported in the balance
sheets for long-term debt approximate their fair values, as the interest rate
related to such debt is variable and commensurate with the credit worthiness of
ISS.

PROPERTY AND EQUIPMENT

     Property and equipment are stated at cost less accumulated depreciation.
Depreciation is computed using the straight-line method for financial reporting
purposes over the estimated useful lives of the assets (primarily three years).

INVENTORY

     Inventory consists of finished goods purchased for resale and is recorded
at the lower of cost or market.

GOODWILL AND INTANGIBLES

     The major classes of intangible assets, including goodwill (excess of cost
over acquired net assets), at December 31, 1998 and 1999 are as follows:

<TABLE>
<CAPTION>
                                                           LIFE      1998         1999
                                                           ----   ----------   ----------
<S>                                                        <C>    <C>          <C>
Goodwill.................................................   10    $3,171,000   $3,171,000
Less accumulated amortization............................            (77,000)    (396,000)
                                                                  ----------   ----------
                                                                  $3,094,000   $2,775,000
                                                                  ==========   ==========
Core technology..........................................    8    $3,853,000   $3,853,000
Developed technology.....................................    5       778,000      778,000
Work force...............................................    6       215,000      215,000
                                                                  ----------   ----------
                                                                   4,846,000    4,846,000
Less accumulated amortization............................           (154,000)    (827,000)
                                                                  ----------   ----------
                                                                  $4,692,000   $4,019,000
                                                                  ==========   ==========
</TABLE>

     Goodwill and other intangible assets are amortized using the straight-line
method for the period indicated. They are reviewed for impairment whenever
events indicate that their carrying amount may not be recoverable. In such
reviews, undiscounted cash flows associated with their carrying value are
compared with their carrying values to determine if a write-down to fair value
is required.

RESEARCH AND DEVELOPMENT COSTS

     Research and development costs are charged to expense as incurred. ISS has
not capitalized any such development costs under Statement of Financial
Accounting Standards ("SFAS") No. 86, Accounting for the Costs of Computer
Software to Be Sold, Leased, or Otherwise Marketed, because the costs incurred
between the attainment of technological feasibility for the related software
product through the date when the product is available for general release to
customers has been insignificant.

                                       41
<PAGE>   43
                                ISS GROUP, INC.

           NOTES TO CONSOLIDATED FINANCIAL STATEMENTS -- (CONTINUED)

1. SIGNIFICANT ACCOUNTING POLICIES -- (CONTINUED)
ADVERTISING COSTS

     ISS incurred advertising costs $619,000 in 1997, $517,000 in 1998 and
$1,312,000 in 1999, which are expensed as incurred and are included in sales and
marketing expense in the statements of operations.

STOCK BASED COMPENSATION

     SFAS No. 123, Accounting for Stock-Based Compensation establishes
accounting and reporting standards for stock-based employee compensation plans.
As permitted by SFAS 123, ISS continues to account for stock-based compensation
in accordance with APB Opinion No. 25, Accounting for Stock Issued to Employees,
and has elected the pro forma disclosure alternative of SFAS 123.

INCOME (LOSS) PER SHARE

     On April 1, 1999 the Company's Board of Directors declared a two-for-one
stock split affected in the form of a stock dividend paid on May 19, 1999 to
stockholders of record on May 5, 1999. Accordingly, all share and income (loss)
per share amounts have been retroactively restated for this 100% stock dividend.

     Basic historical net income (loss) per share (see Note 10) was computed by
dividing net income (loss) plus accretion of the Series A and Series B
Redeemable, Convertible Preferred Stock by the weighted average number of shares
outstanding of Common Stock. Diluted historical net income (loss) per share was
computed by dividing net income (loss) by the weighted average shares
outstanding, including common equivalents (when dilutive).

     Unaudited pro forma net loss per share was computed by dividing net loss by
the unaudited weighted average number of shares of Common Stock outstanding plus
the assumed conversion of the Redeemable, Convertible Preferred Stock into
11,474,000 shares of Common Stock as of the later of (i) January 1, 1997 or (ii)
the date of issuance of such preferred stock, instead of March 27, 1998 when
such shares of preferred stock automatically converted into Common Stock.

RECENTLY ISSUED ACCOUNTING STANDARDS

     In December 1999, the Securities and Exchange Commission Staff released
Staff Accounting Bulletin ("SAB") No. 101, Revenue Recognition in Financial
Statements. SAB No. 101 provides guidance on the recognition, presentation and
disclosure of revenue in financial statements and is effective immediately.
Adoption of SAB No. 101 is not expected to have a material impact on results of
operations or financial position.

2. BUSINESS COMBINATION AND ASSET ACQUISITION

     On August 31, 1999, ISS acquired Netrex, Inc., ("Netrex") a leading
provider of remote, security monitoring services of digital assets, in a
transaction that was accounted for as a pooling-of-interests. To affect the
business combination, ISS issued approximately 2,450,000 shares of ISS stock in
exchange for all of the outstanding stock of Netrex. Additionally, options
outstanding under the Netrex Stock Plan were assumed by ISS resulting in
approximately 510,000 additional ISS shares being reserved for outstanding
grants under the Netrex Stock Plan. The consolidated financial statements of
ISS, including share and per share data, have been restated for all periods
presented to include the results of Netrex with all intercompany transactions
eliminated in such restatement.

                                       42
<PAGE>   44
                                ISS GROUP, INC.

           NOTES TO CONSOLIDATED FINANCIAL STATEMENTS -- (CONTINUED)

2. BUSINESS COMBINATION AND ASSET ACQUISITION -- (CONTINUED)
     Revenues and net income (loss) of the separate companies that includes
periods preceding the Netrex merger were as follows:

<TABLE>
<CAPTION>
                                                                 YEAR ENDED DECEMBER 31,
                                                         ----------------------------------------
                                                            1997          1998           1999
                                                         -----------   -----------   ------------
<S>                                                      <C>           <C>           <C>
Total revenues:
  ISS..................................................  $13,467,000   $35,929,000   $ 74,204,000
  Netrex...............................................   11,958,000    21,159,000     42,283,000
                                                         -----------   -----------   ------------
          Total revenues, as reported..................  $25,425,000   $57,088,000   $116,487,000
                                                         ===========   ===========   ============
Net income (loss):
  ISS..................................................  $(3,919,000)  $(4,102,000)  $  7,326,000
  Netrex...............................................      613,000       209,000        164,000
                                                         -----------   -----------   ------------
  Combined.............................................  $(3,306,000)  $(3,893,000)  $  7,490,000
Business combination expenses..........................           --            --      2,329,000
Pro forma income tax expense...........................           --            --       (368,000)
                                                         -----------   -----------   ------------
Pro forma net income (loss)............................  $(3,306,000)  $(3,893,000)  $  9,451,000
                                                         ===========   ===========   ============
</TABLE>

     Pro forma net income (loss) reflects adjustments to net income (loss) to
record an estimated provision for income taxes for each period presented
assuming Netrex was a taxpaying entity and excludes merger costs.

     In September 1999, ISS acquired privately held NJH Security Consulting
("NJH"), which was based in Atlanta, Georgia. NJH is a consulting firm focused
on providing information security services to organizations worldwide. Upon
closing the acquisition in September 1999, approximately 142,000 shares of ISS
common stock with a value of approximately $3.9 million were issued in exchange
for all of the outstanding stock of NJH. The transaction is being accounted for
using the pooling-of-interests method of accounting; however, this transaction
was not material to ISS's consolidated operations and financial position and,
therefore, the operating results of ISS have not been restated for this
transaction. The operating results of ISS include the results of operations of
NJH since the date of acquisition.

     The consolidated statements of operations include merger costs of
$2,329,000 in 1999 that represent the direct out-of-pocket costs of these
business combinations. These costs are principally investment advisor, legal and
accounting fees.

     In October 1998, ISS acquired March Information Systems Limited ("March"),
a United Kingdom-based developer of Windows NT and Unix-based security
assessment technologies. Also in October 1998, ISS acquired the technology of
DbSecure, Inc., a developer of database security risk assessment solutions. ISS
issued 316,000 shares of ISS Common Stock and paid $5,206,000 in cash
consideration and direct transaction costs for these acquisitions.

     Both of these acquisitions have been accounted for as purchases and their
results have been included in the results of ISS's operations from the effective
dates of acquisition. Substantially all of the aggregate consideration of
$9,144,000 was allocated to identified intangibles, including core and developed
technologies, in-process research and development, work force and goodwill (see
Note 1).

     The valuations of core and developed technologies and in-process research
and development were based on the present value of estimated future cash flows
over the lesser of: (i) five years or (ii) the period in which the product is
expected to be integrated into an existing ISS product. The resulting values
were reviewed for reasonableness based on the time and cost spent on the effort,
the complexity of the development effort and, in the case of in-process
development projects, the stage to which it had progressed. For in-process
research and development, the valuation was reduced for the core technology
component of such product and the

                                       43
<PAGE>   45
                                ISS GROUP, INC.

           NOTES TO CONSOLIDATED FINANCIAL STATEMENTS -- (CONTINUED)

2. BUSINESS COMBINATION AND ASSET ACQUISITION -- (CONTINUED)
percentage of product development remaining at the acquisition date. The
resulting in-process research and development amount of $802,000 is reflected as
a charge in the 1998 statement of operations.

     The following table summarizes the unaudited pro forma results of
operations as if the acquisition of March was concluded on January 1, 1998 (the
effect of the DbSecure acquisition is not included as its impact was
immaterial). This pro forma information is not necessarily indicative of what
the combined operations would have been if ISS had control of such combined
businesses for the periods presented.

     The adjustments to the historical data reflect the following (i) reduction
of interest income in connection with the cash payments and (ii) amortization of
goodwill and intangibles.

<TABLE>
<CAPTION>
                                                                 1998
                                                              -----------
                                                              (UNAUDITED)
<S>                                                           <C>
Revenues....................................................  $58,894,000
Operating loss..............................................   (6,537,000)
Net loss....................................................   (4,619,000)
Per share:
  Basic and diluted net loss................................  $     (0.14)
  Pro forma net loss........................................  $     (0.13)
</TABLE>

3. MARKETABLE SECURITIES

     The following is a summary of available-for-sale marketable securities as
of December 31, 1999:

<TABLE>
<CAPTION>
                                                                           ESTIMATED FAIR
                                                                COST           VALUE
                                                             -----------   --------------
<S>                                                          <C>           <C>
Unrestricted:
  U.S. Treasury securities and obligations of U.S
     government agencies...................................  $18,907,000    $18,907,000
  U.S. corporate commercial paper..........................  $37,786,000    $37,786,000
Restricted:
  U.S. corporate commercial paper..........................  $12,500,000    $12,500,000
                                                             -----------    -----------
                                                             $69,193,000    $69,193,000
                                                             ===========    ===========
</TABLE>

     The contractual maturities of all of these investments were less than one
year as of December 31, 1999. Marketable securities of $12,500,000 are
restricted as of December 31, 1999 as collateral for a letter of credit issued
by a financial institution related to the lease on the new ISS headquarters. The
amount of restricted marketable securities and the related letter of credit will
be reduced annually over the related lease term.

4. REDEEMABLE, CONVERTIBLE PREFERRED STOCK

     All of the outstanding shares of Redeemable, Convertible Preferred Stock
were automatically converted into an aggregate of 11,474,000 shares of Common
Stock on March 27, 1998 in connection with ISS's IPO.

     Redeemable, Convertible Preferred Stock consisted of the following:

<TABLE>
<CAPTION>
                                                                               SHARES ISSUED
                                                       GROSS         NET            AND
SERIES                            DATE OF ISSUANCE    PROCEEDS     PROCEEDS     OUTSTANDING
- ------                            -----------------  ----------   ----------   -------------
<S>                               <C>                <C>          <C>          <C>
A...............................  February 2, 1996   $3,650,000   $3,607,000      7,300,000
B...............................  February 14, 1997   5,280,000    5,253,000      4,174,000
                                                     ----------   ----------    -----------
                                                     $8,930,000   $8,860,000     11,474,000
                                                     ==========   ==========    ===========
</TABLE>

                                       44
<PAGE>   46
                                ISS GROUP, INC.

           NOTES TO CONSOLIDATED FINANCIAL STATEMENTS -- (CONTINUED)

4. REDEEMABLE, CONVERTIBLE PREFERRED STOCK -- (CONTINUED)
     Accretion related to the Series A and Series B Redeemable, Convertible
Preferred Stock was recorded over the respective redemption period by charges
against additional paid-in capital with corresponding increases to the carrying
value of the Series A and Series B Redeemable, Convertible Preferred Stock. Such
increases aggregated $11,000 for the year ended December 31, 1997 and were
immaterial in 1998.

5. STOCK OPTION PLANS

     ISS's Incentive Stock Plan (the "Plan") provides for the granting of
qualified or non-qualified options to purchase shares of ISS's Common Stock.
Under the Plan, the shares reserved for future issuance increase automatically
on the first trading day of each year, beginning with 1999, by an amount equal
to 3% of the number of shares of Common Stock outstanding on the last trading
day of the preceding year.

     Certain options granted under the Plan prior to the IPO are immediately
exercisable, subject to a right of repurchase by ISS at the original exercise
price for all unvested shares. Options granted after the IPO are generally
exercisable as vesting occurs. Vesting is generally in equal annual installments
over four years, measured from the date of the grant.

     Deferred compensation was determined by comparing the exercise price of
stock options issued in December 1997 to the estimated price range for the IPO
as set forth in the initial filing on January 20, 1998 of ISS's Registration
Statement on Form S-1 and the exercise price of stock options issued in January
and February 1998 to the final estimated price range contained in ISS's March
pre-effective amendment to its Registration Statement for the IPO filed in March
1998. The amounts are being charged to operations proportionately over the
four-year vesting period of the related stock options. Amortization of deferred
compensation for the years ended December 31, 1998 and 1999 was $720,000 and
$374,000, respectively. All other options are issued at fair market value on the
date of grant.

     On December 8, 1997, the Board of Directors granted to each of the four
non-employee directors a non-qualified option to purchase up to 40,000 shares of
Common Stock outside the Plan, on the same terms as if those options had been
granted under the program of the 1995 Plan. ISS reserved 160,000 shares of
Common Stock for issuance under these options.

     A summary of ISS's stock option activity is as follows:

<TABLE>
<CAPTION>
                                           1997                    1998                    1999
                                   ---------------------   ---------------------   ---------------------
                                                WEIGHTED                WEIGHTED                WEIGHTED
                                                AVERAGE                 AVERAGE                 AVERAGE
                                     NUMBER     EXERCISE     NUMBER     EXERCISE     NUMBER     EXERCISE
                                   OF SHARES     PRICE     OF SHARES     PRICE     OF SHARES     PRICE
                                   ----------   --------   ----------   --------   ----------   --------
<S>                                <C>          <C>        <C>          <C>        <C>          <C>
Outstanding at beginning of
  year...........................   1,620,000    $0.08      3,776,000    $ 1.36     5,205,000    $ 5.35
  Granted........................   2,206,000     2.27      1,921,000     11.37     1,719,000     33.94
  Exercised......................     (14,000)    0.08       (809,000)      .36    (1,033,000)     3.81
  Canceled.......................     (36,000)    0.25       (129,000)     4.66      (884,000)    15.45
  Assumed........................          --       --        446,000      4.00        60,000      3.51
                                   ----------              ----------              ----------
Outstanding at end of year.......   3,776,000     1.36      5,205,000      5.35     5,067,000     13.58
                                   ==========              ==========              ==========
Exercisable at end of year.......   3,776,000     1.36      3,219,000      1.95     2,693,000      3.00
                                   ==========              ==========              ==========
Weighted average fair value of
  options granted during the
  year...........................  $     1.17              $    13.68              $    29.01
                                   ==========              ==========              ==========
</TABLE>

                                       45
<PAGE>   47
                                ISS GROUP, INC.

           NOTES TO CONSOLIDATED FINANCIAL STATEMENTS -- (CONTINUED)

5. STOCK OPTION PLANS -- (CONTINUED)
     The following table summarizes information about stock options outstanding
at December 31, 1999:

<TABLE>
<CAPTION>
                                                                               OPTIONS FULLY
                                               OPTIONS OUTSTANDING        VESTED AND EXERCISABLE
                                           ----------------------------   -----------------------
                                             NUMBER OF       WEIGHTED        NUMBER
                                              OPTIONS         AVERAGE     EXERCISABLE    WEIGHTED
                                           OUTSTANDING AT    REMAINING         AT        AVERAGE
                                            DECEMBER 31,    CONTRACTUAL   DECEMBER 31,   EXERCISE
RANGE OF EXERCISE PRICES                        1999           LIFE           1999        PRICE
- ------------------------                   --------------   -----------   ------------   --------
<S>                                        <C>              <C>           <C>            <C>
$0.08-0.36...............................    1,015,000         6.61         421,000       $ 0.14
$0.50-3.59...............................    1,296,000         8.10         472,000         3.25
$4.00-11.00..............................      890,000         8.21         225,000         7.37
$12.00-25.00.............................      425,000         8.79          93,000        17.52
$25.25-55.00.............................    1,441,000         9.42              --           --
</TABLE>

     ISS has reserved approximately 5,200,000 shares of ISS common stock for the
future exercise of stock options at December 31, 1999.

     Pro forma information regarding net income and net income per share is
required by SFAS 123, which also requires that the information be determined as
if ISS had accounted for its employee stock options granted subsequent to
December 31, 1994 under the fair value method prescribed by that Statement. The
fair value for options granted was estimated at the date of grant using the
Black-Scholes option-pricing model. The following weighted average assumptions
were used for 1997, 1998 and 1999, respectively: risk-free interest rates of
6.28%, 5.27% and 6.19%, respectively; no dividend yield; volatility factors of
 .60, .60 and 1.25, respectively; and an expected life of the options of 4, 5 and
5 years, respectively.

     The Black-Scholes option valuation model was developed for use in
estimating the fair value of traded options that have no vesting restrictions
and are fully transferable. In addition, option valuation models require the
input of highly subjective assumptions including the expected stock price
volatility. Because employee stock options have characteristics different from
those of traded options, and because the changes in the subjective input
assumptions can materially affect the fair value estimate, in management's
opinion, the existing models do not necessarily provide a reliable single
measure of the fair value of its employee stock options.

     For purposes of pro forma disclosures, the estimated fair value of the
option is amortized to expense over the options' vesting period. The following
pro forma information adjusts the net income (loss) and net income (loss) per
share of Common Stock for the impact of SFAS 123:

<TABLE>
<CAPTION>
                                                                  YEAR ENDED DECEMBER 31,
                                                            ------------------------------------
                                                               1997          1998         1999
                                                            -----------   -----------   --------
<S>                                                         <C>           <C>           <C>
Pro forma net income (loss)...............................  $(3,370,000)  $(6,551,000)  $743,000
                                                            ===========   ===========   ========
Pro forma net income (loss) per share.....................  $     (0.18)  $     (0.20)  $   0.02
                                                            ===========   ===========   ========
</TABLE>

6. LONG-TERM DEBT AND CAPITAL LEASE OBLIGATIONS

     ISS has an agreement with a bank providing for a revolving working capital
line of credit and a term loan facility. Under the terms of the agreement, ISS
may borrow up to $3,000,000 (subject to a borrowing formula) and $500,000,
respectively, with interest payable monthly at prime plus .5 percent. The line
of credit and the term loan facility are collateralized by certain assets of the
Company.

                                       46
<PAGE>   48
                                ISS GROUP, INC.

           NOTES TO CONSOLIDATED FINANCIAL STATEMENTS -- (CONTINUED)

6. LONG-TERM DEBT AND CAPITAL LEASE OBLIGATIONS -- (CONTINUED)
Capital lease obligations are as follows at December 31, 1998 and 1999:

<TABLE>
<CAPTION>
                                                                1998        1999
                                                              ---------   ---------
<S>                                                           <C>         <C>
Lease contracts payable in monthly installments aggregating
  $33,000 including interest at an average rate of 8.3%,
  maturing at various dates through 2004 collateralized by
  related equipment.........................................  $ 725,000   $ 762,000
Less amount representing interest...........................    (90,000)    (74,000)
                                                              ---------   ---------
                                                                635,000     688,000
Less current portion........................................   (210,000)   (327,000)
                                                              ---------   ---------
Non-current portion.........................................  $ 425,000   $ 361,000
                                                              =========   =========
</TABLE>

     The future minimum lease payment commitments are $374,000, $257,000,
$69,000, $40,000 and $22,000 in 2000, 2001, 2002, 2003 and 2004, respectively.

     The charge to income resulting from the depreciation of assets recorded
under capital leases is included in depreciation expense.

     The following is an analysis of the leased assets included in property and
equipment:

<TABLE>
<CAPTION>
                                                                1998       1999
                                                              --------   ---------
<S>                                                           <C>        <C>
Computer equipment..........................................  $388,000   $ 555,000
Furniture and fixtures......................................   364,000     364,000
Office equipment............................................   183,000     344,000
                                                              --------   ---------
                                                               935,000   1,263,000
  Less accumulated depreciation.............................   368,000     641,000
                                                              --------   ---------
Undepreciated cost..........................................  $567,000   $ 622,000
                                                              ========   =========
</TABLE>

     Long-term debt at December 31, 1998 and 1999 consists of the following:

<TABLE>
<CAPTION>
                                                                1998        1999
                                                              ---------   ---------
<S>                                                           <C>         <C>
Note payable to bank, due in monthly installments of
  $13,400, balance due November 2000, at interest rate of
  8.6%, collateralized by related equipment.................  $ 285,000   $ 144,000
Note payable to bank, due in monthly installments of
  $11,500, balance due May 2001, at interest rate of 8.29%,
  collateralized by related equipment.......................    291,000     184,000
                                                              ---------   ---------
                                                                576,000     328,000
Less current maturities.....................................   (260,000)   (254,000)
                                                              ---------   ---------
Non-current portion.........................................  $ 316,000   $  74,000
                                                              =========   =========
</TABLE>

     The non-current portion of long-term debt at December 31, 1999 matures in
2001.

7. COMMITMENTS AND CONTINGENT LIABILITIES

     ISS has non-cancelable operating leases for facilities that expire at
various dates through April 2012. In 1999 ISS entered into an eleven and
one-half year lease for a new corporate headquarters, which it expects to occupy
in various stages beginning in November 2000.

                                       47
<PAGE>   49
                                ISS GROUP, INC.

           NOTES TO CONSOLIDATED FINANCIAL STATEMENTS -- (CONTINUED)

7. COMMITMENTS AND CONTINGENT LIABILITIES -- (CONTINUED)
     Future minimum payments under non-cancelable operating leases with initial
terms of one year or more consisted of the following at December 31, 1999:

<TABLE>
<CAPTION>
                                                               OPERATING
                                                                LEASES
                                                              -----------
<S>                                                           <C>
2000........................................................  $ 4,102,000
2001........................................................    6,156,000
2002........................................................    6,195,000
2003........................................................    5,503,000
2004........................................................    5,606,000
Thereafter..................................................   44,714,000
                                                              -----------
          Total minimum lease payments......................  $72,276,000
                                                              ===========
</TABLE>

     Rent expense was approximately $749,000, $2,098,000 and $2,831,000 for the
years ended December 31, 1997, 1998, and 1999, respectively.

     On July 13, 1999 ISS and Network Associates, Inc. announced that the patent
infringement suit filed in July 1998 by Network Associates, Inc against Internet
Security Systems, Inc. (a wholly-owned subsidiary of ISS) was resolved to the
parties' mutual satisfaction. The resolution of this previously pending
litigation had no material adverse effect on the business, operating results, or
financial condition of ISS.

8. INCOME TAXES

     For financial reporting purposes, the provision for income taxes includes
the following components, all of which are current:

<TABLE>
<CAPTION>
                                                               YEAR ENDED DECEMBER 31,
                                                              -------------------------
                                                              1997    1998       1999
                                                              ----   -------   --------
<S>                                                           <C>    <C>       <C>
Federal income taxes........................................  $ --   $    --   $730,000
State income taxes..........................................    --        --    149,000
Foreign income taxes........................................    --    62,000     97,000
                                                              ----   -------   --------
          Total provision for income taxes..................  $ --   $62,000   $976,000
                                                              ====   =======   ========
</TABLE>

     A reconciliation of the provision for income taxes to the statutory federal
income tax rate is as follows:

<TABLE>
<CAPTION>
                                                                  YEAR ENDED DECEMBER 31,
                                                          ---------------------------------------
                                                             1997          1998          1999
                                                          -----------   -----------   -----------
<S>                                                       <C>           <C>           <C>
Federal income taxes at 34%, applied to pretax income
  (loss)................................................  $(1,332,000)  $(1,440,000)  $ 2,878,000
State income taxes, net of federal income tax benefit...     (157,000)     (160,000)      149,000
Alternative Minimum Tax.................................           --            --       230,000
Intangibles.............................................           --       345,000       209,000
Research and development tax credits....................     (159,000)     (384,000)     (717,000)
Merger expenses not deductible for tax purposes.........           --            --       792,000
S Corp earnings.........................................           --            --      (255,000)
Foreign operations......................................           --        62,000        97,000
Other...................................................      (26,000)       42,000            --
Change in valuation allowance...........................    1,674,000     1,597,000    (2,407,000)
                                                          -----------   -----------   -----------
                                                          $        --   $    62,000   $   976,000
                                                          ===========   ===========   ===========
</TABLE>

                                       48
<PAGE>   50
                                ISS GROUP, INC.

           NOTES TO CONSOLIDATED FINANCIAL STATEMENTS -- (CONTINUED)

8. INCOME TAXES -- (CONTINUED)
     Deferred income taxes reflect the net income tax effects of temporary
differences between the carrying amounts of assets and liabilities for financial
reporting purposes and the amounts used for income tax purposes. The net income
tax effect has been computed using a combined statutory rate of 38% for federal
and state taxes. Significant components of ISS's net deferred income taxes are
as follows:

<TABLE>
<CAPTION>
                                                                     DECEMBER 31,
                                                              --------------------------
                                                                 1998           1999
                                                              -----------   ------------
<S>                                                           <C>           <C>
Deferred income tax liability -- core technology............  $   494,000   $    419,000
                                                              -----------   ------------
Deferred income tax assets:
  Depreciation and amortization.............................       72,000        267,000
  Accrued liabilities.......................................      410,000        121,000
  Allowance for doubtful accounts...........................      109,000        165,000
  Deferred compensation.....................................      274,000        142,000
  Net operating loss carryforwards..........................    5,447,000      9,986,000
  AMT credit carryforwards..................................           --        230,000
  Foreign net operating loss carryforwards..................      298,000        647,000
  Research and development tax credit carryforwards.........      571,000      1,336,000
                                                              -----------   ------------
          Total deferred income tax assets..................    7,181,000     12,894,000
Net deferred income tax assets..............................    6,687,000     12,475,000
                                                              -----------   ------------
Less valuation allowance....................................   (6,687,000)   (12,475,000)
                                                              -----------   ------------
          Net deferred income tax assets....................  $        --   $         --
                                                              ===========   ============
</TABLE>

     For financial reporting purposes, a valuation allowance has been recognized
to reduce the net deferred income tax assets to zero. ISS has not recognized any
benefit from the future use of the deferred income tax assets because
management's evaluation of all the available evidence in assessing the
realizability of the tax benefits of such loss carryforwards indicates that the
underlying assumptions of future profitable operations contain risks that do not
provide sufficient assurance to recognize such tax benefits currently.

     The valuation allowances at December 31, 1998 and 1999 include items
resulting from both operating losses and stock option deductions. The change in
balance between December 31, 1998 and 1999 is the net result of a reduction of
the valuation allowance related to operating losses (as shown in the provision
reconciliation) and an increase in the valuation allowance related to stock
option deductions.

     The deferred income tax assets include approximately $3,212,000 and
$12,124,000 at December 31, 1998 and 1999, respectively, of assets related to
stock option deductions. While income tax expense will be recorded on any future
pre-tax profits from United States operations, these deferred income tax assets
would reduce the related income taxes payable. This reduction in income taxes
payable in future periods would be recorded as additional paid-in-capital.

     ISS has approximately $26,300,000 of net operating loss carryforwards for
federal income tax purposes that expire in varying amounts between 2011 and
2019. The net operating loss carryforwards may be subject to certain limitations
in the event of a change in ownership. ISS also has approximately $1,200,000 of
net operating loss carryforwards related to its foreign operations and
approximately $1,336,000 of research and development tax credit carryforwards
that expire between 2011 and 2019.

                                       49
<PAGE>   51
                                ISS GROUP, INC.

           NOTES TO CONSOLIDATED FINANCIAL STATEMENTS -- (CONTINUED)

9. EMPLOYEE BENEFIT PLANS

     ISS sponsors a 401(k) plan that covers substantially all employees over 21
years of age. ISS may make contributions to the plan at its discretion, but has
made no contributions to the plan through December 31, 1999.

10. INCOME (LOSS) PER SHARE

     The following table sets forth the computation of basic and diluted net
income (loss) per share:

<TABLE>
<CAPTION>
                                                                  YEAR ENDED DECEMBER 31,
                                                          ---------------------------------------
                                                             1997           1998          1999
                                                          -----------   ------------   ----------
<S>                                                       <C>           <C>            <C>
Numerator:
  Net income (loss).....................................  $(3,306,000)  $ (3,893,000)  $7,490,000
  Accretion of Series A and Series B
     Redeemable, Convertible Preferred Stock............      (11,000)            --           --
                                                          -----------   ------------   ----------
                                                          $(3,317,000)  $ (3,893,000)  $7,490,000
                                                          ===========   ============   ==========
Denominator:
  Denominator for basic net income (loss) per share --
     weighted average shares............................   18,399,000     32,351,000   39,996,000
  Effect of dilutive stock options......................           --             --    3,695,000
                                                          -----------   ------------   ----------
  Denominator for diluted net income (loss) per share --
     weighted average shares............................   18,399,000     32,351,000   43,691,000
  Redeemable, Convertible Preferred Stock...............   11,474,000      2,612,000           --
                                                          -----------   ------------   ----------
Weighted average shares for pro forma net loss per
  share.................................................   29,873,000     34,963,000           --
                                                          ===========   ============
Basic net income (loss) per share.......................  $     (0.18)  $      (0.12)  $     0.19
                                                          ===========   ============   ==========
Diluted net income (loss) per share.....................  $     (0.18)  $      (0.12)  $     0.17
                                                          ===========   ============   ==========
Pro forma net income (loss) per share...................  $     (0.11)  $      (0.11)
                                                          ===========   ============
</TABLE>

     Options aggregating 3,776,000 and 5,205,000 at December 31, 1997 and 1998,
respectively, are not included in the above calculations as they are
antidilutive.

11. EXPORT SALES

     ISS generates export sales from the United States to the Europe,
Asia/Pacific Rim and Latin America regions. Also, revenues are generated from
ISS's foreign operations in these regions. ISS is organized as, and operates in,
a single business segment. Revenues from any one country are not material. In
the aggregate, the Europe, Asia/Pacific Rim and Latin America regions
represented the following percentages of total revenues:

<TABLE>
<CAPTION>
                                                              1997    1998    1999
                                                              ----    ----    ----
<S>                                                           <C>     <C>     <C>
Europe......................................................   5%      9%      11%
Asia/Pacific Rim............................................   6       3        5
Latin America...............................................  --      --        1
</TABLE>

                                       50
<PAGE>   52
                                ISS GROUP, INC.

           NOTES TO CONSOLIDATED FINANCIAL STATEMENTS -- (CONTINUED)

12. QUARTERLY FINANCIAL RESULTS (UNAUDITED)

     Summarized quarterly results for the two years ended December 31, 1998 and
1999 are as follows (in thousands, except per share data):

<TABLE>
<CAPTION>
                                               FIRST     SECOND      THIRD     FOURTH
                                              -------    -------    -------    -------
<S>                                           <C>        <C>        <C>        <C>
1998 by quarter:
  Revenues..................................  $10,477    $11,824    $13,812    $20,975
  Operating income (loss)...................   (1,599)    (2,147)    (1,258)    (1,101)
  Net income (loss).........................   (1,539)    (1,319)      (528)      (507)

Loss per share:
  Basic.....................................  $ (0.08)   $ (0.04)   $ (0.01)   $ (0.01)
  Diluted...................................    (0.08)     (0.04)     (0.01)     (0.01)
  Pro forma.................................    (0.05)        --         --         --

1999 by quarter:
  Revenues..................................  $22,975    $27,279    $30,001    $36,232
  Operating income (loss)...................      396        739       (842)     2,407
  Net income................................    1,176      2,127        693      3,494

Income per share:
  Basic.....................................  $  0.03    $  0.05    $  0.02    $  0.09
  Diluted...................................     0.03       0.05       0.02       0.08
</TABLE>

     Because of the method used in calculating per share data, the quarterly per
share data will not necessarily add to the per share data as computed for the
year.

                                       51
<PAGE>   53

                                                                     SCHEDULE II

                       VALUATION AND QUALIFYING ACCOUNTS

<TABLE>
<CAPTION>
                                                   BALANCE AT
                                                  BEGINNING OF                            BALANCE AT
                                                      YEAR       PROVISION   WRITE-OFFS   END OF YEAR
                                                  ------------   ---------   ----------   -----------
<S>                                               <C>            <C>         <C>          <C>
1997
Allowance for Doubtful Accounts.................    $ 96,000     $210,000    $ (20,000)    $286,000
                                                    ========     ========    =========     ========
1998
Allowance for Doubtful Accounts.................    $286,000     $229,000    $(103,000)    $412,000
                                                    ========     ========    =========     ========
1999
Allowance for Doubtful Accounts.................    $412,000     $554,000    $(118,000)    $848,000
                                                    ========     ========    =========     ========
</TABLE>

                                       52
<PAGE>   54

                                   SIGNATURES

     Pursuant to the requirements of the Section 13 or 15(d) of the Securities
Exchange Act of 1934, the Registrant has duly caused this Report to be signed on
its behalf by the undersigned, thereunto duly authorized.

                                          ISS GROUP, INC.

                                          By:      /s/ RICHARD MACCHIA
                                            ------------------------------------
                                                      Richard Macchia
                                             Vice President and Chief Financial
                                                           Officer

Dated: March 30, 2000

                               POWER OF ATTORNEY

     KNOW ALL PERSONS BY THESE PRESENTS, that each person whose signature
appears below hereby severally constitutes and appoints, Thomas E. Noonan,
Richard Macchia and Jon Ver Steeg, and each or any of them, his true and lawful
attorney-in-fact and agent, each with the power of substitution and
resubstitution, for him in any and all capacities, to sign any and all
amendments to this Annual Report (Form 10-K) and to file the same, with exhibits
thereto and other documents in connection therewith, with the Securities and
Exchange Commission, hereby ratifying and confirming all that each said
attorney-in-fact and agent, or his substitute or substitutes, may lawfully do or
cause to be done by virtue hereof.

     Pursuant to the requirements of the Securities Exchange Act of 1934, this
Report has been signed below by the following persons on behalf of the
Registrant and in the capacities and on the dates indicated.

<TABLE>
<CAPTION>
                        NAME                                        TITLE                    DATE
                        ----                                        -----                    ----
<C>                                                    <S>                              <C>

                /s/ THOMAS E. NOONAN                   Chairman, President and Chief    March 30, 2000
- -----------------------------------------------------    Executive (Principal
                  Thomas E. Noonan                       Executive Officer)

              /s/ CHRISTOPHER W. KLAUS                 Chief Technology Officer,        March 30, 2000
- -----------------------------------------------------    Secretary and Director
                Christopher W. Klaus

                 /s/ RICHARD MACCHIA                   Vice President and Chief         March 30, 2000
- -----------------------------------------------------    Financial Officer (Principal
                   Richard Macchia                       Financial and Accounting
                                                         Officer)

                /s/ RICHARD S. BODMAN                  Director                         March 30, 2000
- -----------------------------------------------------
                  Richard S. Bodman

                /s/ ROBERT E. DAVOLI                   Director                         March 30, 2000
- -----------------------------------------------------
                  Robert E. Davoli

                    /s/ SAM NUNN                       Director                         March 30, 2000
- -----------------------------------------------------
                      Sam Nunn
</TABLE>

                                       53
<PAGE>   55

<TABLE>
<CAPTION>
                        NAME                                        TITLE                    DATE
                        ----                                        -----                    ----
<C>                                                    <S>                              <C>
               /s/ KEVIN J . O'CONNOR                  Director                         March 30, 2000
- -----------------------------------------------------
                  Kevin J. O'Connor

                 /s/ DAVID N. STROHM                   Director                         March 30, 2000
- -----------------------------------------------------
                   David N. Strohm
</TABLE>

                                       54

<PAGE>   1
                                                                   EXHIBIT 10.10



                               MOUNT VERNON PLACE

                                LEASE AGREEMENT

         THIS LEASE, made and entered into as of this ________ day of November,
1999, by and between MOUNT VERNON PLACE PARTNERS, L.L.C., a Georgia limited
liability company (hereinafter referred to as the "Landlord") and INTERNET
SECURITY SYSTEMS, INC., a Georgia corporation (hereinafter referred to as the
"Tenant");

                             W I T N E S S E T H :

         1.       PREMISES. The Landlord, for and in consideration of the
rents, covenants, agreements, and stipulations hereinafter mentioned, reserved,
and contained, to be paid, kept and performed by the Tenant, has leased and
rented, and by these presents does lease and rent, unto the said Tenant, and
said Tenant hereby agrees to lease and take upon the terms and conditions which
hereinafter appear, the following described property (hereinafter referred to
as the "Premises") two buildings known as Mount Vernon Place (hereinafter
collectively referred to in the singular as the "Building" and respectively as
the "Phase I Building" and the "Phase II Building") to be situated in Land Lot
35 of the 17th District, Fulton County, Georgia. A legal description of the
land on which the Building is to be situated is attached hereto as Exhibit "B"
(hereinafter referred to as the "Land").

                  (a)      Exhibit "A" attached hereto represents a description
         and approximation of the Premises to be leased pursuant to this Lease,
         such Premises to comprise approximately 238,600 rentable square feet
         within the Building (inclusive of the bridges to be constructed by
         Landlord pursuant to Special Stipulation 2 attached to this Lease).
         For purposes of this Lease, the parties agree that the rentable square
         feet of the Premises shall be measured and determined in accordance
         with the Building Owners and Managers Association International
         standard of measurement ANSI/BOMA Z65.1 1996. Upon the final Drawings
         and Specifications, as this term is defined in the Work Letter, being
         ascertained, Landlord and Tenant's architect, Warner, Summers, Ditzel,
         Benefield, Ward & Associates, Inc. shall measure the rentable square
         footage of the Premises in accordance with such standard, which
         measure by Landlord and Tenant's architect shall be controlling, and
         the 238,600 rentable square foot figure set forth above shall be
         adjusted accordingly. The standard of measurement ANSI/BOMA Z65.1 1996
         shall be used as the same is in effect as of the date of this Lease
         even if such standard shall change hereafter.

                  (b)      Within five (5) days after the Commencement Date (as
         defined below), Landlord shall deliver to Tenant a completed Tenant
         Acceptance Agreement (the "Tenant Acceptance Agreement") attached
         hereto as Exhibit "C" and incorporated herein, which shall contain an
         acknowledgment of the date upon which the Commencement Date (as
         defined below) of this Lease occurred, and Landlord's calculation of
         the exact number of rentable square feet within the Premises. Tenant
         shall have the right to object to the
<PAGE>   2

         Tenant Acceptance Agreement by delivering written notice to Landlord
         within five (5) days after Landlord delivers the Tenant Acceptance
         Agreement to Tenant, failing which Tenant shall be deemed to have
         agreed that all information contained in the Tenant Acceptance
         Agreement is correct. If Tenant objects to the Tenant Acceptance
         Agreement within said five (5) day period, Landlord and Tenant shall
         work together to resolve their differences and, after such differences
         have been resolved, Landlord shall execute the Tenant Acceptance
         Agreement and deliver same to Tenant and Tenant shall have a period of
         five (5) days to give written notice to Landlord objecting to the
         Tenant Acceptance Agreement, failing which Tenant shall be deemed to
         have agreed that the Tenant Acceptance Agreement is correct. Upon
         Tenant agreeing or being deemed to have agreed that all information
         contained in the Tenant Acceptance Agreement is correct, the
         Commencement Date as shown on the Tenant Acceptance Agreement shall be
         the Commencement Date for purposes of Section 2 of this lease and for
         all other purposes under this Lease and the rentable square feet of
         the Premises as shown on the Tenant Acceptance Agreement shall replace
         the rentable square feet of the leased premises referenced and defined
         in Section 1 above, and shall be deemed to be the rentable square feet
         of the Premises for all purposes under this lease. All payments of
         Base Monthly Rental (as defined below), and all other payments of rent
         and other sums of money required of Tenant herein shall be made as and
         when required herein, notwithstanding any unresolved objections to the
         Tenant Acceptance Agreement. All such payments shall be based upon the
         Tenant Acceptance Agreement prepared by Landlord until such objections
         have been finally resolved, whereupon any overpayment or any
         underpayment theretofore made shall be adjusted by increasing or
         reducing, as the case may be, the next installment of Base Monthly
         Rental coming due.

         2.       TERM. The term of this Lease shall be for a period of eleven
(11) years and six (6) months commencing on the Commencement Date (as defined
below) (such term being hereinafter referred to as the "Term"), unless sooner
terminated as may be hereinafter provided.

         3.       COMPLETION OF IMPROVEMENTS. (a) Landlord agrees to proceed
with due diligence to prepare the Premises in accordance with the Work Letter
attached hereto as Exhibit "D" (hereinafter referred to as the "Work Letter")
and in accordance with the terms of this Lease. Subject to Force Majeure (as
defined in Section 45) and subject to Tenant Delay, as defined in Section
2.01(b) of the Work Letter, Landlord shall deliver the Premises to Tenant on or
before November 1, 2000. At the time of delivery of the leased premises to
Tenant, the "Base Building Condition" as described in Section 1.02 of the Work
Letter (the "Base Building Condition") shall be constructed and installed by
Landlord and Tenant's leasehold improvements shall be constructed and installed
by Landlord pursuant to the terms, conditions and provisions of the Work
Letter. SEE SPECIAL STIPULATION 25. SEE SPECIAL STIPULATION 28.

         As used herein, "Commencement Date" means the earlier of (i) the
Commencement Date as calculated pursuant to Special Stipulation 4 or (ii) the
date upon which Tenant commences conducting its business from all or any
portion of the Premises; provided, however, in no event shall the Commencement
Date be earlier than November 1, 2000.



                                     - 2 -
<PAGE>   3

         4.       QUIET ENJOYMENT. Landlord hereby represents and warrants
that, on the Commencement Date, Landlord will own indefeasible fee simple title
in and to the Land and Building. So long as Tenant shall observe and perform
the covenants and agreements binding on it hereunder and subject to the terms
and provisions hereof, Tenant shall at all times during the Term peacefully and
quietly have and enjoy possession of the Premises.

         5.       BASE MONTHLY RENTAL. Tenant agrees to pay Landlord, by
payments to Mount Vernon Place Partners, L.L.C., and delivered to Landlord c/o
Griffin Management Services, Inc., 800 Mt. Vernon Highway, Suite 300, Atlanta,
Georgia 30328, promptly on the first day of each month in advance, during the
Term of this Lease, without deduction or set off, in legal tender, a monthly
rental as determined under Special Stipulation 16 (hereinafter referred to as
"Base Monthly Rental"). If the Term commences on a day other than the first day
of a month, or terminates on a day other than the last day of a month, the Base
Monthly Rental for the first or last partial month shall be prorated based upon
the actual number of days in such a month.

         Tenant hereby acknowledges that if any monthly payment of rent or any
monies due hereunder from Tenant shall not be received by Landlord within five
(5) business days after written notice from Landlord to Tenant that such
payment is due, then Tenant shall pay the Landlord a late charge equal to
2 1/2% of such delinquent amount. Any amounts payable hereunder by Tenant to
Landlord which are not paid within five (5) business days after written notice
from Landlord to Tenant that such payment is due shall bear interest at the
rate of one percent (1%) per month until paid.

          6.      BASE MONTHLY RENTAL ADJUSTMENT. For purposes of this Section
6 and all other provisions of this Lease, Base Monthly Rental shall be composed
of two (2) components: (i) Net Rental which is defined as the total Base
Monthly Rental less operating expenses per square foot of the Premises for the
first twelve (12) months of the term of this Lease, and (ii) Remaining Rental
which is defined as the remainder of Base Monthly Rental other than Net Rental,
such that Net Rental and Remaining Rental when combined shall equal the total
Base Monthly Rental. Commencing one year from the date of the initial Lease
term hereof and continuing on the same day of each year during the initial and
any renewal term hereof, the Net Rental component of Base Monthly Rental, as
increased by previous rental adjustments hereunder, shall be increased by the
lesser of the following: (i) the amount of the CPI Increase, as this term is
defined below; or (ii) two and one-half percent (2 1/2%).

         As used in this Section 6, the term "Lease Year" shall mean the twelve
(12) month period commencing on the Commencement Date, or, if the Commencement
Date is not on the first day of the calendar month, commencing on the first day
of the first calendar month following the Commencement Date, and each
successive twelve (12) month period thereafter during the Term. The term
"Subsequent Year" shall mean each Lease Year of the Term following the first
year. The term "Prior Year" shall mean the Lease Year prior to the subsequent
year. The term "Index" shall mean the Consumer Price Index-Seasonally Adjusted
U.S. City Average for All Urban Consumers (Base Year 1982-1984 = 100) published
by the Bureau of Labor Statistics of the United States Department of Labor. The
term "Base Month" shall mean the calendar month which is two (2) months prior
to the month during which the Lease is fully executed by Landlord and Tenant.
The



                                     - 3 -
<PAGE>   4

term "Comparison Month" shall mean the calendar month which is two (2) months
prior to the first full month of each Subsequent Year in question. On the first
day of each Subsequent Year, the CPI Increase shall be calculated as follows:
the Net Rental component of Base Monthly Rental shall be increased to an amount
equal to Net Rental for the first Lease Year plus an amount equal to the
product of ten (10) times the percentage increase in the Index for the
Comparison Month as compared to the Index for the Base Month multiplied by Net
Rental for the first Lease Year; provided, however, in no event shall Net
Rental for a Subsequent Year be less than Net Rental applicable to the Prior
Year. In the event the Base Year (1982-1984 = 100) used in computing the Index
is changed, the figures used in making the adjustment above shall accordingly
be changed. Likewise, if the Index is discontinued, the index increase shall be
in accordance with an industry wide standard for measuring the cost of living
increase and used at the time of such discontinuation acceptable to Landlord.

         An estimated annual rent schedule of the Net Rental annual rate,
assuming an annual escalation of two and one-half percent (2 1/2%) per year in
Net Rental occurs pursuant to this Section 6 and assuming operating expenses
for the first year of the Term of this Lease are $4.87 per square foot of the
Premises, is set forth in the illustrative chart below:

<TABLE>
<CAPTION>
         LEASE YEAR                 NET RENTAL ANNUAL RATE
         ----------                 ----------------------

         <S>                        <C>
         First Year                 $16.18
         Second Year                $16.58
         Third Year                 $17.00
         Fourth Year                $17.42
         Fifth Year                 $17.86
         Sixth Year                 $18.31
         Seventh Year               $18.76
         Eighth Year                $19.23
         Ninth Year                 $19.71
         Tenth Year                 $20.21
         Eleventh Year              $20.71
         Last Six Months            $21.23
</TABLE>

         In the event actual Operating Expenses for the first year of the Term
are greater than $4.87 per square foot of the Premises, then the above Net
Rental annual rates shall be adjusted downward accordingly.

         7.       [RESERVED]

         8.       ADDITIONAL RENT, OPERATING EXPENSE ADJUSTMENT. The Operating
Expense Base Year of the rentable area of the Building shall be the calendar
year of January 1, 2001 through December 31, 2001. Subject to Section 1(a)
above, the total rentable area of the Building is anticipated to be 238,600
rentable square feet. SEE SPECIAL STIPULATION 2. If in any calendar year after
the Operating Expense Base Year during the term hereof, the Operating



                                     - 4 -
<PAGE>   5

Expenses of the rentable area of the Building should exceed the Operating
Expenses of the Base Year (such excess being hereinafter referred to as the
"Operating Expense Differential"), then as additional rent for the calendar
year, Tenant shall pay within thirty (30) days after written notice by Landlord
of said amount being due for each rentable square foot of floor space leased
hereunder, and in any expansion or extensions hereof. For the purpose of this
Paragraph 8, Operating Expenses are defined in Exhibit "E" of this Lease. In
addition Operating Expenses shall be adjusted and grossed up so as to show
actual Operating Expenses without computing or taking into account reduced
costs because of first year warranties on materials and equipment.

              If during any calendar year of the Lease, the occupancy of the
rentable area of the Building averages less than one hundred percent (100%),
then it is agreed that the Operating Expense will be adjusted for such year so
that all such Operating Expenses shall be computed as though the rentable area
of the Building has been one hundred percent (100%) occupied for such calendar
year. All such expense categories will be accounted for and reported in
accordance with generally accepted accounting principles.

              At any time during the term of this Lease but not later than
fifteen (15) days prior to the date an additional rental payment is due
pursuant to this Section 8, Landlord may deliver to Tenant a written estimate
of any additional rents which may be reasonably anticipated hereunder,
estimated divided by the number of months remaining in the calendar year, and
Tenant shall pay as additional rental to Landlord promptly on the first day of
each month in advance without deduction or set off in legal tender the monthly
amount called for under such estimate from Landlord to Tenant for those months
for which such additional rental is due pursuant to this Section 8. Any such
written estimate from Landlord to Tenant, as contemplated in this paragraph,
may also include amounts reasonably estimated by Landlord to be due as a result
of Landlord's replacing light bulbs and fixtures in the Premises, as
contemplated in Section 14 of this Lease, or as a result of Landlord's paying
utility bills on behalf of Tenant and thereafter receiving reimbursement from
Tenant for such payments by Landlord on Tenant's behalf, as contemplated under
Section 17 of this Lease. SEE SPECIAL STIPULATION 31.

              Statements showing the actual Operating Expenses of the Building
and Tenant's proportionate share thereof (hereinafter referred to as "Statement
of Actual Adjustment") shall be delivered by Landlord to Tenant within one
hundred twenty (120) days after the end of any calendar year in which
additional rental was paid or due by Tenant under provisions hereof. Within
thirty (30) days after written notice by Landlord to Tenant of such Statement
of Actual Adjustment, Tenant shall pay to Landlord the amount of any rentals
shown as being due and unpaid thereon. Should such Statement of Actual
Adjustment show the Tenant had paid to Landlord an aggregate amount in excess
of the additional rental due for the preceding calendar year and Tenant is not
then in default hereunder, Landlord shall refund the amount of overpayment.

         If the Term of this Lease begins on a day other than the first day of
the calendar year, or should this Lease terminate on a day other than the last
day of the calendar year, the amount shown as due by Tenant on the Statement of
Actual Adjustment shall reflect a proration based on the proportion that the
number of days this Lease was in effect during such calendar year bears to



                                     - 5 -
<PAGE>   6

360. The Landlord's right to recover Operating Expenses Adjustment shall
survive the termination of this Lease.

         Provided Tenant is not in default under the terms of this Lease Tenant
shall have the right to inspect Landlord's books and records with respect to
Operating Expenses and its proportionate share thereof for any preceding
calendar year. This inspection shall be completed at the Tenant's sole cost and
expense by independent, certified public accountants practicing for an
accounting firm of national prominence and for the exclusive purpose of
determining whether Landlord has complied with the terms of this Lease relating
to Operating Expenses. Should Tenant's inspection reveal that Landlord has
overstated or understated Operating Expenses an appropriate adjustment will be
made. If Tenant owes any amount to Landlord based on such adjustment, it shall
be paid to Landlord within thirty (30) days after the request thereof; if
Landlord owes any amount to Tenant based on such adjustment, such amount shall
be credited against the rent next coming due under this Lease.

         9.       USE OF PREMISES. The Premises shall be used for general
office purposes, and purposes related thereto (which may include a cafeteria or
food service facility for use by Tenant's employees if permitted by applicable
laws, ordinances and regulations), and no other purposes, all in accordance
with the Rules and Regulations attached hereto and incorporated herein by this
reference. The Tenant shall not use, permit or allow the Premises to be used
other than as strictly provided in this Lease and shall not use, permit or
allow the Premises or any part thereof to be used for any unlawful purpose or
otherwise in violation of any federal, state or local statute, law, ordinance,
rule or regulation, including, without limitation, in violation of any zoning
ordinances; nor shall the Tenant knowingly permit any nuisance within the
Premises or permit the Premises to be used in any manner which will be a source
of material annoyance or in any way knowingly interfere with the peaceful
possession, enjoyment and proper use of other areas of the Building, nor shall
the Premises be knowingly used in any manner so as to vitiate the insurance or
increase the rate of insurance on the Premises or the Building, nor shall the
Premises be used for any unlawful purpose which would tend to lower the quality
or character of the Building, create unreasonable elevator loads or otherwise
materially interfere with Building operations. Not by way of limitation of the
foregoing but in addition thereto, neither the Premises nor any portion thereof
shall be used or occupied for any or all of the following: governmental or
quasi-governmental offices, spas (other than a health club or exercise facility
for employees of Tenant), massage parlors, escort services offices, retail
sales purposes, classroom facility purposes (other than in connection with
Tenant's employee and client training), schools, auto leasing or auto sales
offices, equipment or appliance repair shops, day care centers (other than for
Tenant's employees' children), nurseries, churches, or places of religious or
quasi-religious worship, religious facilities or offices of religious
organizations, or retail or wholesale sale purposes, medical research
laboratories or offices for medical or quasi-medical professionals providing
medical treatments.

         10.      NO NUISANCE. Tenant shall conduct its business in such a
manner so as not to knowingly create any nuisance or interference with Landlord
in its operation of the Building.

         11.      ASSIGNMENT AND SUBLETTING. Tenant may sublease or assign any
or all of the Premises without Landlord's prior written consent; provided,
however, any assignee or



                                     - 6 -
<PAGE>   7

subtenant of Tenant shall be bound by all of the terms, conditions and
provisions of this Lease, including, without limitation, the provisions of
Section 9 concerning use of the Premises, and Tenant shall remain primarily
liable on this Lease for the entire Term hereof and shall in no way be released
from the full and complete performance of all of the terms, obligations
(including, without limitation, those under Special Stipulation 10), covenants
and agreements contained herein. Prior to the time of any such assignment or
sublease by Tenant, Tenant shall first provide Landlord with written
notification of Tenant's intent to so assign or sublease and such written
notification from Tenant to Landlord shall include, at a minimum, the following
information regarding any applicable proposed assignee or sublessee: (i)
financial statements and other relevant financial information regarding any
proposed assignee or sublessee; (ii) the identity and type of business of such
proposed assignee or sublessee; and (iii) such proposed assignee or sublessee's
proposed use of the Premises which shall in all events be consistent and in
compliance with the permitted use provisions set forth under Section 9 above.
Landlord's consent shall not be required with respect to any such proposed
assignee or sublessee; rather, the purpose of the preceding provisions
regarding such notification and information from Tenant to Landlord shall be
that of notifying Landlord with respect to any proposed assignee or sublessee.
Further, in the event Tenant fails to comply with its obligations set forth
under this Section 11 with respect to providing such information to Landlord
and otherwise notifying Landlord as called for above under this Section 11,
then any such breach by Tenant shall be considered a nonmonetary breach
pursuant to nonmonetary event of default 16(ii) in Section 16 of this Lease
which follows, as opposed to a monetary event of default pursuant to 16(i) in
Section 16 of this Lease which follows, and accordingly, shall be subject to
the notice and cure provisions set forth in said 16(ii).

         12.      HOLDING OVER. Should Tenant or any of its successors in
interest continue to hold the Premises after termination of this Lease, whether
such termination occurs by lapse of time or otherwise, with Landlord's
acquiescence, and without any distinct agreement between the parties, then for
the first six (6) month period of such holding over by Tenant, such holding
over shall constitute and be construed as a tenancy at will at a monthly rental
equal to 125% of the monthly rental (including Base Monthly Rental and any
adjusted and additional rent) provided herein at the time of such termination.
At all times following the first six (6) month period of such holding over by
Tenant, such holding over shall then constitute and be construed as a month to
month tenancy at will at a monthly rental equal to one hundred fifty percent
(150%) of the monthly rental (including Base Monthly Rental and any adjusted
and additional rent). At all times during the period of such holding over by
Tenant (but only during such period of such holding over by Tenant and not
prior to the expiration of the normal term of this Lease), Tenant shall be
entitled to terminate this Lease upon thirty (30) days prior written notice to
Landlord. Similarly, at all times following the first six (6) month period of
such holding over by Tenant, Landlord shall be entitled to terminate this Lease
upon sixty (60) days prior written notice to Tenant and at all times following
the expiration of such sixty (60) day notice period from Landlord to Tenant,
Tenant shall be regarded as a tenant at sufferance and not as a tenant at will;
subject, however, to all the terms, provisions, covenants and agreements on the
part of Tenant hereunder. At all times during the period of such tenancy at
sufferance, no payments of money by Tenant to Landlord after the termination of
this Lease shall reinstate, continue, renew or extend the Term and no extension
of this Lease after the termination hereof shall be valid unless and until the
same shall be reduced to writing and signed by both Landlord and Tenant. With
respect to such tenancy at sufferance, Tenant shall be liable to



                                     - 7 -
<PAGE>   8

Landlord for all damage which Landlord shall suffer by reason of Tenant's
holding over and Tenant shall indemnify, defend and hold Landlord harmless
against all claims made by any other tenant or prospective tenant against
Landlord resulting from delay by Landlord in delivering possession of the
Premises to such other tenant or prospective tenant.

         13.      ALTERATIONS AND IMPROVEMENTS. (a) No structural alteration
in, or structural addition to, the Premises or the mechanical, electrical, or
any other systems (other than security) of the Premises will be made without
first obtaining Landlord's prior written consent, which shall not be
unreasonably withheld, conditioned, or delayed, and any such work consented to,
although paid for by Tenant, may be done by Landlord's contractor. However, in
the event the same is performed by Tenant then all such work performed by
Tenant shall meet any and all applicable building codes, and shall otherwise be
performed in full compliance with any and all applicable laws, ordinances,
codes and regulations, and further, Tenant shall (i) perform all such work in a
reasonable manner; (ii) utilize only contractors or other vendors with a first
class reputation; (iii) cause such work to be completed promptly on a lien free
basis; (iv) cause such work to be completed in compliance with all applicable
laws, ordinances, regulations and rules; (v) utilize the same or similar
materials as any materials which may be replaced; (vi) obtain Landlord's prior
written approval of all contractors, subcontractors and other vendors to be
utilized by Tenant in performing any such work; and (vii) obtain any and all
required building permits and other required approvals prior to performing any
such work. Tenant shall, however, be entitled to perform nonstructural
alterations or nonstructural additions to the Premises and shall be entitled to
work on the security system (but not any other Building system) without
Landlord's prior written consent but subject to and in compliance with the
terms and conditions set forth in this Section 13 regarding any work performed
by Tenant.

                  (b)      If Tenant's actions, omissions or occupancy of the
Premises shall knowingly cause the rate of fire or other insurance either on
the Building or the Premises to be increased, Tenant shall pay, as additional
rent, the amount of any such increase promptly upon demand by Landlord; and

                  (c)      All erections, additions, fixtures and improvements,
whether temporary or permanent in character (except only the movable office
furniture of Tenant) made in or upon the Premises shall be and remain
Landlord's property and shall remain upon the Premises at the termination of
this Lease by lapse of time or otherwise, with no compensation to Tenant. At
the expiration of the Term of this Lease, Tenant shall leave the Premises broom
clean and in good condition, normal wear and tear accepted.

         14.      REPAIRS TO THE PREMISES. Landlord shall not be required to
make any repairs or improvements to the Premises, except roof and structural
repairs and repairs of latent defects necessary for safety and, tenantability,
together with repairs to the mechanical, electrical and power, plumbing
(including hot and cold water), HVAC, elevators and restrooms as may be
required. Tenant shall, at its own cost and expense, keep in good repair all
portions of the Premises, including but not limited to windows, interior glass,
doors, interior walls and finish work, floors and floor coverings, and
supplemental or special heating and air conditioning systems, and shall take
good care of the Premises and its fixtures and permit no waste, except normal
wear and tear with due consideration for the purpose for which the Premises are
leased. Landlord shall maintain and



                                     - 8 -
<PAGE>   9

replace, at its cost and expense, all light bulbs and fixtures in the Premises.
To the extent Landlord incurs costs pursuant to the preceding sentence in
excess of Landlord's costs associated with the Building's standard two foot by
four foot fluorescent light fixtures and bulbs and any other Building standard
lighting, Landlord shall invoice Tenant for such excess costs incurred by
Landlord, and Tenant shall pay any and all such invoices as additional rental
in accordance with the provisions of Section 8 and Special Stipulation 31 of
this Lease. Tenant shall indemnify Landlord against any loss, damage, or
expense arising by reason of any failure of Tenant to keep the Premises in good
repair and tenantable condition as expressly required herein or due to any act
or neglect of Tenant, its agents, employees, contractors, invitees, licensees,
tenants, or assignees. If Tenant fails to perform after five (5) days prior
written notice from Landlord to Tenant that any such maintenance or repair is
required (except in the event of emergency in which event no such prior written
notice shall be required), or cause to be performed, such maintenance and
repairs, then at the option of Landlord, in its sole discretion, any such
maintenance or repair may be performed or caused to be performed by Landlord
and the cost and expense thereof charged to Tenant, and Tenant shall pay the
amount thereof to Landlord on demand as additional rental. Tenant shall
promptly report to Landlord in writing any damage to, or defective condition in
or about the Building or Premises known to Tenant.

                  15.      LANDLORD'S RIGHT TO ENTER PREMISES. Tenant shall not
change the locks on any entrance to the Premises without prior written notice
to Landlord, and in this event, Tenant shall provide copy keys to Landlord to
the Premises; provided, however, Tenant shall have the right to utilize a card
access system for entry to the Premises to which Landlord shall be subject but
Landlord shall at all times have full access to the Premises and Building.
However, notwithstanding the foregoing, Landlord and Tenant will agree upon
certain limited specific areas of the Premises which will be off limits to
Landlord at all times with such agreement by Landlord and Tenant to be
reflected in an amendment to this Lease. Designated agents, employees, and
contractors of Landlord shall have the right to enter the Premises upon one (1)
business day prior written notice from Landlord to Tenant (except in the event
of emergency in which event no such notice shall be required), at such times as
Landlord deems reasonably necessary, to make necessary repairs, additions,
alterations, and improvements to the Premises or the Building, including,
without limitation, the erection, use, and maintenance of pipes and conduits.
Landlord shall also be allowed to take into and through the Premises any and
all needed materials that may be required to make such repairs, additions,
alterations, and improvements, all without being liable to Tenant in any manner
whatsoever. During such time as work is being carried on in or about the
Premises, provided such work is carried out in a manner so as not to interfere
unreasonably with the conduct of Tenant's business therein, the rent provided
herein shall in no way abate, and Tenant waives any claim and cause of action
against Landlord for damages by reason of loss or interruption to Tenant's
business and profits therefrom because of the prosecution of any such work or
any part thereof. In the event of emergency, or if otherwise necessary to
prevent injury to persons or damage to property, such entry to the Premises may
be made by force without any liability whatsoever on the part of Landlord for
damage resulting from such forcible entry.

                  16.      DEFAULT AND REMEDIES. The following events shall be
deemed to be events of default by Tenant under this Lease: (i) Tenant shall
fail to pay any installment of Base Monthly Rental, Additional Rent or any
other charge or assessment against Tenant pursuant to the terms



                                     - 9 -
<PAGE>   10

hereof within ten (10) days after notice thereof to Tenant; (ii) Tenant shall
fail to comply with any term, provision, covenant or warranty made under this
Lease by Tenant, other than the payment of the Base Monthly Rental or
additional rent or any other charge or assessment payable by Tenant, and shall
not cure such failure within thirty (30) days after notice thereof to Tenant
except that if such matter, by its nature, requires more than thirty (30)
business days to cure, then Tenant shall be entitled to additional time (but
not to exceed an additional forty-five (45) business days) provided Tenant
commences such cure promptly and diligently pursues such cure to completion in
all events within such additional forty-five (45) business day period; (iii)
Tenant or any guarantor of this Lease shall make a general assignment for the
benefit of creditors, or shall admit in writing its inability to pay its debts
as they become due, or shall file a petition in bankruptcy, or shall be
adjudicated as bankrupt or insolvent, or shall file a petition in any
proceeding seeking any reorganization, arrangement, composition, readjustment,
liquidation, dissolution or similar relief under any present or future statute,
law or regulation, or shall file an answer admitting or fail timely to contest
the material allegations of a petition filed against it in any such proceeding;
(iv) a proceeding is commenced against Tenant or any guarantor of this Lease
seeking any reorganization, arrangement, composition, readjustment,
liquidation, dissolution or similar relief under any present or future statute,
law or regulation, and such proceeding shall not have been dismissed within
sixty (60) business days after the commencement thereof; (v) a receiver or
trustee shall be appointed for the Premises or for all or substantially all of
the assets of Tenant or of any guarantor of this Lease; or (vi) Tenant shall
fail to take possession of the Premises as provided in this Lease; (vii) Tenant
shall knowingly do or permit to be done anything which creates a lien upon the
Premises or the Building and such lien is not removed or discharged within
thirty (30) business days after the filing thereof.

         Upon the occurrence of any of the aforesaid events of default, without
notice or demand of Tenant in any instance, Landlord shall have the option to
pursue any one or more of the following remedies:

                  (a)      Terminate this Lease by giving Tenant notice of
termination, in which event this Lease shall expire and terminate on the date
specified in such notice of termination, with the same force and effect as
though the date so specified were the date herein originally fixed as the
termination date of the Term of this Lease, and all rights of Tenant under this
Lease and in and to the Premises shall expire and terminate, and Tenant shall
remain liable for all obligations under this Lease arising up to the date of
such termination, and Tenant shall surrender the Premises to Landlord on the
date specified in such notice and if Tenant fails to do so, Landlord may
without prejudice to any other remedy which it may have for possession or
arrearage in rent, enter upon and take possession of the Premises and expel or
remove Tenant and any other person who may be occupying the Premises or any
portion thereof.

                  (b)      Landlord may immediately, or at any time thereafter
so long as such event of default remains uncured, terminate this Lease, and in
the event this Lease is so terminated, Landlord shall be entitled to recover
forthwith against Tenant, as liquidated damages and not as a penalty, the
present value determined by application of a reasonable discount rate selected
by Landlord of the Aggregate Gross Rent (defined below) and the actual or
estimated (as reasonably determined by Landlord) Reletting Costs (defined
below) less the aggregate fair market rental



                                    - 10 -
<PAGE>   11

value of the Premises for what otherwise would have been the unexpired balance
of the Lease Term (Landlord and Tenant hereby agreeing that Landlord's actual
damages in such event are impossible to ascertain and the amount set forth
hereinabove as Landlord's liquidated damages is a reasonable estimate of the
amount of actual damages which Landlord probably would suffer). In determining
the aggregate fair market rental value pursuant to the preceding sentence, the
parties hereby agree that all relevant factors shall be considered as of the
time Landlord seeks to enforce such remedy, including, but not limited to, (i)
the length of time remaining in what otherwise would have been the unexpired
balance of the Lease Term (exclusive of renewals and extensions), (ii) the then
current market conditions in the metropolitan Atlanta, Georgia area, (iii) the
likelihood of reletting the Premises for a period of time equal to what
otherwise would have been the unexpired balance of the Lease Term, (iv) the net
effective rental rates (taking into account all concessions) then being
obtained for space of similar type and size in similar type buildings in the
metropolitan Atlanta, Georgia area, (v) the vacancy levels in comparable
quality multi-tenant office buildings in the metropolitan Atlanta, Georgia
area, (vi) the anticipated duration of the period the Premises will be
unoccupied prior to the reletting, (vii) the anticipated cost of reletting, and
(viii) the current levels of new construction of multi-tenant office buildings
in the metropolitan Atlanta, Georgia area that will be completed during the
period in what otherwise would have been the unexpired balance of the Lease
Term and the degree to which such new construction will likely affect vacancy
rates and rental rates in comparable quality multi-tenant office buildings in
the metropolitan Atlanta, Georgia area. In the event Landlord shall relet the
Premises for the period which otherwise would have constituted the unexpired
portion of the Term (or any part thereof), the amount of rent and other sums
payable by the tenant thereunder shall be deemed prima facie to be the rental
value for the Premises (or the portion thereof so relet) for the Lease Term of
such reletting. Tenant shall in no event be entitled to any rents collected or
payable in respect of any reletting, whether or not such rents shall exceed the
Base Monthly Rental and any additional rent reserved in this Lease. As used
herein, the term "Aggregate Gross Rent" shall mean the Base Monthly Rental and
any additional rent and any other sums due hereunder as of the date of
termination of this Lease plus the Base Monthly Rental and any additional rent
which would have been owing by Tenant hereunder for the balance of the Lease
Term had this Lease not been terminated, less the net proceeds, if any,
received as a result of any reletting of the Premises by Landlord subsequent to
such termination, after deducting all of Landlord's expenses including, without
limitation, all repossession costs, brokerage commissions, legal expenses,
attorneys' fees, expenses of employees, alteration and repair costs and
expenses of preparation for such reletting (collectively, the "Reletting
Costs").

                  (c)      Without terminating this Lease, terminate Tenant's
right of possession and enter into and upon and take possession of the Premises
or any part thereof, and at Landlord's option, expel and remove persons and
property therefrom by entry (including the use of force if necessary),
dispossessing suit or otherwise, without thereby releasing Tenant from any
liability hereunder, without terminating this Lease, and without being liable
to prosecution or any claim for damages therefor. Such property, if any, may be
removed and stored in a warehouse or elsewhere at the cost of, and for the
account of Tenant, all without being deemed guilty of trespass or becoming
liable for any loss or damage which may be occasioned thereby, and Landlord
may, but shall be under no obligation to do so relet the Premises or any
portion thereof in Landlord's or Tenant's name, but for the account of Tenant,
with or without advertisement, and by private negotiations, and receive the



                                    - 11 -
<PAGE>   12

rent therefore, and for any term and upon such terms and conditions as Landlord
may deem necessary or desirable. Landlord shall in no way be responsible or
liable for any rental concessions or any failure to lease the Premises or any
part thereof, or for any failure to collect any rent due upon such reletting.
Upon each such reletting, all rentals received by Landlord from such reletting
shall be applied as follows: first, to the payment of any indebtedness (other
than any amounts due hereunder) from Tenant to Landlord; second, to the payment
of any costs and expenses of such reletting, including, without limitation,
brokerage fees and attorneys' fees and costs of alterations and repairs (Tenant
agreeing that Landlord shall have the right to make such alterations and
repairs as, in Landlord's judgement, may be necessary to relet the Premises);
third, to the payment of rental and other charges then due and unpaid
hereunder; and the residue, if any, shall be held by Landlord to the extent of
and for application in payment of future amounts due hereunder as the same may
become due and payable hereunder. In reletting the Premises as aforesaid,
Landlord may grant rent concessions and Tenant shall not be credited therefor.
If such rentals received from such reletting shall at any time or from time to
time be less than sufficient to pay to Landlord the entire sums then due from
Tenant hereunder, Tenant shall pay any such deficiency to Landlord. Such
deficiency shall, at Landlord's option, be calculated and paid monthly. No such
reletting shall be construed as an election by Landlord to terminate this Lease
unless a written notice of such election has been given to Tenant by Landlord.
Notwithstanding any such reletting without termination, Landlord may at any
time thereafter elect to terminate this Lease for any such previous event of
default provided same has not been cured. Notwithstanding anything contained
herein to the contrary, no termination of Tenant's right of possession of the
Premises by dispossessory action or otherwise shall release Tenant from the
performance of Tenant's obligations under this Lease, including, without
limitation, the timely payment of all rent reserved hereunder for the balance
of the Term of this Lease following such termination of Tenant's right of
possession, and Tenant agrees to so perform said obligations.

                  (d)      Without liability to Tenant or any other party and
without constituting a constructive or actual eviction, suspend, or discontinue
furnishing or rendering to Tenant any property, material, labor, utilities or
other service, wherever Landlord is obligated to furnish or render the same, so
long as Tenant is in default under this Lease.

                  (e)      Allow the Premises to remain unoccupied and collect
Base Monthly Rental and other charges due hereunder from Tenant as they come
due.

                  (f)      Landlord may perform, as agent for and at the
expense of Tenant, any obligation of Tenant under this Lease which Tenant has
failed to perform and of which Landlord shall have given Tenant notice and
opportunity to cure as provided herein, the cost of which performance by
Landlord together with interest thereon at the default rate from the date of
such expenditure, shall be deemed additional rental and shall be payable by
Tenant to Landlord upon demand, and Tenant agrees that Landlord shall not be
liable for any damages resulting to Tenant from such action, whether caused by
negligence of Landlord or otherwise.

                  (g)      Landlord may exercise any other legal or equitable
right or remedy which it may have, including, but not limited to Landlord's
right judicially to obtain possession pursuant to Georgia statutory law.



                                    - 12 -
<PAGE>   13

         Any costs and expenses incurred by Landlord (including, without
limitation, reasonable (non-statutory) attorneys' fees actually incurred) in
successfully enforcing any of its rights or remedies under this Lease shall be
deemed additional rent and shall be repaid to Landlord by Tenant demand.

         Pursuit of any of the foregoing remedies shall not preclude pursuit of
any other remedy herein provided or any other remedy provided by law or at
equity, nor shall pursuit of any remedy herein provided constitute an election
of remedies thereby excluding the later election of an alternate remedy, or a
forfeiture or waiver of any Base Monthly Rental, additional rent or other
charges and assessments payable by Tenant and due to Landlord hereunder or of
any damage accruing to Landlord by reason or violation of any of the terms,
covenants, warranties and provisions herein contained. No course of dealing
between Landlord and Tenant or any failure or delay on the part of Landlord in
exercising any rights of Landlord under this paragraph, or under any other
provisions of this Lease, shall operate as a waiver of any rights of Landlord
hereunder or under any other provisions of this Lease, nor shall any waiver of
an event of default on one occasion operate as a waiver of any subsequent event
of default or of any other event of default. No express waiver shall affect any
condition, covenant, rule, or regulation other than the one specified in such
waiver and that one only for the time and in the manner specifically stated.

         If this Lease is terminated by Landlord pursuant to clause (b) above,
"present value" may be computed by discounting the amount of such excess to
present worth at a discount rate equal to one percent (1%) above the discount
rate then in effect at the Federal Reserve Bank of Atlanta, Georgia. Neither
the commencement of any action or proceeding, nor the settlement thereof, nor
entry of judgment thereon shall bar Landlord from bringing subsequent actions
or proceedings from time to time, nor shall the failure to include in any
action or proceeding any sum or sums then due be a bar to the maintenance of
any subsequent actions or proceedings for the recovery of such sum or sums so
omitted. Landlord's pursuit of any remedy or remedies, including, without
limitation, any one or more of the remedies stated above, shall not (i)
constitute an election of remedies or preclude pursuit of any other remedy or
remedies provided in this Lease or separately or concurrently or in any
combination, or (ii) serve as the basis for any claim of constructive eviction,
or allow Tenant to withhold any payments under this Lease.

         The failure of Landlord to insist upon strict performance of any of
the terms, conditions and covenants herein shall not be deemed to be a waiver
of any subsequent breach or default in the terms, conditions, and covenants
herein contained except as may be expressly waived in writing.

         Landlord shall in no event be in default in the performance of any of
its obligations in this Lease unless and until Landlord shall have failed to
perform such obligation within thirty (30) days or such additional time as is
reasonably required to correct any such default, after notice by Tenant to
Landlord properly specifying wherein Landlord has failed to perform any such
obligation.

         If Tenant shall at any time be in default hereunder, and if Landlord
shall deem it necessary to engage attorneys to enforce Landlord's rights
hereunder, the determination of such necessity to be in the reasonable
discretion of Landlord or if Landlord is made a party to litigation involving
or



                                    - 13 -
<PAGE>   14

pertaining to Tenant due to no fault of Landlord, then Tenant will reimburse
Landlord for the reasonable expenses incurred thereby, including but not
limited to court costs and reasonable attorneys' fees and other legal expenses.

         Tenant hereby covenants that, prior to the exercise of remedies, it
will give the holder of any Mortgage (as defined below) notice and thirty (30)
days to cure said default unless said default cannot be cured within thirty
(30) days, in which case such holder shall have the right, but not the
obligation, to commence and to diligently prosecute the cure of Landlord's
default.

         17.      LANDLORD'S SERVICES. Landlord shall furnish the following
services to Tenant during the Term of this Lease:

         (a)      Janitor service shall be provided Monday through Friday of
each week, exclusive of New Years Day, Memorial Day, Independence Day, Labor
Day, Thanksgiving Day and Christmas Day, pursuant to specifications therefor
described on Exhibit "G" attached hereto and incorporated herein by reference.
The janitorial staff shall be subject to Tenant's security clearance procedures
for the Premises. Additionally, Tenant shall have the right to replace the
janitorial services provided by Landlord, and if Tenant so elects, then the
rental under this Lease shall be reduced by Landlord's previous cost in
providing such janitorial services as documented by an amendment to this Lease
to be executed by Landlord and Tenant.

         Tenant will design Tenant's electrical system serving any equipment
producing non-linear electrical loads to accommodate such non-linear electrical
loads, including, but not limited to, over-sizing neutral conductors, de-rating
transformers and/or providing power line filters. Tenant's final contract
documents for the Tenant Improvements (as defined in the Work Letter) shall
include a calculation of Tenant's fully connected design load with and without
demand factors and shall indicate the number of watts of un-metered and
sub-metered loads.

         The design and installation of any additional electrical equipment (or
any related meter) required by Tenant shall be subject to the prior approval of
Landlord (which approval shall not be unreasonably withheld). All expenses
incurred by Landlord in connection with the review and approval of any
additional electrical equipment shall also be reimbursed to Landlord by Tenant.

         If any of Tenant's electrical equipment requires conditioned air in
excess of Building Standard air conditioning, the same shall be installed by
Tenant at Tenant's sole cost in a manner previously approved by Landlord in
writing, and Tenant shall pay all design, installation, metering and operating
costs relating thereto.

         To the extent the services described hereinabove require electricity
and water supplied by public utilities, Landlord's covenants thereunder shall
only impose on Landlord the obligation to use its good faith, reasonable
efforts to cause the applicable public utilities to furnish the same. All of
the services (other than janitorial) contemplated under this Section 17 as well
as any other applicable utility services shall be provided by Landlord to
Tenant solely at Tenant's cost, and in no event, notwithstanding any other
provision of this Lease to the contrary, shall Landlord incur



                                    - 14 -
<PAGE>   15

any costs whatsoever associated with utility invoices from the applicable
utilities. Rather, Landlord's only responsibility shall be to receive and remit
payment for such invoices on Tenant's behalf to be reimbursed by Tenant in
accordance with the following: In the course of Landlord's management of the
Building, Landlord shall receive and remit payment for the utility invoices
associated with the services set forth under this Section 17, and Tenant shall
reimburse Landlord for such payments made by Landlord on Tenant's behalf within
fifteen (15) days of Landlord's presentation of Landlord's invoice to Tenant
associated with Landlord's payment on Tenant's behalf of any such utility
payments. SEE SECTION 8 AND SPECIAL STIPULATION 31. Landlord's management of
the Building shall include landscaping and other services commensurate with the
following standard: such management shall be in a first class manner comparable
to other office properties in the Central Perimeter Office Market of Atlanta,
Georgia. SEE SPECIAL STIPULATION 19.

         18.      WINDOW DRESSINGS. All exterior windows of the Premises shall
be equipped only with Building-standard blinds provided by the Landlord. Tenant
may install other window treatments so long as same have solid white linings
and so long as the Building-standard blinds remain affixed between the window
glass and the other window treatments.

         19.      TELEPHONE SERVICE. Tenant acknowledges and agrees that
securing and arranging for telephone service to the Premises is the sole
responsibility of Tenant and that Landlord has no responsibility or obligation
to provide or arrange such telephone service.

         20.      DESTRUCTION OF PREMISES. Should the Premises be so damaged by
fire or other cause that rebuilding or repairs cannot, in the estimation of
Landlord, be completed within one hundred twenty (120) days from the date of
the fire, or other cause of damage, then either Landlord or Tenant may
terminate this Lease by written notice to the other given within thirty (30)
days of the date of such damage or destruction, in which event rent shall be
abated from the date of such damage or destruction. However, if the damage or
destruction is such that rebuilding or repairs can be completed within one
hundred twenty (120) days, Landlord covenants and agrees, subject to the
provisions of this paragraph, to make such repairs with reasonable promptness
and dispatch within such one hundred twenty (120) day period, and to allow
Tenant an abatement in the Base Monthly Rental for such time as the Premises
are untenantable or proportionately for such portion of the Premises as shall
be untenantable, and Tenant covenants and agrees that the terms of this Lease
shall not be otherwise affected. In no event shall Landlord be required to
repair or replace any trade fixtures, furniture, equipment or other property
belonging to Tenant nor shall Landlord be required to rebuild, repair or
replace any part of the partitions, fixtures, additions, or other improvements
which may have been placed in or about the Premises by Tenant. Notwithstanding
anything to the contrary contained in this paragraph, Landlord shall not have
any obligation whatsoever to repair, reconstruct or restore the Premises when
the damage resulting from any casualty contained under this paragraph occurs
during the last six (6) months of the Term of this Lease, but rent shall abate
to the extent set forth above in this Section 20 until such repairs are
completed.

         21.      CONDEMNATION. If the whole of the Premises or access to the
Premises, or such portion thereof, as will make Premises unusable for the
purposes herein leased, be condemned by



                                    - 15 -
<PAGE>   16

any legally constituted authority for any public use or purpose, then, in
either of said events, the Term hereby granted shall cease from the date when
possession thereof is taken by public authorities, and rental shall be
accounted for as between Landlord and Tenant as of said date. Such termination,
however, shall be without prejudice to the rights of either Landlord or Tenant
to recover compensation and damage caused by condemnation from the condemnor;
provided, however, Tenant shall not be entitled to claim compensation for items
which would reduce Landlord's award.

         22.      INSURANCE. Landlord shall insure the initial Tenant
Improvements to the Premises. Subject to the foregoing, Tenant shall insure
subsequent alterations, additions, and improvements to the Premises and shall
otherwise carry the required insurance under this Lease as follows: Tenant
shall carry fire and extended coverage insurance insuring Tenant's interest in
its improvements and betterment to the Premises and any and all furniture,
equipment, supplies, and other property owned, leased, held, or possessed by it
and contained therein, against loss or damage by fire, flood, windstorms, hail,
earthquakes, explosion, riot, damage from aircraft and vehicles, smoke damage,
vandalism and malicious mischief and such other risks as are from time to time
covered under "extended coverage" endorsements and special extended coverage
endorsements commonly known as "all risks" endorsements, such insurance
coverage to be in an amount equal to the full replacement value of such
improvements and property.

         Tenant also agrees to carry a policy or policies of workers'
compensation and commercial general liability insurance, including personal
injury and property damage in an amount of not less than Two Million and No/100
Dollars ($2,000,000.00) for the property damage and Five Million and No/100
Dollars ($5,000,000.00) per occurrence for personal injuries or deaths of
persons occurring in or about the Premises. Said policies shall: (i) name
Landlord, its agents and mortgagees as additional insureds and insure
Landlord's contingent liability under this Lease (except for the workers'
compensation policy, which shall instead include waiver of subrogation
endorsement in favor of Landlord); (ii) be issued by an insurance company which
is acceptable to Landlord and licensed to do business in the State of Georgia
and maintains an A.M. Best credit rating of "B+" or better; and (iii) provide
that said insurance shall not be cancelled unless thirty (30) days' prior
written notice shall have been given to Landlord. Said policy or policies, or
certificate thereof, shall be delivered to Landlord by Tenant upon commencement
of the Term of the Lease and upon each renewal and/or modification of said
insurance. If during the Term or any extension thereof additional coverage
and/or higher limits of insurance than those mentioned above shall be deemed
necessary by Landlord, Tenant shall procure such additional coverage provided
such additional coverage is appropriate, customary and generally required for
like premises utilized for similar purpose. If Tenant shall fail at any time to
procure and/or maintain the insurance required herein, Landlord may, at its
option, procure such insurance on Tenant's behalf and the cost thereof shall be
payable upon demand, as additional rent. Payment by Landlord of any insurance
premium or the carrying by Landlord of any such insurance policy shall not be
deemed to waive or release the default of Tenant with respect thereto.

         Landlord shall procure and maintain at its expense (but with the
expense to be included in Operating Expenses) throughout the Term a policy or
policies of special form/all risk insurance covering the Building including the
initial Tenant Improvements in the Premises up to the amount



                                    - 16 -
<PAGE>   17

of the Tenant Improvement Allowance, but excluding Tenant's personal property
and equipment, in an amount equal to the full insurable replacement costs
thereof as such may increase from time to time (but such insurance may provide
for a commercially reasonable deductible), and in an amount sufficient to
comply with any coinsurance requirements in such policy, and a policy of
worker's compensation insurance, if any, as required by applicable law. In
addition, Landlord shall procure and maintain at its expense (but with the
expense to be included in Operating Expenses) and shall thereafter maintain
throughout the Term, a commercial general liability insurance policy covering
the Building with combined single limits for damage to property and personal
injury of not less than One Million Dollars ($1,000,000.00) per occurrence,
subject to annual aggregate limits of not less than Two Million Dollars
($2,000,000.00). Landlord may also carry such other types of insurance in form
and amounts which Landlord shall determine to be appropriate from time to time,
and the costs thereof shall be included in Operating Expenses. All such
policies procured and maintained by Landlord pursuant to this Section 22 shall
be carried with companies licensed to do business in the State of Georgia. Any
insurance required to be carried by Landlord hereunder may be carried under
blanket policies covering other properties of Landlord and/or its members
and/or their respective related or affiliated corporations and entities as long
as such blanket policies provide insurance at all times for the Building as
required by this Lease. Tenant shall be named as an additional insured on all
such insurance carried by Landlord with respect to the Building.

         23.      WAIVER OF SUBROGATION. Landlord and Tenant each hereby
releases the other from any and all liability or responsibility to the other or
anyone claiming through or under them by way of subrogation or otherwise for
any loss or damage to property caused by fire or any other perils that is
insured against or that are required to be insured against under the terms of
the Lease, even if such loss or damage shall have been caused by the fault or
negligence of the other party, or anyone for whom such party may be
responsible, including, without limitation, any other tenants or occupants of
the remainder of the Building in which the Premises are located; provided,
however, that this release shall be applicable and in force and effect only to
the extent that such release shall be lawful at that time and in any event only
with respect to loss or damage occurring during such time as the releaser's
policies shall contain a clause or endorsement to the effect that any such
release shall not adversely affect or impair said policies or prejudice the
right of the releaser to recover thereunder and then only to the extent of the
insurance proceeds payable under such policies. Landlord and Tenant each agrees
that it will request its insurance carriers to include in its policies such a
clause of endorsement. If extra cost shall be charged therefor, each party
shall advise the other thereof and of the amount of the extra cost, and the
other party, at its election, may pay the same, but shall not be obligated to
do so. If such other party fails to pay such extra costs, the release
provisions of this paragraph shall be inoperative against such other party to
the extent necessary to avoid invalidation of such releaser's insurance.

         24.      NO ESTATE IN LAND. This contract shall create the
relationship of Landlord and Tenant between the parties hereto; no estate shall
pass out of Landlord. Tenant has only a usufruct, not subject to levy and sale,
and not assignable by Tenant except by Landlord's consent.

         25.      INDEMNITY. Excepting for the willful acts or negligence of
Landlord, its agents and employees, Tenant indemnifies and shall hold Landlord,
its agents and employees, harmless from



                                    - 17 -
<PAGE>   18

and defend Landlord, its agents, officers, directors, partners, attorneys and
employees, against any and all claims or liability for injury or death to any
person or damage to any property whatsoever:

                  (a)      either (i) occurring in, on, or about the Premises;
or (ii) occurring in, on, or about any facilities (including, without
limitation, elevators, stairways, passageways or hallways) the use of which
Tenant may have in conjunction with other occupants of the Building, when such
injury, death or damage shall be caused in part or in whole by the act, neglect
or fault of, or omission of any duty with respect to the same by Tenant, its
agents, employees, contractors, invitees, licensees, tenants, or assignees; or

                  (b)      arising from any work or thing whatsoever done by or
benefiting the Tenant in or about the Premises or from transactions of the
Tenant concerning the Premises; or

                  (c)      arising from any breach or default on the part of
the Tenant in the performance of any covenant or agreement on the part of the
Tenant to be performed pursuant to the terms of this Lease; or

                  (d)      otherwise arising from any act or neglect of the
Tenant, or any of its agents, employees, contractors, invitees, licensees,
tenants or assignees; and from and against all costs, expenses, counsel fees,
and court costs incurred or assessed in connection with any or all of the
foregoing. Furthermore, in case any action or proceeding be brought against
Landlord by reason of any claims or liability, Tenant agrees to cause such
action or proceeding to be defended at Tenant's sole expense by counsel
reasonably satisfactory to Landlord. The provisions of this Lease with respect
to any claims or liability occurring or caused prior to any expiration or
termination of this Lease shall survive such expiration or termination.

         Tenant shall give immediate notice to Landlord in case of casualty or
accidents in the Premises. The provisions of this paragraph shall survive the
expiration or sooner termination of this Lease.

         Except for the willful acts or negligence of Tenant, its agents,
contractors, employees, invitees, licensees, visitors, and customers, Landlord
hereby indemnifies and shall hold Tenant harmless from and defend Tenant
against any and all claims or liability for injury or death to any person or
damage to any property whatsoever arising from any breach or default on the
part of Landlord in the performance of any covenant or agreement on the part of
Landlord to be performed pursuant to the terms of this Lease.

         26.      LIABILITY OF LANDLORD. Subject to the provisions of Special
Stipulations 18 and 19, Landlord shall not be liable to Tenant or to any
persons, firm, corporation, or other business association claiming by, through,
or under Tenant for failure to furnish or for delay in furnishing any service
provided for in this Lease, and no such failure or delay by Landlord shall be
an actual or constructive eviction of Tenant nor shall any such failure or
delay operate to relieve Tenant from the prompt and punctual performance of
each and all the covenants to be performed herein by Tenant; nor for water
discharged from sprinkler systems, if any, or from water pipes and plumbing
facilities in the Building; nor for the theft, mysterious disappearance, or
loss of any property of



                                    - 18 -
<PAGE>   19

Tenant whether from the Premises or any part of the Building; and nor from
interference, disturbance, or acts to or omitted against Tenant by third
parties, including, without limitation other occupants of the Building and any
such occurrences shall not constitute an actual or constructive eviction of
Tenant.

         27.      LIMITATION OF LIABILITY. Landlord's obligations and liability
with respect to this Lease shall be limited solely to Landlord's interest in
the Building any insurance proceeds received by Landlord in connection
therewith to the extent not yet applied by Landlord, as such interest is
constituted from time to time, and neither Landlord nor any officer, director,
shareholder, or partner of Landlord, or of any partner of Landlord, shall have
any personal liability whatsoever with respect to this Lease. In no event shall
Landlord be liable to Tenant nor shall any interest of Landlord in the Building
be subject to execution by Tenant, for any indirect, special or consequential
damages.

         28.      NO WAIVER OF RIGHTS. No failure or delay of Landlord to
exercise any right or power given it herein or to insist upon strict compliance
by Tenant of any obligation imposed on it herein and no custom or practice of
either party hereto at variance with any term hereof shall constitute a waiver
or a modification of the terms hereof by Landlord or any right it has herein to
demand strict compliance with the terms hereof by Tenant. No person has or
shall have any authority to waive any provision of this Lease unless such
waiver is expressly made in writing and signed by Landlord.

         29.      ENTIRE AGREEMENT AND EXHIBITS. This Lease constitutes and
contains the sole and entire agreement of Landlord and Tenant and no prior or
contemporaneous oral or written representation or agreement between the parties
and affecting the Premises shall have legal effect. The content of each and
every exhibit which is referenced in this Lease as being attached hereto is
incorporated into this Lease as fully as if set forth in the body of this
Lease.

         30.      NOTICES. All notices required or desired to be given with
respect to this Lease shall, in order to be effective, be in writing and shall
be effectively given or delivered if hand delivered to the addresses for
Landlord and Tenant specified hereinbelow, or if deposited, postage prepaid, to
the United States mail, certified, return receipt requested, properly addressed
to the addresses specified hereinbelow, or if delivered by Federal Express or
other overnight commercial courier to the addresses for Landlord and Tenant
hereinbelow. Any notice mailed or sent by overnight commercial courier shall be
deemed to have been given upon receipt or refusal thereof. Notice effected by
hand delivery shall be deemed to have been given at the time of actual
delivery. In the event of a change of address by either party, such party shall
give written notice thereof to the other party in accordance with the
foregoing. Additionally, Tenant agrees to send copies of all notices required
or permitted to be given to Landlord to each lessor under any ground or land
lease covering all or any part of the Land and each holder of a mortgage or
deed to secure debt encumbering the Building and/or the Land that notifies
Tenant in writing of its interest in the address to which notices are to be
sent.



                                    - 19 -
<PAGE>   20
         If to Tenant                    INTERNET SECURITY SYSTEMS, INC.
         (prior to Commencement Date):   6600 Peachtree-Dunwoody Road, N.E.
                                         300 Embassy Row, Fifth Floor
                                         Atlanta, Georgia 30328
                                         Attention: Mr. Richard Macchia

         If to Tenant
         (after Commencement Date):      INTERNET SECURITY SYSTEMS, INC.
                                         6303 Barfield Road
                                         Suite 100
                                         Atlanta, Georgia 30328
                                         Attn: Mr. Richard Macchia

         If to Landlord:                 MOUNT VERNON PLACE PARTNERS, L.L.C.
                                         c/o Griffin Management Services, Inc.
                                         800 Mount Vernon Highway, Suite 300
                                         Atlanta, Georgia 30328
                                         Attn: Mr. Joel J. Griffin

         The foregoing addresses may be changed by thirty (30) days written
notice from time to time.

         Tenant hereby appoints as his agent to receive the service of all
dispossessory or distraint proceedings and notices thereunder, and all notices
required under this Lease, the person in charge of or occupying the Premises at
the time; and if no person is in charge of or occupying same, then such service
or notice may be made by attaching the same on the main entrance to the
Premises. To the extent permitted by law, Tenant hereby submits to the
jurisdiction of any state or federal court located in Fulton County, Georgia,
as well as to the jurisdiction of all courts from which an appeal may be taken
from the aforesaid courts for the purpose of any suit, action or other
proceeding arising out of Tenant's obligations under or with respect to this
Lease and Tenant hereby expressly waives any and all objections that Tenant may
have as to jurisdiction and/or venue in any of such courts.

         31.      SUCCESSORS AND ASSIGNS. The covenants, conditions and
agreements herein contained shall inure to the benefit of and be binding upon
Landlord, its successors and assigns, and shall be binding upon Tenant, its
heirs, executors, administrators, successors and assigns, and shall inure to
the benefit of Tenant. Nothing contained in this Lease shall in any manner
restrict Landlord's right to assign or encumber this Lease in its sole
discretion. Should Landlord assign this Lease as provided for above, Tenant
shall be bound to said conditions of this Lease for the balance of the Term
hereof remaining after such succession, and Tenant shall attorn to such
succeeding party as its landlord under this Lease promptly under any such
successions. Tenant agrees that should any party so succeeding to the interest
of Landlord require a separate agreement of attornment regarding the matters
covered by this Lease, then Tenant shall enter into any such "attornment
agreement," provided the same does not modify any of the provisions of this
Lease and has no adverse effect upon Tenant's continued occupancy of the
Premises.



                                    - 20 -
<PAGE>   21

         32.      SUBORDINATION. Landlord will obtain within thirty (30) days
from the date of this Lease from its lender financing the acquisition of the
Land, as this term is defined in Special Stipulation 1, and the construction of
the Building in connection therewith, a subordination, non-disturbance and
attornment agreement between Landlord, such lender, and Tenant. Tenant agrees
that this Lease shall, subject to obtaining the aforesaid subordination,
non-disturbance attornment agreement be and remain subject and subordinate to
all present and future mortgages, deeds to secure debt or other security
instruments (the "Security Deeds") affecting the Premises provided that such
future lenders will not disturb Tenant as long as Tenant remains in full
compliance with all terms and conditions of this Lease. Tenant shall promptly
execute and deliver to Landlord such certificate or certificates in writing as
Landlord may request, confirming the subordinate nature of the Lease to such
Security Deeds.

         33.      ESTOPPEL CERTIFICATE. Tenant shall, within ten (10) days
after request from Landlord, at any time and from time to time execute,
acknowledge and deliver to Landlord a written statement certifying as follows:
(a) that this Lease is unmodified and in full force and effect (or if there has
been modification thereof, that the same is in full force and effect as
modified and stating the nature thereof); (b) that to the best of its knowledge
there are no uncured defaults on the part of Landlord (or if any such default
exists, the specific nature and extent thereof); and (c) the date to which any
rents and other charges have been paid in advance, if any; and (d) such other
matters as Landlord may reasonably request.

         34.      TIME IS OF THE ESSENCE. Time is of the essence with the
respect to the performance of each of the covenants and agreements of this
Lease; provided, however, that failure of Landlord to provide Tenant with any
notification regarding adjustments in Base Monthly Rental, or any other charges
provided for hereunder, within the time periods prescribed in this Lease shall
not relieve Tenant of its obligation to make such payments, which payments
shall be made by Tenant at such time as notice is subsequently given. Unless
specifically provided otherwise, all references to terms of days or months
shall be construed as references to calendar days or calendar months,
respectively.

         35.      CAPTIONS; GOVERNING LAW. The captions of this Lease are for
convenience of reference only and in no way define, limit or describe the scope
or intent of this Lease. The laws of the State of Georgia shall govern the
validity, performance and enforcement of this Lease.

         36.      DEFINITIONS. "Landlord" as used in this Lease shall include
his heirs, representatives, assigns and successors in title to Premises.
"Tenant" shall include its heirs and representatives, and if this Lease shall
be validly assigned or sublet, shall include also Tenant's assignees or
sublessees, as to premises covered by such assignment or sublease. "Broker" and
"Co-Broker" shall include its successors, assigns, heirs, and representatives.
"Landlord," "Tenant," "Broker" and "Co-Broker," shall include male and female,
singular and plural, corporation, partnership or individual, as may fit the
particular parties.

         37.      SEVERABILITY. If any clause or provision of this Lease is or
becomes illegal, invalid, or unenforceable because of present or future laws or
any rule or regulation of any



                                    - 21 -
<PAGE>   22

governmental body or entity, effective during its term, the intention of the
parties hereto is that the remaining parts of this Lease shall not be affected
thereby, unless such invalidity is, in the sole determination of Landlord,
essential to the rights of both parties in which event Landlord has the right
to terminate this Lease on written notice to Tenant.

         38.      LAWS AND REGULATIONS; BUILDING RULES AND REGULATIONS. Subject
to the provisions of Special Stipulation 11, Tenant shall comply with, and
Tenant shall cause its agents, contractors, customers, employees, invitees,
licensees, servants and visitors to comply with (i) all applicable laws,
ordinances, orders, directions, requirements, rules and regulations (state,
federal, municipal and other agencies or bodies having any jurisdiction
thereof) now in force or which may hereafter be in force, which shall impose
any duty upon Landlord or Tenant relating to the use, condition or occupancy of
the Premises or the conduct of Tenant's business therein, including, without
limitation, the Americans With Disabilities Act of 1990 (as now or hereafter
amended); and (ii) the Building Rules and Regulations set forth in Exhibit "F,"
as such Rules and Regulations are modified and supplemented by Landlord from
time to time, and such other rules and regulations as are reasonably adopted by
Landlord from time to time, for the safety, care or cleanliness of the Premises
and the Building, or for preservation of good order therein, all of which will
be sent by Landlord to Tenant in writing and shall be thereafter carried out
and observed by Tenant, its agents, contractors, customers, employees,
invitees, licensees, servants and visitors. Tenant hereby expressly waives the
benefit of all existing and future rent control laws and similar governmental
rules and regulations, whether in time of war or not, to the full extent
permitted by law.

         39.      SPECIAL STIPULATIONS. The Special Stipulations attached
hereto are hereby incorporated herein and made a part hereof. In the event the
Special Stipulations conflict with any of the foregoing provisions of this
Lease, the Special Stipulations shall control.

         40.      BROKER COMMISSION. Tenant represents and warrants to Landlord
that, other than Insignia/ESG, Inc. ("Broker"), no broker, agent, commissioned
salesperson or other person has represented Tenant in the negotiations for and
procurement of this Lease, and that no commissions, fees or compensation of any
kind are due in connection herewith to any broker, agent, commissioned
salesperson or other person, other than Broker, which has acted as broker for
Tenant in this transaction. Landlord shall pay Broker a real estate commission
in connection with this transaction pursuant to the terms of a separate written
Commission Agreement between Landlord and Broker. Landlord has disclosed that
The Griffin Company ("Co-Broker") is acting on behalf of Landlord in this
transaction and is receiving a commission pursuant to the terms of a separate
written Commission Agreement.

         41.      REMOVAL OF PERSONAL PROPERTY. Tenant may (if not in default
hereunder) prior to the expiration of this Lease, or any extension thereof,
remove all unattached and movable personal property and equipment which Tenant
has placed in the Premises, provided Tenant repairs all damages to Premises
caused by such removal. All personal property of Tenant remaining on the
Premises after the end of the Term shall be deemed conclusively abandoned,
notwithstanding that title to or a security interest in such personal property
may be held by an individual or entity other than Tenant, and Landlord may
dispose of such personal property in any manner it deems proper, in



                                    - 22 -
<PAGE>   23

its sole discretion. Tenant hereby waives and releases any claim against
Landlord arising out of the removal or disposition of such personal property.
Tenant shall reimburse Landlord for the cost of removing such personal
property.

         42.      SIGNAGE. Subject to applicable laws, regulations, and
ordinances, Tenant, at Tenant's sole cost and expense (but with Tenant allowed
to use a portion of the Tenant Improvement Allowance as set forth in the Work
Letter attached as Exhibit "D") and subject to Landlord's prior written
approval as to the exact location and as to the plans and specifications for
such signage, shall be entitled to install signage including Tenant's corporate
name and logo on each Building and the parking deck together with a monument
sign adjacent to each Building and the walls of elevator lobbies of the
Building and on entrance doors to the Building on any full floors of the
Building leased by Tenant. The location of such signage together with all plans
and specifications for such signage shall be provided by Tenant to Landlord
subject to Landlord's prior written approval not to be unreasonably withheld by
Landlord. Subject to the foregoing, Tenant shall not place any other signs,
decals, or other materials upon the windows or suite doors of the Premises nor
on the exterior walls of Premises. Any additional signage other than as
provided for under this Section 42 desired by Tenant shall be approved, in
writing, by Landlord and the management company of the Building, which shall be
granted in their sole discretion.

         43.      EFFECT OF TERMINATION OF LEASE. No termination of this Lease
prior to the normal ending thereof, by lapse of time or otherwise, shall affect
Landlord's right to collect rent for the period prior to termination thereof.

         44.      RIGHTS CUMULATIVE. All rights, powers and privileges
conferred hereunder upon parties hereto shall be cumulative but not restrictive
to those given by law.

         45.      FORCE MAJEURE. In the event of strike, lockout, labor
trouble, civil commotion, act of God, or any other cause (hereinafter
collectively referred to as "Force Majeure") outside and beyond Landlord's
control, resulting in the impairment of Landlord's ability to perform any
obligation or provide any service hereunder, this Lease shall not terminate,
and Tenant's obligation to pay Base Monthly Rental, additional rental and all
other charges and sums due payable by Tenant shall not be altered or excused
and Landlord shall not be considered to be in default under this Lease or
liable in damages to Tenant in any manner.

         46.      TENANT CORPORATION, PARTNERSHIP OR INDIVIDUAL. If Tenant
executes this Lease as a corporation, each of the persons executing this Lease
on behalf of Tenant does hereby covenant, warrant and represent that Tenant is
a duly organized and validly existing corporation, that Tenant has and is
qualified to do business in Georgia, that the corporation has full right and
authority to enter into this Lease, and that each and all persons signing on
behalf of the corporation were authorized to so do. Upon Landlord's request,
Tenant shall provide Landlord with evidence reasonably satisfactory to Landlord
confirming the foregoing covenants and warranties. If Tenant executes this
Lease as a partnership, Tenant does hereby covenant, warrant and represent that
all the persons who are general or managing



                                    - 23 -
<PAGE>   24

partners in said partnership have executed this Lease on behalf of Tenant, or
that this Lease has been executed and delivered pursuant to and in conformity
with a valid and effective authorization therefor, by all of the general or
managing partners of such partnership, and is and constitutes the valid and
binding agreement of the partnership and each and every partner therein in
accordance with its terms. Also, it is agreed that each and every present and
future partner of Tenant shall be and shall remain at all times jointly and
severally liable hereunder, and that the death, resignation, or withdrawal of
any partner shall not release the liability of such partner under the terms of
this Lease unless and until Landlord consents in writing to such release. If
Tenant executes this Lease as an individual, Tenant does hereby covenant,
warrant and represent that his legal residence address is that set forth below
his signature on this Lease. If more than one individual or entity comprises
and constitutes Tenant, then all individuals and entities comprising Tenant are
and shall each be jointly and severally liable for the due and proper
performance of Tenant's covenants, duties and obligations arising under or in
connection with this Lease.

         47.      SUBMISSION OF LEASE. The submission of this Lease for
examination does not constitute an offer to lease nor a reservation of space
even if said lease is executed by Landlord, and this Lease shall be effective
only upon execution hereof by Landlord and Tenant.

         48.      NO RECORDATION OF LEASE. This Lease is not in recordable
form, and Tenant agrees not to record or permit the recording of this Lease or
other evidence thereof except that Tenant shall be entitled to record a
memorandum of this Lease, previously approved in writing by Landlord, which
memorandum shall provide that this Lease is subject to present and future
lenders as set forth in Section 32 of this Lease and subject to the terms and
conditions of Section 32 of this Lease.

         49.      HAZARDOUS SUBSTANCES. Tenant hereby covenants and agrees that
Tenant shall not cause or knowingly permit any "Hazardous Substances" (as
hereinafter defined) to be generated, placed, held, stored, used, located or
disposed of at the Building or any part thereof, except for Hazardous
Substances as are commonly and legally used or stored as a consequence of using
the Demised Premises for general office and administrative purposes, but only
so long as the quantities thereof do not pose a threat to public health or to
the environment or would necessitate a "response action", as that term is
defined in CERCLA (as hereinafter defined), and so long as Tenant strictly
complies or causes compliance with all applicable governmental rules and
regulations concerning the use or production of such Hazardous Substances. For
purposes of this paragraph, "Hazardous Substances" shall mean and include those
elements or compounds which are contained in the list of Hazardous Substances
adopted by the United States Environmental Protection Agency (EPA) or the list
of toxic pollutants designated by Congress or the EPA which are defined as
hazardous, toxic, pollutant, infectious or radioactive by any other federal,
state or local statute, law, ordinance, code, rule, regulation, order or decree
regulating, relating to or imposing liability (including, without limitation,
strict liability) or standards of conduct concerning, any hazardous, toxic or
dangerous waste, substance or material, as now or at any time hereinafter in
effect (collectively "Environmental Laws"). Tenant hereby agrees to indemnify
Landlord and hold Landlord harmless from and against any and all losses,
liabilities, including strict liability, damages, injuries, expenses, including
reasonable attorneys' fees, costs of settlement or judgment and claims of any
and every kind whatsoever paid, incurred or suffered by, or asserted against,
Landlord by any person, entity or governmental agency for, with respect to, or
as a direct or indirect result of, the presence in, or the escape, leakage,
spillage, discharge,



                                    - 24 -
<PAGE>   25

emission or release from, the Demised Premises of any Hazardous Substances
(including, without limitation, any losses, liabilities, including strict
liability, damages, injuries, expenses, including reasonable attorneys' fees,
costs of any settlement or judgment or claims asserted or arising under the
Comprehensive Environmental Response, Compensation and Liability Act
["CERCLA"], any so-called federal, state or local "Superfund" or "Superlien"
laws or any other Environmental Law); provided, however, that the foregoing
indemnity is limited to matters arising solely from Tenant's violation of the
covenant contained in this Article. The obligations of Tenant under this
Article shall survive any expiration or termination of this Lease. SEE SPECIAL
STIPULATION 12.

         50.      EXECUTION. This Lease may be executed in any number of
counterparts, each of which shall be deemed an original and any of which shall
be deemed to be complete in itself and may be introduced into evidence or used
for any purpose without the production of the other counterparts. No
modification or amendment of this Lease shall be binding upon the parties
hereto unless such modification or amendment is in writing and signed by
Landlord and Tenant.

         51.      LANDLORD AND TENANT RELATIONSHIP. The relationship between
Landlord and Tenant shall be solely that of landlord and tenant only, and no
provision of this Lease including, without limitation, the provisions of
Special Stipulation 8 of this Lease, shall be deemed or construed by the
parties hereto, or by any third party, as creating the relationship of
principal and agent, or of partnership, or of joint venture, between the
parties hereto, and accordingly, without limiting the generality of the
foregoing provisions, Tenant shall have no authority to bind or enter into any
agreements on behalf of Landlord whatsoever.

         52.      AUTHORITY. As a material inducement to Landlord to enter into
this Lease, Tenant, acknowledging that Landlord may rely on each such
representation and warranty, represent and warrant to Landlord that:

         (a)      the execution, delivery and full performance of this Lease by
                  Tenant do not and shall not constitute a violation of any
                  contract, agreement, undertaking, judgment, statute,
                  regulation, governmental or court order or other restriction
                  of any kind to which Tenant is or may be bound;

         (b)      Tenant has executed and entered into this Lease free from
                  fraud, undue influence, duress, coercion or other defenses to
                  the execution of this Lease;

         (c)      Tenant is duly organized, validly existing and in good
                  standing under the laws of the state of Georgia and has full
                  power and authority to enter into this Lease, to perform
                  Tenant's obligations under this Lease in accordance with the
                  terms hereof, and to transact business in the State of
                  Georgia; and

         (d)      the execution and delivery of this Lease by the individual or
                  individuals executing this Lease on behalf of Tenant, and
                  Tenant's performance of its obligations under this Lease,
                  have been duly authorized and approved by all necessary
                  corporate or partnership action, as the case may be, and
                  Tenant's execution, delivery and



                                    - 25 -
<PAGE>   26

                  performance of this Lease are not in conflict with Tenant's
                  bylaws or articles of incorporation, or other charters,
                  agreements, rules or regulations governing Tenant's business,
                  as any of the foregoing may have been supplemented, modified,
                  amended, or altered in any manner.

         IN WITNESS WHEREOF, the parties hereto have set their hands and seals
hereunder and have caused this Lease to be executed in their names and their
corporate seals to be affixed by their officers duly authorized thereunto, upon
the day and year set forth above.


                                          TENANT:


Signed, sealed and delivered              INTERNET SECURITY SYSTEMS, INC.,
in the presence of:                       a Georgia corporation



                                          By:
- -------------------------------------        ----------------------------------
Notary Public or Witness



                                          Name:
- -------------------------------------          --------------------------------
Name (Please Print)                                   (Please Print)

                                          Title:
                                                -------------------------------


                                          Attest:
                                                -------------------------------

                                          Name:
                                               --------------------------------
                                                      (Please Print)

                                          Title:
                                                -------------------------------
                                                      [CORPORATE SEAL]


                                          LANDLORD:

Signed, sealed and delivered              MOUNT VERNON PLACE PARTNERS,
in the presence of:                       L.L.C., A GEORGIA LIMITED LIABILITY
                                          COMPANY



                                          By
- -------------------------------------        ----------------------------------
Notary Public or Witness                     JOEL J. GRIFFIN
                                             MANAGING MEMBER


- -------------------------------------
Name        (Please Print)



                                    - 26 -
<PAGE>   27
                               MOUNT VERNON PLACE

                              SPECIAL STIPULATIONS


1.       Notwithstanding any provision of this Lease to the contrary,
         Landlord's obligations under this Lease are contingent upon Landlord's
         acquisition of the Land by December 31, 1999 and in the event Landlord
         has not acquired the Land by December 31, 1999, then Landlord shall be
         entitled to terminate this Lease by written notice to Tenant in which
         event neither party shall have any further liability or obligation
         hereunder to the other. Alternatively, Landlord may extend the
         contingency date for Landlord's acquisition of the Land from December
         31, 1999, as described above, to January 31, 2000, and if Landlord
         elects to extend such date, then in the event Landlord has not then
         acquired the Land by January 31, 2000, then Landlord or Tenant shall
         then be entitled to terminate this Lease by written notice to the
         other in which event neither party shall have any further liability or
         obligation hereunder to the other. Upon the execution of this Lease,
         Landlord has paid to Tenant a payment of $25.00 as an option payment
         from Landlord to Tenant thereby making this Lease a mutually binding
         option agreement notwithstanding that this Lease is not binding upon
         Landlord unless and until the contingency set forth above in this
         Special Stipulation 1 with regarding Landlord's acquisition of the
         Land is removed. Tenant hereby acknowledges the receipt and
         sufficiency of such $25.00 option payment from Landlord to Tenant.

2.       Within the thirty (30) days of the date of this Lease, Landlord shall
         apply for any and all necessary permits and approvals so as to allow
         for Landlord's construction of two (2) bridges connecting the Phase I
         Building and the Phase II Building, and Landlord shall diligently
         pursue any and all such required permits and approvals (collectively
         "Approvals"). In the event the Approvals are obtained, then Landlord
         shall construct such bridges connecting the Phase I and Phase II
         Buildings, but in the event Landlord is unable to obtain such
         Approvals, then Landlord shall not be obligated to construct such
         bridges nor shall Landlord be deemed to be in breach or default under
         this Lease; provided, however, Landlord shall construct a covered walk
         way between the Phase I building and the Phase II building pursuant to
         plans and specifications mutually acceptable to Landlord and Tenant.
         In the event such bridges are not constructed, then the rentable
         square feet of the Building shall be adjusted accordingly.

3.       Landlord shall construct the Building substantially in accordance with
         the following plans and specifications: those certain project manuals
         and drawings styled "Mount Vernon Place Office Building, Atlanta,
         Georgia, November 4, 1999, Project Manuals & Drawings" as further
         enumerated in Exhibit "A-1" attached hereto and made a part hereof by
         reference. Any modifications by Landlord to the construction of the
         Building as determined by Landlord shall remain substantially in
         accordance with such plans and specifications provided that Landlord
         shall notify Tenant when any such modifications are made by Landlord
         to such plans and specifications. Landlord's general construction of
         the Building shall be comparable in quality to the following facility:
         Perimeter Place Office Building located at 800 Mount Vernon Highway.
<PAGE>   28

4.       Notwithstanding any provision of this Lease to the contrary, the Term
         of this Lease shall be for eleven (11) years and six (6) months
         commencing on the Commencement Date which shall be the date the
         construction of the Tenant Improvements is completed pursuant to the
         Work Letter (the "Work Letter") attached hereto as Exhibit "D" and
         made a part hereof by reference and a certificate of occupancy is
         issued by Fulton County. The target Commencement Date of November 1,
         2000 would result in an expiration date of the Term on April 31, 2012.
         However, in the event of Tenant Delay, as this term is defined under
         Section 6 of the Work Letter, the Commencement Date shall be the date
         construction of the Tenant Improvements would have been completed
         pursuant to the Work Letter and a certificate of occupancy would have
         been issued by Fulton County had not such Tenant Delay occurred. The
         method for determining the rental Commencement Date set forth in this
         Special Stipulation 4 shall apply to each and every respective phase
         of the staged occupancy of the Premises described below in Special
         Stipulation 5.

5.       The following represents the parties' agreement regarding staged
         occupancy of the Premises and the payment of rental in connection
         therewith: On the first initial Commencement Date (with an initial
         target Commencement Date of November 1, 2000), as determined pursuant
         to Special Stipulation 4 above, Tenant shall occupy and begin paying
         rental for all five (5) floors of the Phase I Building (consisting of
         115,500 rentable square feet). Similarly, on the second target
         Commencement Date of February 1, 2001, with the actual second
         Commencement Date being determined as set forth above in Special
         Stipulation 4, Tenant shall begin paying rental for two (2) floors of
         the Phase II Building together with the two (2) bridges constructed by
         Landlord pursuant to Special Stipulation 2 above consisting of a total
         of 53,800 rentable square fee (46,200 square feet for such two (2)
         floors of the Phase II Building and 7,600 rentable square feet for
         such two (2) bridges). Similarly, on the third target Commencement
         Date of August 1, 2001, with the actual third Commencement Date being
         determined pursuant to Special Stipulation 4 above, Tenant shall begin
         paying rental for an additional floor of the Phase II Building
         consisting of 23,100 rentable square feet. Similarly, on the fourth
         target Commencement Date of February 1, 2002, with the actual fourth
         Commencement Date being determined pursuant to Special Stipulation 4
         above, Tenant shall begin paying rental for an additional floor of the
         Phase II Building consisting of 23,100 rentable square feet. Finally,
         upon the fifth target Commencement Date of August 1, 2002, with the
         actual fifth Commencement Date being determined pursuant to Special
         Stipulation 4 above, Tenant shall begin paying rental for the last
         floor of the Phase II Building consisting of 23,100 rental square
         feet. Landlord and Tenant shall agree within sixty (60) days of the
         date of this Lease as to the exact sequences of floors in the Phase II
         Building to be occupied by Tenant on the respective second through
         fifth target Commencement Dates of February 1, 2001, August 1, 2001,
         February 1, 2002, and August 1, 2002 as set forth above in this
         Special Stipulation 5, and when Landlord and Tenant reach such
         agreement within such sixty (60) day period, an amendment to this
         Lease shall be executed reflecting such agreement by the parties. The
         schedule of Tenant's rental obligations for the staged occupancy of
         the Premises as set forth in this Special Stipulation 5 is set forth
         in Special Stipulation 17 below subject to the assumptions and terms
         and conditions set forth in Special Stipulation 17 below. Tenant shall
         occupy the respective
<PAGE>   29

         portions of the Premises at the respective Commencement Dates as
         determined pursuant to Special Stipulation 4 and Special Stipulation 5
         of this Lease.

6.       Tenant shall not be liable for any increase of, or reassessment in,
         real property taxes and assessments resulting from a sale, transfer,
         reapportionment of proprietary interest, or any other change in
         ownership of the Building or site during the Term or from major
         alterations, improvements, modifications, or renovations to the
         Building or site. However, subject only to the restrictions set forth
         in the preceding sentence, Tenant shall remain fully liable for real
         property taxes and assessments to the extent set forth in Section 8
         and Exhibit "E" of the Lease and otherwise.

7.       If used by Tenant to pay for the Tenant Costs, as such term is defined
         under Section 3.02 of the Work Letter attached hereto as Exhibit "D",
         up to $2.50 per rentable square foot of the Premises over and above
         the total $24.00 per rentable square foot Tenant Improvement
         Allowance, as this term is defined in Section 3.01 of the Work Letter,
         may be amortized as set forth herein and added as additional rental
         (over and above the amounts of the first sixty (60) monthly
         installments of Base Monthly Rental) with such amortization to be at
         an interest rate of ten percent (10%) per annum over the first five
         (5) years of the Term of this Lease, to the extent such extra amounts
         are used by Tenant to pay for the Tenant Costs. To the extent the
         total $24.00 per rentable square foot Tenant Improvement Allowance is
         not used in full ("Savings"), then Tenant may use such Savings for
         relocation expenses, wiring expenses, telecommunication expenses and
         for similar items and/or for moving expenses and/or for the permitted
         purposes set forth in Section 3.01 of the Work Letter and/or Tenant
         may elect to have Landlord apply up to $2.50 per rentable square foot
         of the Premises of such Savings (but not in excess of up to $2.50 per
         rentable square foot of the Premises of such Savings) as a credit
         toward Tenant's initial rental obligations under this Lease.

8.       Subject to the terms, conditions and agreements set forth in this
         Special Stipulation 8, Landlord shall pay to Tenant a portion of the
         net cash flow (for purposes of this Special Stipulation 8, the term
         "net cash flow" shall be defined as Landlord's actual cash flow from
         Landlord's operation of the Building (after the Preferred Return, as
         this term is defined below, has been paid in full to each of
         Landlord's members) less Landlord's payment of expenses in connection
         with Landlord's operation of the Building and less Landlord's
         maintenance of reserves in connection with Landlord's operation of the
         Building subject to the limitation that any loans from Landlord's
         members to Landlord shall not bear interest at a rate in excess of the
         Preferred Return) otherwise payable to Landlord's members from the
         operation of the Building, which payments by Landlord to Tenant, the
         parties agree, shall constitute an expense of Landlord in the
         operation of the Building (but which shall not constitute an Operating
         Expense as set forth in Exhibit "E" and other applicable provisions of
         this Lease) upon the following terms and conditions: Unless otherwise
         approved by Tenant, Landlord's permanent financing for the Building
         shall contain an amortization based upon a period of not less than
         twenty-five (25) years. Landlord shall be entitled to determine the
         payment of all operating expenses and the maintenance of all reserves
         in connection with Landlord's operation of the Building. Each of
         Landlord's members has contributed and/or will from time to time
         contribute cash and/or other equivalent value
<PAGE>   30

         associated with each such member's investment in its membership
         interests in Landlord and otherwise as set forth in the operating
         agreement of Landlord and the books and records of Landlord maintained
         in connection therewith (hereinafter the respective contributions by
         each of Landlord's members are referred to respectively as "Cash
         Invested"). For purposes of this Special Stipulation 8, the respective
         amounts of the Cash Invested for each such member of Landlord shall
         not be decreased in any respect whatsoever and shall be deemed to be
         entitled to a twelve percent (12%) per annum preferred interest return
         ("Preferred Return") as further set forth in this Special Stipulation
         8 and shall not be diminished by depreciation, return of capital, or
         any other accounting event which might otherwise be deemed to decrease
         the amount of Cash Invested or the capital account of any such member;
         rather, the aggregate Cash Invested, as the same may be increased from
         time to time, shall in no event ever be diminished for purposes of
         this Special Stipulation 8. Each member of Landlord shall be entitled
         to the Preferred Return on each such member's Cash Invested from and
         after the respective times of each increment of such Cash Invested by
         such member, and after each such member has received such member's
         total current Preferred Return on any and all Cash Invested, then
         subject to Landlord's payment of expenses in connection with the
         Building and the maintenance of normal reserves, as determined by
         Landlord, the remaining net cash flow shall on an annual basis within
         sixty (60) days from the expiration of each calendar year, or more
         frequently if net cash flow is distributed to the members of Landlord
         more frequently, be divided as follows: Landlord shall pay as an
         expense of Landlord in its operation of the Building to Tenant thirty
         percent (30%) of such net cash flow with the remaining seventy percent
         (70%) of such net cash flow to be distributed to Landlord's members
         contemporaneous with the payment of such thirty percent (30%) of net
         cash flow to Tenant. Such payment of thirty percent (30%) of net cash
         flow from Landlord to Tenant shall continue only for the first eight
         and one-half (8 1/2) years of the term of this Lease and shall not
         continue thereafter. In the event the Building is sold or refinanced
         during such eight and one-half (8 1/2) years initial term of this
         Lease, but not thereafter, then after the Preferred Return is paid to
         Landlord's members, Tenant shall be entitled to receive as an expense
         payment from Landlord to Tenant thirty percent (30%) of the remaining
         net proceeds from any such sale or refinancing with the remaining 70%
         to be distributed to Landlord's members. At any and all times during
         all terms of this Lease, Landlord shall be entitled to determine the
         financing of Landlord (both temporary and permanent) in connection
         with its acquisition, construction, and operation of the Building
         subject only to the restriction that permanent financing shall be
         based on an amortization period of not less than twenty-five (25)
         years as set forth above in this Special Stipulation 8, and further,
         Landlord shall determine expenses to be paid in connection with the
         operation of the Building, reserves to be maintained in connection
         therewith, and the terms of any such sale or refinancing. In no event
         shall Tenant be entitled to any payment of net cash flow or net
         proceeds from any sale or refinancing or any other payment under this
         Special Stipulation 8 after the first eight and one-half (8 1/2) years
         of the initial term of this Lease (the "Tenant Participation Period").
         Further, following any sale of the Building from the initial landlord,
         Mount Vernon Place Partners, L.L.C. to a successor during the Tenant
         Participation Period, provided that Tenant is paid thirty percent
         (30%) of the remaining net proceeds from such sale as described above
         in this Special Stipulation 8, then Tenant shall not be entitled to
         receive any further payments from any successor landlord,
<PAGE>   31

         and the provisions of this Special Stipulation 8 shall accordingly,
         only be binding upon the initial landlord Mount Vernon Place Partners,
         L.L.C. during the Tenant Participation Period. Notwithstanding the
         preceding sentence, in the event the term of this Lease is extended
         past eleven and one-half (11 1/2) years by a mutually acceptable
         written extension agreement between Landlord and Tenant which is
         executed and entered into during such Tenant Participation Period,
         then the Tenant Participation Period shall also be extended by the
         same period as the extension term set forth in any such written
         extension agreement; provided, however, that in all events, Tenant's
         rights to receive the portion of net cash flow from operations and net
         proceeds from any sale or refinancing, as set forth above in this
         Special Stipulation 8, shall cease upon the date when three (3) years
         are left on the term of this Lease. Accordingly, in no event shall
         Tenant be entitled to any portion of net cash flow or net proceeds
         from any sale or refinancing during the last three (3) years of the
         Term of this Lease, and accordingly, the Tenant Participation Period
         shall not be extended by any holdover by Tenant either pursuant to
         Section 12 of this Lease or otherwise. However, in the event Tenant
         extends the Term of this Lease pursuant to Special Stipulation 13
         below regarding Tenant's renewal of the Term of this Lease, then the
         Tenant Participation Period shall be extended in the manner set forth
         above, and if Tenant's rights to receive thirty percent (30%) of net
         cash flow as set forth above have lapsed, then such rights shall be
         revived by such extension of the Tenant Participation Period except
         that all lapsed payments due from Landlord to Tenant associated with
         such extension shall be paid by Landlord to Tenant as an expense in
         Landlord's operation of the Building (but which shall not constitute
         an Operating Expense as set forth in Exhibit "E" and other applicable
         provisions of this Lease) in the current year when such lapsed rights
         to receive payments are revived by such extension. Except as set forth
         in the preceding sentence, the Tenant Participation Period shall not
         be extended for any other reason except only as set forth above in
         this Special Stipulation 8.

9.       Landlord agrees to provide Tenant in increments up to the aggregate
         amount of $700,000.00 to be utilized by Tenant to offset or buyout of
         Tenant's existing rental obligation for approximately 90,000 square
         feet at Embassy Row. Such amounts shall be payable by Landlord to
         Tenant to the extent of and at the respective times Tenant incurs
         offset or buyout obligations with respect to Tenant's office space at
         Embassy Row as indicated by the following illustrative examples: In
         the event Tenant buys out of its existing rental obligation at Embassy
         Row, then the payments from Landlord to Tenant pursuant to this
         Special Stipulation 9 shall be on or about the same time or times as
         Tenant's respective payments obligations under such buyout and
         similarly, in the event Tenant sublets its office space at Embassy
         Row, then for the incremental difference between the amount received
         by Tenant pursuant to such sublease and the amount due from Tenant to
         the landlord at Embassy Row, then Landlord shall pay the amounts of
         such incremental differences to Tenant pursuant to this Special
         Stipulation 9 on or about the respective times of Tenant's obligations
         for such incremental difference to its landlord at Embassy Row. To the
         extent such $700,000.00 amount set forth above in this Special
         Stipulation 9 is not utilized in full by Tenant pursuant to this
         Special Stipulation 9, then up to, but not in excess of, $350,000.00
         of such unutilized amount will be applied by Landlord as a credit
         against Tenant's rental obligations under this Lease.
<PAGE>   32

10.      On or before November 19, 1999 (with the form of the letter of credit
         to be provided for Landlord's review and approval by November 10,
         1999), Tenant shall deliver to Landlord an irrevocable standby letter
         of credit as security for Tenant's performance under this Lease and to
         compensate Landlord for Landlord's expenses incurred (said letter of
         credit and each letter of credit substituted therefor as hereinafter
         provided, being hereinafter referred to as the "Letter of Credit")
         issued in form and substance and by an issuing banking institution
         acceptable to Landlord containing the following terms and conditions:

         (i)      the Letter of Credit shall provide for multiple draws;

         (ii)     Landlord or Landlord's successor-in-title to the Premises
                  shall be the beneficiary under the Letter of Credit;

         (iii)    draws under the Letter of Credit shall be honored by the
                  issuing lending institution upon presentation by an
                  authorized representative of Landlord accompanied by (a)
                  Landlord's sight draft, (b) a certification by Landlord that
                  Tenant has defaulted under this Lease and, as a result of
                  such default, Landlord is entitled to present the Letter of
                  Credit for payment, and (c) a certification by Landlord that
                  Landlord is entitled to payment of the sums set forth as
                  rental due under this Lease, together with a certificate as
                  to additional sums representing itemized costs and expenses
                  incurred by Landlord as a result of the default by Tenant
                  under this Lease and otherwise;

         (iv)     the term of the Letter of Credit shall be one (1) year from
                  the date of issuance thereof; and

         (v)      in the event the Letter of Credit has not been replaced by
                  Tenant with a substitute Letter of Credit in the amount set
                  forth below by five (5) business days prior to the expiring
                  date thereof, Landlord shall be entitled to present the
                  Letter of Credit for payment of the entire remaining
                  undisbursed balance thereof, accompanied solely by Landlord's
                  sight draft.

         The first Letter of Credit shall be in the face amount of Ten Million
         and No/100 Dollars ($10,000,000.00); each successive Letter of Credit
         shall be in the face amount of One Million and No/100 Dollars
         ($1,000,000.00) less than the Letter of Credit replaced by such
         successive Letter of Credit, until the amount of the next successive
         Letter of Credit is $0.00 at which time Landlord shall return the
         issued and outstanding Letter of Credit and Tenant shall have no
         further obligation to cause the issuance of additional Letters of
         Credit.
<PAGE>   33

11.      Landlord warrants that the Building, Premises and all common areas
         will meet building codes in Fulton County at the Commencement Date and
         that the Premises will be in compliance with the Americans With
         Disabilities Act (42 U.S.C.ss. 12101 et. seq.). Landlord warrants that
         the offices, rooms, buildings, structures, and adjacently owned
         property, including all parking lots, walkways, entrances, hallways
         and other public spaces, elevators, and other devices or pathways for
         ingress and egress to the leased property that might be used by
         customers, clients, invitees of Tenant and the general public, conform
         to the requirements of the Americans with Disabilities Act and all
         regulations issued by the U.S. Attorney General or other authorized
         agencies under the authorization of the American with Disabilities
         Act. The Landlord promises to reimburse and indemnify and defend the
         Tenant for any expenses incurred because of the failure of the leased
         Premises and adjacently owned property to conform with the above cited
         law and regulations, including the costs of making any alterations,
         renovations, or accommodations required by the Americans with
         Disabilities Act, or any governmental enforcement agency, or any
         court, any and all fines, civil penalties, and damages awarded against
         the Tenant resulting from a violation or violations of the above-cited
         law and regulations, and all reasonable legal expenses incurred in
         defending claims made under the above-cited law and regulations,
         including reasonable attorneys' fees.

         Consistent with the foregoing, in addition, Tenant shall, at Tenant's
         sole expense but subject to Landlord's prior written approval, make
         each and every alteration or addition to the interior, non-structural
         portion of the Leased Premises required to bring the interior,
         non-structural portion of the Leased Premises into compliance with the
         requirements imposed by the Americans With Disabilities Act, (42
         U.S.C. ss. 12101 et. seq.) and any regulations promulgated pursuant
         thereto (collectively such Act and regulations are referred to as "ADA
         Requirements") effective from time to time during the Term if (a) the
         requirement for such alteration or addition arises as a result of (i)
         any alteration or addition by Tenant; or (ii) any violation by Tenant
         of any ADA Requirements; or (iii) a special use of the Leased Premises
         or any part thereof by Tenant or any assignee or subtenant of Tenant
         (including, but not limited to, use for a facility which constitutes,
         or, if open to the public generally, would constitute, a "place of
         public accommodation" under the ADA Requirements); or (iv) the special
         needs of the employee(s) of Tenant or any assignee or subtenant of
         Tenant; or (b) the ADA Requirements would otherwise make Tenant,
         rather than Landlord, primarily responsible for making such alteration
         or addition.

12.      Landlord represents that there is no asbestos or Hazardous Substances
         in, on or about the Building, including the Premises and the Land.
         Excepting for the willful act or negligence or violations of
         Environmental Laws by Tenant, or its agents, employees, contractors,
         customers, invitees, licensees, or visitors, Landlord indemnifies and
         shall hold Tenant harmless from and defend Tenant against any and all
         claims or liability solely resulting from a breach of the foregoing
         representation in the preceding sentence.
<PAGE>   34

13.      Landlord agrees to grant to Tenant, but not any sublessee, the right
         to renew this Lease on the same conditions and terms contained herein,
         except as hereafter provided, for three 5-year renewal terms, provided
         Tenant is not in default under this Lease at the time of Tenant's
         exercise of said right or at the commencement of each renewal term.
         Tenant shall give written notice to Landlord of Tenant's intent to
         negotiate of said right twelve (12) months prior to the Lease
         expiration or said right to renew shall expire.

         If Tenant exercises the right to renew, the annual base rent for each
         renewal term shall be equal to 95% of the then "current effective
         market rate" for comparable space in low rise Class "A" office
         buildings in the North Central/I 285 and North Fulton/Georgia 400
         office submarkets of metropolitan Atlanta, Georgia, taking into
         account "free rent," tenant finish allowances, types and amount of
         parking, and other financial concessions as are typically given to
         tenants for such comparable space at the time of renewal.

         Within thirty (30) days of receipt of notice of Tenant's exercise of
         the right to renew, Landlord shall provide Tenant written notice of
         Landlord's proposal of the "current effective market rate." Should
         Tenant agree with Landlord's proposal, then Tenant shall within thirty
         (30) days execute an amendment renewing this Lease. In the event
         Tenant finds such proposal to be unsatisfactory, Tenant shall notify
         Landlord, in writing, within fifteen (15) days of receipt of
         Landlord's proposal and such notice shall contain Tenant's proposal
         for the "current effective market rate". Should Landlord agree with
         Tenant's proposal, then Tenant shall within thirty (30) days execute
         an amendment renewing this Lease. In the event Landlord finds Tenant's
         proposal unsatisfactory, Landlord shall so notify Tenant, in writing,
         within five (5) business days of the receipt of Tenant's proposal and
         in such event, Landlord and Tenant agree to negotiate in good faith in
         an attempt to agree upon the "current effective market rate."

         If Tenant and Landlord are unable to agree on the amount of the
         "current effective market rate" within an additional thirty (30) days
         after notification by Landlord that Tenant's proposal is
         unsatisfactory then at Tenant's option, such amount shall be
         determined by arbitration as described below, or the option to renew
         will expire.

         Landlord and Tenant shall agree to each choose an arbitrator to choose
         a third party arbitrator to determine the "current effective market
         rate". Upon such third party arbitrator determining the "current
         effective market rate", Landlord and Tenant shall renew the Lease by
         immediately executing an amendment renewing this Lease at such rate
         determined by the third party arbitrator. Such third party arbitrator
         shall determine the "current effective market rate" within thirty (30)
         days of being chosen. The third party arbitrator shall have at least
         ten (10) years' business experience in independent appraisal in
         commercial real estate transactions in the metropolitan Atlanta,
         Georgia area. Landlord and Tenant agree that each party shall pay for
         the costs incurred by the arbitrator it selects, and that the costs of
         the third party arbitrator will be divided equally between Landlord
         and Tenant.
<PAGE>   35

14.      During the Term and any renewals of this Lease, Landlord shall provide
         Tenant exclusive use a total of 785 parking spaces in the parking deck
         adjacent to the Building, at no charge for such primary term and any
         renewals. All such spaces, subject to the remaining terms and
         conditions of this Lease, will be available twenty-four (24) hours per
         day, seven (7) days per week, every day of the year. Additionally, by
         the Commencement Date, Landlord agrees to restripe and refurbish that
         certain additional parking lot (the "Additional Lot") consisting of
         surface parking available at the Sanbury Building located at 6405
         Barfield Road, Fulton County, Georgia, and as of the Commencement
         Date, Tenant shall have the nonexclusive use of the parking from and
         out of such Additional Lot. It is also possible that Landlord may
         construct a third building upon the Land. Tenant acknowledges and
         agrees that in all events Landlord shall be fully entitled to
         construct such third building, and that if Landlord so elects to
         construct such third building, then any such construction by Landlord
         may be upon the Additional Lot, and accordingly, during the time of
         such construction and at all times thereafter, Tenant shall lose its
         right of parking use of the Additional Lot set forth in this Special
         Stipulation 14. Tenant agrees that Landlord shall not be deemed to be
         in breach or default of any provision of this Lease whatsoever if
         Landlord elects to construct the third building and Tenant accordingly
         loses its right to use such Additional Lot. Additionally, at any time
         during the first five (5) years of the Term of this Lease, Tenant
         shall have the right to notify Landlord in writing that Tenant
         requests forty-seven (47) additional parking spaces in addition to the
         seven hundred eighty-five (785) parking spaces described above, and if
         Tenant so notifies Landlord, Landlord shall provide such forty-seven
         (47) additional parking spaces to Tenant from and out of newly
         constructed parking by Landlord, which construction shall be at
         Landlord's cost but which construction shall not constitute an
         Operating Expense under Exhibit "E" and other applicable provisions of
         this Lease.

15.      Landlord hereby acknowledges and agrees that Tenant shall have the
         right to install and operate satellite dishes (not to exceed one meter
         in diameter) for service to the Premises at a location on the roof and
         in a first-class manner acceptable to Landlord (hereinafter referred
         to as the "dish space") during the term of this Lease and any
         extension thereof.

         Tenant hereby agrees to install any such satellite dish on the dish
         space in a good and workmanlike manner, maintain and repair such
         satellite dish and dish space in proper condition and to secure all
         permits required for the installation and operation thereof, at no
         cost to Landlord, and hereby indemnifies Landlord from and against any
         claims against Landlord for personal injury, property damage or other
         damage, including reasonable attorney's fees, arising from the
         installation, use, operation, maintenance, repair and removal of the
         dish space, the satellite dish, or any cables or related equipment
         thereof. The provisions of this paragraph shall survive the expiration
         date or sooner termination of this Lease. The insurance required to be
         carried by Tenant under the Lease shall also apply to the satellite
         dish and dish space.

         Landlord understands and agrees that the satellite dish and related
         equipment is considered the personal property of Tenant, and that
         Tenant has the right to remove the same at any time during the Term,
         or during any renewals or extensions thereafter.
<PAGE>   36

         Accordingly, Tenant shall remove the satellite dish and restore the
         dish space to substantially the same condition as existed prior to the
         installation of the satellite dish, reasonable wear and tear excepted.

         All direct expenses incurred by Tenant in connection with the
         installation, operation or removal of the satellite dish shall be paid
         promptly by Tenant, and Tenant shall not permit any mechanic's or
         other lien to be filed against Landlord in connection with the
         installation, operation or removal of the satellite dish. Tenant shall
         provide Landlord with an executed contractor's lien waiver within
         thirty (30) days of completion of the work. Tenant shall be
         responsible for any and all utilities to be used in connection with
         the operation of the satellite dish should Landlord determine an
         additional charge is necessary for its operation.

         Tenant shall properly and promptly repair any damage or potentially
         damaging condition existing or caused by the existence or operation
         and use of the satellite dish or connecting cables or any part thereof
         within ten (10) days after receipt of Landlord's written notice;
         provided, however, if such repair cannot reasonably be cured within
         the said ten-day period, and Tenant shall, in good faith, commence to
         repair and diligently proceed to effect such repair, then the ten-day
         period shall be extended for such reasonable period as Tenant shall
         require to effect such repair. Should Tenant fail to satisfy the terms
         of this provision within said ten-day period, Landlord may repair the
         damaged condition at Tenant's cost.

         Tenant represents and warrants to Landlord that the specifications,
         location and contemplated use of the satellite dish comply with all
         laws, ordinances, codes and regulations promulgated by any
         governmental authority having jurisdiction over the Premises or the
         installation and operation of the satellite dish. The construction and
         installation shall be accomplished in a good and workmanlike manner
         and with no disruption to the other occupants of the Building. Tenant
         shall provide Landlord, prior to installation of the satellite dish,
         detailed drawings and specifications on the mounting method to be used
         in affixing the proposed dish to the roof. Tenant shall require all
         contractors and subcontractors to provide Landlord with certificates
         of insurance with Landlord being named as Additional Loss Payee prior
         to installation.

16.      The scheduled rental payments from Tenant to Landlord with respect to
         the Base Monthly Rental due under Section 5 of the Lease taking into
         account the staged occupancy of the Premises as described in Special
         Stipulation 5 above are as set forth in the illustrative chart below:

         For purposes of calculating the Base Monthly Rental under Section 5 of
         the Lease, the monthly rental shall be calculated based upon an annual
         rental rate (the "Base Rental Rate") of $21.05 per rentable square
         foot of the Premises, as the rentable square footage of the Premises
         shall increase pursuant to Special Stipulation 5 above. Base Monthly
         Rental shall also increase as a result of increases in Net Rental as
         described under Section 6 of the Lease. Accordingly, the parties'
         agreement with respect to Tenant's rental
<PAGE>   37

         obligations to Landlord are set forth in Sections 5, 6 and 8 of the
         Lease and as set forth in Special Stipulations 4 and 5 above with
         respect to the staged occupancy of the Premises. The following
         illustrative chart of Tenant's rental obligations to Landlord for the
         first three (3) years of the Term of this Lease assumes that (i)
         Tenant's initial occupancy and staged occupancy of the respective
         portions of the Premises occurs on all of the target Commencement
         Dates of November 1, 2000, February 1, 2001, August 1, 2001, February
         1, 2002, and August 1, 2002 as set forth in Special Stipulation 4,
         Special Stipulation 5 and other applicable provisions of this Lease
         and that (ii) the bridges are constructed by Landlord pursuant to
         Special Stipulation 2 and that (iii) Operating Expenses for the first
         twelve (12) months of the term of the Lease are $4.87 per square foot
         of the Premises and that the annual increase in Net Rental which
         results under Section 6 of this Lease is two and one-half percent (2
         1/2%) per year for each and every year and that (iv) any payment
         obligations from Tenant to Landlord pursuant to Section 8 of the Lease
         and other applicable provisions resulting from increased Operating
         Expenses above those of the Operating Expense Base Year of calendar
         year 2001 are invoiced by Landlord to Tenant separately from and over
         and above the rental expenses set forth in the illustrative chart
         below and are therefore due in addition to those rental expenses set
         forth in the chart below, and accordingly, assuming that all of the
         foregoing assumptions in (i) through (iv) inclusive above apply,
         Tenant's Base Monthly Rental obligations for the period from November
         1, 2000 through October 31, 2003 would be as follows:

<TABLE>
<CAPTION>
- -------------------------------------------------------------------------------
MONTH                RENTABLE SQUARE    BASE RENTAL            AMOUNT OF BASE
                     FOOTAGE OF         RATE                   MONTHLY RENTAL
                     PREMISES                                  SUBJECT TO
                                                               ASSUMPTIONS SET
                                                               FORTH ABOVE
- -------------------------------------------------------------------------------
<S>                  <C>                <C>                    <C>
November, 2000       115,500            $  21.05               $202,606.25
- -------------------------------------------------------------------------------
December, 2000       115,500            $  21.05               $202,606.25
- -------------------------------------------------------------------------------
January, 2001        115,500            $  21.05               $202,606.25
- -------------------------------------------------------------------------------
February, 2001 *     169,300            $  21.05               $296,980.42
- -------------------------------------------------------------------------------
March, 2001          169,300            $  21.05               $296,980.42
- -------------------------------------------------------------------------------
April, 2001          169,300            $  21.05               $296,980.42
- -------------------------------------------------------------------------------
May, 2001            169,300            $  21.05               $296,980.42
- -------------------------------------------------------------------------------
June, 2001           169,300            $  21.05               $296,980.42
- -------------------------------------------------------------------------------
July, 2001           169,300            $  21.05               $296,980.42
- -------------------------------------------------------------------------------
August, 2001*        192,400            $  21.05               $337,501.67
- -------------------------------------------------------------------------------
September, 2001      192,400            $  21.05               $337,501.67
- -------------------------------------------------------------------------------
October, 2001        192,400            $  21.05               $337,501.67
- -------------------------------------------------------------------------------
November, 2001       192,400            $21.4545**             $343,987.15
- -------------------------------------------------------------------------------
December, 2001       192,400            $21.4545               $343,987.15
- -------------------------------------------------------------------------------
January, 2002        192,400            $21.4545               $343,987.15
- -------------------------------------------------------------------------------
February, 2002*      215,500            $21.4545               $385,287.06
- -------------------------------------------------------------------------------
March, 2002          215,500            $21.4545               $385,287.06
- -------------------------------------------------------------------------------
April, 2002          215,500            $21.4545               $385,287.06
- -------------------------------------------------------------------------------
May, 2002            215,500            $21.4545               $385,287.06
- -------------------------------------------------------------------------------
June, 2002           215,500            $21.4545               $385,287.06
- -------------------------------------------------------------------------------
</TABLE>

<PAGE>   38

<TABLE>
<S>                  <C>                <C>                    <C>
July, 2002           215,500            $21.4545               $385,287.06
- -------------------------------------------------------------------------------
August, 2002*        238,600            $21.4545               $426,586.98
- -------------------------------------------------------------------------------
September, 2002      238,600            $21.4545               $426,586.98
- -------------------------------------------------------------------------------
October, 2002        238,600            $21.4545               $426,586.98
- -------------------------------------------------------------------------------
November, 2002       238,600            $21.8691**             $434,830.85
- -------------------------------------------------------------------------------
December, 2002       238,600            $21.8691               $434,830.85
- -------------------------------------------------------------------------------
January, 2003        238,600            $21.8691               $434,830.85
- -------------------------------------------------------------------------------
February, 2003       238,600            $21.8691               $434,830.85
- -------------------------------------------------------------------------------
March, 2003          238,600            $21.8691               $434,830.85
- -------------------------------------------------------------------------------
April, 2003          238,600            $21.8691               $434,830.85
- -------------------------------------------------------------------------------
May, 2003            238,600            $21.8691               $434,830.85
- -------------------------------------------------------------------------------
June, 2003           238,600            $21.8691               $434,830.85
- -------------------------------------------------------------------------------
July, 2003           238,600            $21.8691               $434,830.85
- -------------------------------------------------------------------------------
August, 2003         238,600            $21.8691               $434,830.85
- -------------------------------------------------------------------------------
September, 2003      238,600            $21.8691               $434,830.85
- -------------------------------------------------------------------------------
October, 2003        238,600            $21.8691               $434,830.85
- -------------------------------------------------------------------------------
</TABLE>

         *  Rentable square footage of Premises increases as per target
Commencement Dates of staged occupancy

         ** Base Rental Rate increases as a result of annual 2 1/2% assumed
increase in Net Rental

         For the remaining months of the Term of this Lease from November, 2003
         through April, 2012, subject to the above assumptions, Net Rental
         shall continue to increase as set forth in Section 6 of this Lease (as
         of November of each applicable year if the initial target date of
         November 1, 2000 is met) resulting in increases in the Base Rental
         Rate and the Base Monthly Rental in connection therewith calculated in
         the manner set forth under Section 6 of the Lease.

         Additionally, at any time any rental rate changes as a result of any
         provision of this Lease, then Tenant agrees to execute an amendment to
         this Lease setting forth the revised rental rates as a result of such
         changes if requested to do so by Landlord provided, however, that any
         such amendment shall not change any other substantive provision of
         this Lease.

17.      Notwithstanding the provisions of Special Stipulation 8, Special
         Stipulation 9, or any other provisions of this Lease, Tenant shall not
         be entitled to receive any payments from Landlord during any period
         that Tenant is in default under this Lease, and accordingly, any such
         payment due from Landlord to Tenant pursuant to Special Stipulation 8,
         Special Stipulation 9, or any other provisions of this Lease may be
         held by Landlord and at Landlord's election applied so as to cure any
         such default by Tenant.

18.      Landlord shall not be relieved of liability pursuant to Section 26 of
         the Lease to the extent such liability results from Landlord's
         negligence or willful act.
<PAGE>   39

19.      If Landlord fails to maintain any portion of the Building which
         Landlord is expressly required to maintain in accordance with the
         terms of this Lease or if Landlord fails to provide any services to
         the Premises which Landlord is expressly required to provide in
         accordance with the terms of this Lease, and (i) as a result of such
         failure, Tenant's use and enjoyment of the Premises is interfered with
         in a material manner, and (ii) Landlord fails to commence to cure such
         failure within three (3) days after written notice from Tenant of such
         failure (specifying in such notice the nature of the failure), and
         thereafter fails to proceed with due diligence to cure such failure
         until completion, then Tenant shall have the right to perform such
         maintenance work on the Premises subject to the terms and limitations
         of this Special Stipulation 19. If Tenant is entitled and elects to
         perform any maintenance as aforesaid, Tenant shall (i) perform such
         maintenance work in a reasonable manner; (ii) utilize only contractors
         or other such vendors with a first class reputation; (iii) cause such
         work to be completed promptly and on a lien free basis; (iv) cause
         such work to be completed in compliance with all applicable laws,
         ordinances, regulations and rules; and (v) utilize the same or similar
         materials as replaced. Tenant shall not be entitled to alter the
         Building structure under any circumstance. Landlord shall reimburse
         Tenant, within thirty (30) days after receipt of copies of the
         invoices or other written evidence, reasonably satisfactory to
         Landlord in Landlord's reasonable judgment, of the costs incurred by
         Tenant for which Tenant claims reimbursement for the reasonable costs
         and expenses incurred by Tenant in curing Landlord's breach as
         aforesaid. In addition, in the event Landlord fails to commence to
         cure such failure within the three (3) day written notice period
         provided for above, then Landlord shall pay to Tenant $5,000.00 per
         day for each of the first five (5) days and $13,000.00 per day
         thereafter until Landlord commences to cure such failure (or if Tenant
         validly elects to cure such failure itself subject to the terms and
         conditions set forth above in this Special Stipulation 19, then the
         $5,000.00 per day payment for each of the first five (5) days and
         $13,000.00 per day thereafter shall continue until Tenant commences to
         effect such cure). Tenant agrees that the remedies in favor of Tenant
         under this Special Stipulation 19 and the payments from Landlord to
         Tenant as set forth in this Special Stipulation 19 shall constitute
         Tenant's sole remedies for any breach of the Lease by Landlord
         described or contemplated under this Special Stipulation 19. Landlord
         shall pay to Tenant the payments called for by Landlord under this
         Special Stipulation 19 within thirty (30) days from the time Landlord
         is obligated to pay such payments to Tenant.

20.      As a part of the construction of the initial Tenant Improvements
         pursuant to the Work Letter, Tenant shall present a proposal to
         Landlord within thirty (30) days from the date of this Lease as to the
         location, size, specifications and other pertinent information
         regarding emergency generators that Tenant desires Landlord to install
         as a part of the initial Tenant Improvements and, subject to
         Landlord's written approval (not to be unreasonably withheld by
         Landlord) of the location, size, specifications and other pertinent
         information regarding such emergency generators, such emergency
         generators shall be installed by Landlord at Tenant's cost as a part
         of the initial Tenant Improvements to the Premises.

21.      Notwithstanding the provisions of Rule and Regulation No. 1, Rule and
         Regulation No. 18, or any other provision of this Lease to the
         contrary, Tenant shall be responsible for all
<PAGE>   40

         security for the Premises and Building, and Landlord shall not be
         responsible for providing any such security services.

22.      Landlord shall construct the Building such that seven and one-half
         (7 1/2) watts live load of power per square foot of Tenant office space
         will be available at the buss duct on each floor of the Building.

23.      At all times during the Term of this Lease, Tenant shall be entitled
         to use any and all common areas of the Building for Tenant's purposes
         consistent with the requirements of this Lease. In addition, Tenant
         shall have exclusive use of the Building and those areas of the Land
         which are crosshatched on Exhibit "H" attached hereto and made a part
         hereof by reference.

24.      Subject to the approval of applicable utilities providers, Landlord
         shall construct the Phase I Building and the Phase II Building such
         that power and fiber optic feeds are available at the north and south
         corners of the Phase I Building and the Phase II Building.

25.      In the event any of the following occur: (i) Landlord has not begun
         construction of the footings for the Phase I Building by June 5, 2000;
         (ii) Landlord has not begun construction of the structure of the Phase
         I Building by July 17, 2000; (iii) Landlord has not begun construction
         of the precast for the Phase I Building by October 2, 2000; (iv)
         Landlord has not begun construction of the tenant finish for the Phase
         I Building by December 4, 2000; or (v) the initial Commencement Date
         for the Phase I Building has not occurred by March 1, 2001
         (hereinafter any of such events are referred to as a "Material Delay")
         then as a result of such Material Delay, Tenant shall have a
         termination right subject to the terms and conditions of this Special
         Stipulation 26 provided, however, that Tenant shall have no such
         termination right if Material Delay has occurred if any of the
         following have caused such Material Delay: (i) Force Majuere, as this
         term is defined in Section 45 of this Lease; or (ii) Tenant Delay, as
         this term is defined in Section 2.01(b) of the Work Letter; or (iii)
         if Material Delay has occurred solely because Fulton County or any
         other applicable municipality, agency or jurisdiction has delayed in
         its issuance of the certificate of occupancy or any other required
         approvals for the Premises, and in the event Material Delay has
         occurred and such Material Delay is not due to either (i), (ii), or
         (iii) above, and Tenant desires to exercise such termination right,
         then prior to the exercise of such termination right, Tenant shall
         first provide Landlord thirty (30) days prior written notice and right
         to cure such breach by Landlord, and Landlord shall cure such breach
         within such thirty (30) day period, or longer if such breach by its
         nature requires longer to cure provided that Landlord promptly
         commences such cure within such thirty (30) day period and thereafter
         diligently pursues cure until completion, and in the event Landlord
         continues to breach and cause Material Delay beyond the applicable
         notice and cure period set forth in this Special Stipulation 25, then
         Tenant shall be entitled to terminate this Lease by written notice to
         Landlord in which event neither party shall have any further rights or
         obligations under this Lease, but Tenant shall have no claim for
         damages whatsoever against Landlord and Landlord shall not be liable
         to Tenant for any such damages in connection with such termination by
         Tenant.
<PAGE>   41

         Notwithstanding the preceding paragraph, in the event the initial
         Commencement Date for the Phase I Building has not occurred by July 1,
         2001, then unless such initial Commencement Date has not occurred due
         to Tenant Delay, Tenant shall have the termination right set forth in
         this Special Stipulation 25 subject to the notice and cure provisions
         and the remaining provisions set forth in this Special Stipulation 25
         (except that the termination right described in this second paragraph
         of this Special Stipulation 25 shall accrue in favor of Tenant even if
         the delay described in this second paragraph of this Special
         Stipulation 25 is attributable either to Force Majuere or to the
         failure of any governmental entity to issue any certificate of
         occupancy or other required approval).

26.      [Reserved.]

27.      Within thirty (30) days from the expiration of each calendar year
         during the term of this Lease, Tenant shall provide to Landlord
         audited annual financial statements of ISS Group, Inc., a Delaware
         corporation, prepared in accordance with generally accepted accounting
         principles and certified in writing to Landlord by the chief financial
         officer of Tenant.

28.      In the event Landlord fails to deliver the Phase I Building on or
         before December 1, 2001, and such failure is not attributable to Force
         Majuere or Tenant Delay, then (i) notwithstanding the provisions of
         Section 3 of this Lease, the Commencement Date shall become the
         earlier of the following: (a) the date upon which Tenant commences
         conducting its business from all or any portion of the Premises; or
         (b) February 1, 2001. (Tenant shall not be obligated to occupy the
         Phase I Building prior to February 1, 2001 in the event Landlord fails
         to deliver the Phase I Building to Tenant on or before December 1,
         2000 and such failure is not attributable to Force Majuere or Tenant
         Delay), and in the event this Special Stipulation 28 is invoked such
         that this (i) is applicable, then (a) the Term of the Lease shall
         remain eleven and one-half (11 1/2) years following the newly adjusted
         Commencement Date and (b) the respective terms of the required letter
         of credit and replacement letters of credit under Special Stipulation
         10 above shall be in accordance with such newly adjusted Term and (c)
         the increases in Net Rental pursuant to Section 6 of this Lease shall
         also be in accordance with such newly adjusted Term, but (d) the
         staged occupancy schedule for the Premises set forth in Special
         Stipulation 5 shall remain as set forth in Special Stipulation 5
         without change or adjustment; and (ii) again, in the event Landlord
         fails to deliver the Phase I Building to Tenant on or before December
         1, 2000 and such failure is not attributable to Force Majuere or
         Tenant Delay, then additionally Tenant shall receive a two (2) month
         abatement in Base Monthly Rental for the months of February and March,
         2001.

29.      If Tenant occupies any other portion of the Premises other than the
         Phase I Building earlier than any of the subsequent target
         Commencement Dates set forth in Special Stipulation 5, then Tenant
         during the period of such early occupancy prior to any such subsequent
         target Commencement Date shall pay only one-half (1/2) of the rental
         with respect to the applicable portion of the Premises which Tenant
         occupies early and during the period of
<PAGE>   42

         such early occupancy only, and not thereafter, and only with respect
         to the applicable portion of such Premises which Tenant has occupied
         early.

30.      The parties acknowledge that Tenant is applying for a property tax
         abatement with respect to the Premises. Any such savings which result
         from Tenant's successfully obtaining such property tax abatement shall
         inure to Tenant's benefit thereby resulting in a reduction of the
         additional rental otherwise due under Section 8 of this Lease with
         respect to ad valorem tax increases. For purposes of calculating
         Operating Expenses for either the first year of the Term or the base
         year of 2001, Operating Expenses shall be calculated based upon a
         fully assessed and occupied Building.

31.      Notwithstanding the provisions of Section 8, Section 14, Section 17,
         or any other provision of this Lease to the contrary, the parties
         agree that Landlord may render to Tenant written estimates of amounts
         reasonably anticipated to be due from Tenant to Landlord as a result
         of Landlord's maintaining and replacing light bulbs and fixtures in
         the Premises as contemplated under Section 14 of the Lease or as a
         result of Landlord's paying utility bills on Tenant's behalf to be
         reimbursed by Tenant as contemplated under Section 17 of this Lease
         with respect to any and all months during the Term of this Lease
         (notwithstanding that Landlord shall not be entitled to render
         estimates to Tenant of additional Operating Expenses to be paid by
         Tenant until after the base year of 2001). It is acknowledged and
         agreed that such estimates may be rendered at all times from and after
         the Commencement Date, with fifteen (15) days prior notice, during the
         years 2000 and 2001 as well as the remainder of the Term of this Lease
         and any renewals thereof. To the extent as a result of such estimates
         rendered from Landlord to Tenant with respect to the applicable
         expenses under either Section 14 or Section 17 of this Lease, Tenant
         either overpays or underpays such expenses, then any such overpayment
         or underpayment shall be reconciled within one hundred twenty (120)
         days after the end of any calendar year and as otherwise provided in
         the manner set forth in the fourth (4th) paragraph of Section 8 of
         this Lease. As with all other written estimates from Landlord to
         Tenant described in either the third paragraph of Section 8 of this
         Lease or in this Special Stipulation 31, Tenant shall pay as
         additional rental to Landlord promptly on the first day of each month
         in advance without deduction or set off in legal tender the monthly
         amount called for under such estimate from Landlord to Tenant for
         those months for which additional rental is due pursuant to such
         estimates and as otherwise contemplated under this Lease.

         With respect to amounts due from Tenant to Landlord as a result of
         Landlord's maintaining and replacing light bulb and fixtures in the
         Premises as contemplated under Section 14 of the Lease, Landlord shall
         render such estimates to Tenant and Tenant shall pay such amounts in
         accordance with the terms and conditions of Section 8 and this Special
         Stipulation 31. With respect to amounts due from Tenant to Landlord as
         a result of Landlord's paying utility bills on Tenant's behalf to be
         reimbursed by Tenant as contemplated under Section 17 of this Lease,
         Landlord shall be entitled to either (i) render invoices to Tenant
         which shall be paid by Tenant within fifteen (15) days of Tenant's
         receipt of such invoice, as provided in Section 17 of this Lease; or
         (ii) render estimates and annual reconciliations to Tenant as provided
         in Section 8 and this Special Stipulation 31 of this
<PAGE>   43

         Lease. With respect to any particular utility bill due to be
         reimbursed by Tenant to Landlord, Landlord shall be entitled to chose
         from the foregoing (i) or (ii) as applicable.

32.      The parties shall negotiate in good faith in an attempt to reach
         within ninety (90) days from the date of this Lease a conceptual plan
         for Landlord's development of and Tenant's leasing from Landlord of a
         Phase III building to be located upon the Land. Neither party shall be
         obligated to enter into any such lease. Rather, the parties' only
         obligations shall be to negotiate in good faith, and in no event shall
         this Lease be deemed dependant upon the parties' entering into any
         such subsequent lease. Further, in no event shall Tenant be required
         to occupy such Phase III building sooner than twelve (12) months
         following the last actual Commencement Date with respect to Tenant's
         staged occupancy of the Premises as described under Special
         Stipulation 5.

<PAGE>   44
                               MOUNT VERNON PLACE

                       INTERNET SECURITY SYSTEMS , INC.,
                             A GEORGIA CORPORATION

                                  EXHIBIT "A"


         The Premises shall consist of the entirety of the Phase I Building and
the Phase II Building as these terms are defined in this Lease to be
constructed pursuant to the project manuals and drawings more particularly
described and enumerated in Exhibit "A-1" attached hereto and made a part
hereof by reference. It is acknowledged that no floor plan of the Premises is
attached to this Lease because Tenant is instead leasing the entirety of such
Phase I and Phase II Building according to the terms and conditions of this
Lease.


                                  EXHIBIT "A"
<PAGE>   45

                               MOUNT VERNON PLACE

                        INTERNET SECURITY SYSTEMS, INC.,
                             A GEORGIA CORPORATION

                        EXHIBIT "B" - LEGAL DESCRIPTION









                                [TO BE ATTACHED]


                                  EXHIBIT "B"
<PAGE>   46

                               MOUNT VERNON PLACE

                       INTERNET SECURITY SYSTEMS, INC.,
                             A GEORGIA CORPORATION

                   EXHIBIT "C" - TENANT ACCEPTANCE AGREEMENT

         THIS AGREEMENT is an amendment to the Lease Agreement (the "Lease")
for space in the office buildings known as MOUNT VERNON PLACE, located at 6303
Barfield Road, Atlanta, Fulton County, Georgia 30328, dated as of the ______
day of ____________, 1999, by and between MOUNT VERNON PLACE PARTNERS, LLC, as
Landlord, and Internet Security Systems _____, a _____________________________,
as Tenant.

         Pursuant to the provisions of Paragraph 3 of the Lease, Landlord and
Tenant hereby mutually agree that:

         1.       Except for those items shown on the attached "Punch List,"
which Landlord will remedy within ____________ days hereof, Landlord has fully
completed the construction work required under the terms of the Lease.

         2.       Tenant is in possession of, and has accepted the Premises.
The Premises are tenantable, the Landlord has no further obligation for
construction (except as specified above), and Tenant acknowledges that both the
Building and the Premises are satisfactory in all respects except for any
latent defects for which Landlord shall be and remain responsible. All
conditions of the Lease required of Landlord as of this date have been
fulfilled (except as specified above), and there are no defenses or setoffs
against the enforcement of the Lease by Landlord.

         3.       The Commencement Date of the Lease is hereby agreed to be the
______ day of ___________________, 2000.

         4.       The Expiration Date of the Lease is hereby agreed to be
the ______ day of ____________________, 2012.

         5.       The Premises are hereby agreed to contain _________________
rentable square feet.

         6.       The Building is hereby agreed to contain __________________
rentable square feet.

         7.       Tenant's Percentage Share is hereby agreed to be ____________
percent.

         All other terms and conditions of the Lease are hereby ratified and
acknowledged to be unchanged.


                                  EXHIBIT "C"
<PAGE>   47

         Agreed and Executed this ___________ day of __________________, 1999.


                              TENANT:

Signed, sealed and delivered  INTERNET SECURITY SYSTEMS, INC.,
this ________ day of          a Georgia corporation
____________________, 1999
in the presence of:


                              By:  (Exhibit Purposes Only - Not for Signature)
- ----------------------------     ----------------------------------------------
Notary Public/Witness


                              Name:
- ----------------------------       --------------------------------------------
Name (Please Print)                               (Please Print)
                              Title:
                                    -------------------------------------------

                              Attest:
                                     ------------------------------------------

                              Name:
                                   --------------------------------------------

                              Title:
                                    -------------------------------------------

                              LANDLORD:
                                       ----------------------------------------


Signed, sealed and delivered  MOUNT VERNON PLACE PARTNERS, LLC
this ________ day of          A GEORGIA LIMITED LIABILITY COMPANY
____________________, 1999
in the presence of:



                              By: (Exhibit Purposes Only - Not for Signature)
- ----------------------------     ----------------------------------------------
Witness                           Joel J. Griffin, Managing Member



- ----------------------------
Name (Please Print)
<PAGE>   48

                               MOUNT VERNON PLACE

                                  WORK LETTER

         WHEREAS, the undersigned Landlord and Tenant have executed, sealed and
delivered the Lease, to which this Agreement is attached, and into which this
Agreement is fully incorporated by this reference, as Exhibit "D";

         WHEREAS, said Lease provides for the leasing of office space (the
"Premises") within MOUNT VERNON PLACE located at 6303 Barfield Road, Atlanta,
Fulton County, Georgia 30328 (the "Building");

         WHEREAS, the terms "Landlord" and "Tenant," "Premises" and "Building,"
as used herein, shall have the same meanings ascribed thereto as set forth in
the Lease; and

         WHEREAS, Landlord and Tenant desire to set forth herein their
respective agreements regarding design and construction of the improvements to
the Premises.

         NOW THEREFORE, in consideration of the Premises, the execution and
delivery of the Lease by the parties hereto, the mutual covenants contained
herein, and other good and valuable consideration, the receipt and sufficiency
of which are hereby acknowledged, Landlord and Tenant, intending to be legally
bound, hereby agree as follows:

SECTION 1. TENANT IMPROVEMENTS.

Section 1.01.   Definition.

                The term "Tenant Improvements" shall mean all improvements
constructed or installed in or on the Premises in accordance with the Drawings
and Specifications, as hereinafter defined.

Section 1.02.   Base Building Condition.

                Landlord agrees that the following shall be furnished,
installed and, if appropriate, made operational as part of the Base Building at
Landlord's sole expense:

                a)  Finish interior of exterior walls, with drywall portions of
                    such interior walls taped and floated and ready for surface
                    treatment. All window glass and frames installed and ready
                    for final finishing. All exterior windows equipped with
                    Building-standard blinds;

                b)  Building standard ceiling system and tile throughout
                    elevator lobbies and other appropriate common Building
                    facilities as shown on the Base Building plans;

                c)  Broom-clean unfinished concrete floors;


                                  EXHIBIT "D"
<PAGE>   49

                d)  Building standard light fixtures throughout elevator
                    lobbies and other appropriate common Building facilities as
                    shown on the Base Building plan;

                e)  Landlord and Tenant agree that Base Building shall include
                    the men's and women's restrooms on the Premises, as shown
                    in Exhibit "A," including all bathroom and light fixtures,
                    mirrors, doors, and partitions constructed to Building
                    standard in compliance with applicable codes;

                f)  Building standard drinking fountains;

                g)  Main heating, ventilating and air conditioning (HVAC) plant
                    and equipment as shown on the Base Building plans;

                h)  Concrete columns unfinished;

                i)  Building standard ceiling grid installed in the Premises;

                j)  Sprinkler risers, main loop and sprinkler heads on the
                    floor with capacity and number of heads as required by
                    applicable laws, based on an open floor plan. Sprinkler
                    heads in areas with unfinished ceilings will be turned up
                    toward the structure;

                k)  Building stairways and exits with surrounding walls taped,
                    floated and finished and painted;

                l)  Building core with surrounding walls taped, floated and
                    ready for final finishing;

                m)  Life safety systems as required by all applicable laws as
                    shown on the Base Building Plans;

                n)  Elevator, elevator shaft doors, frames and door facings
                    prime painted and ready for final finishing;

                o)  Building standard 2 x 4 parabolic light fixtures will be
                    provided for installation by Landlord's Contractor at a
                    ratio of one (1) fixture per eighty (80) square feet; and

                p)  HVAC will be provided in all restrooms and elevator
                    lobbies. Perimeter slot diffusers and P.I.U.'s will be
                    installed on all tenant floors.

Section 1.03. Architect.

         The term "Architect" herein referred to shall be Warner, Summers,
Ditzel, Benefield, Ward & Associates, Inc., the architect for the Base Building
and the architect selected by Tenant for the design, drawings, specifications
and finish schedule for the Premises.
<PAGE>   50

SECTION 2. DRAWINGS AND SPECIFICATIONS.

Section 2.01.   Definition.

                The term "Drawings and Specifications" shall mean the final
drawings, specifications, and finish schedules for the Tenant Improvements
which shall be prepared by Tenant and approved by Landlord in accordance with
the following procedure:

                a)  As provided in Section 3.02 (b) hereof, the cost of
                    preparing the drawings, specifications, finish schedules
                    and the like shall be paid by Tenant and be a part of
                    Tenant Costs.

                b)  As soon as reasonably possible but in all events not later
                    than December 1, 1999, Tenant shall submit to Landlord for
                    Landlord's review and comments Tenant's preliminary space
                    plan for the Premises. Within thirty (30) days of
                    Landlord's receipt of Tenant's preliminary space plan for
                    the Premises, Landlord shall provide comments regarding
                    such preliminary space plan, and promptly following
                    Tenant's receipt of Landlord's comments, Tenant shall cause
                    such preliminary space plan to be revised in accordance
                    with Landlord's comments so as to cause such preliminary
                    space plan to be acceptable to Landlord. In all events,
                    Tenant shall provide a final space plan for the Premises
                    acceptable to Landlord (which shall then become the
                    "Drawings and Specifications" as defined above) not later
                    than February 1, 2000. Landlord shall within one (1) month
                    of Landlord's receipt of Tenant's final space plan for the
                    Premises acceptable to Landlord, provide an initial
                    construction estimate to Tenant. At its option, Tenant may
                    review the initial construction estimate (which shall
                    include a breakdown of the bids of the trades together with
                    all other costs to be included within Tenant's Construction
                    Costs with each such bid and cost to be set forth on a
                    "line item basis") for all or any part of the work and if
                    dissatisfied with the costs of all or any trade portion(s)
                    or other cost items of such proposal, Tenant may require
                    Landlord to solicit bids or obtain proposals from others or
                    otherwise object to such costs items as hereinafter
                    provided. If Tenant disapproves any portion of Landlord's
                    initial construction estimate, Tenant may with regard to
                    any trade bid (a) require Landlord to obtain no less than
                    three (3) subcontractor bids and Tenant shall then have the
                    right to select the chosen bid; (b) require the work to be
                    performed on a time and materials basis by such trades.
                    Tenant shall promptly provide any comments regarding
                    Landlord's initial construction estimate. Further, Tenant
                    shall promptly exercise all of its rights regarding
                    Tenant's review and approval of Landlord's construction
                    estimate, and Tenant shall in all events be responsible for
                    causing such initial construction estimate to be finally
                    approved by Tenant not later than May 1, 2000 ("Final Price
                    Approval"). Within one (1) month of Landlord's receipt of
                    Final Price Approval from Tenant, Landlord will apply for a
                    building permit for construction for the Tenant
                    Improvements for the Premises and Landlord will begin
                    construction of
<PAGE>   51

                    such Tenant Improvements no later than August 1, 2000. (THE
                    PRECEDING SCHEDULE SET FORTH IN THIS SECTION 2.01(B) IS
                    ONLY APPLICABLE TO THE PHASE I BUILDING AND LANDLORD'S
                    CONSTRUCTION OF THE TENANT IMPROVEMENTS FOR THE PHASE I
                    BUILDING. WITH RESPECT TO TENANT'S SUBSEQUENT STAGED
                    OCCUPANCY OF THE PREMISES AS SET FORTH IN SPECIAL
                    STIPULATION 5, THE PARTIES SHALL, BY A SERIES OF AMENDMENTS
                    TO THIS LEASE, AGREE UPON AND EXECUTE SUBSEQUENT
                    CONSTRUCTION SCHEDULES COMPARABLE IN FORMAT AND TIMING IN
                    RELATION TO SUCH SUBSEQUENT STAGES OF OCCUPANCY AS SET
                    FORTH ABOVE IN THIS SECTION 2.01(B). THE REMAINING
                    PROVISIONS OF THIS WORK LETTER SHALL ALSO APPLY TO EACH OF
                    SUCH OTHER CONSTRUCTION SCHEDULES ASSOCIATED WITH EACH
                    SUBSEQUENT STAGED OCCUPANCY OF THE PREMISES.)

                    As used herein throughout this Work Letter and throughout
                    the body of the Lease, the term "Tenant Delay" shall mean
                    any actual delay in causing the Premises to be ready for
                    occupancy which is due to any act or omission of Tenant,
                    its agents, contractors, or employees including, without
                    limitation, Tenant's failure to adhere to the schedule and
                    time frames and deadlines set forth above in this
                    subparagraph (b). Tenant Delay shall include, without
                    limitation: (i) delays due to changes by Tenant in or
                    additions to the Drawings and Specifications or to the work
                    and/or other plans and specifications in connection
                    therewith, (ii) delays resulting from Tenant's failure to
                    timely perform its obligations under the approved schedule
                    set forth above, including any failure to submit or
                    finalize any drawings, plans or specifications by the
                    applicable dates and/or within the applicable time periods
                    indicated in such approved schedule and including any
                    failure to timely perform any of Tenant's work required in
                    order for Landlord to obtain a certificate of occupancy for
                    the Premises, and (iii) delays because of Tenant's
                    specifications for materials or equipment (including,
                    without limitation, computer room materials) not permitting
                    timely completion under normal circumstances. For items
                    identified by Landlord to cause a delay in construction,
                    Tenant shall have the right to either (i) accept such items
                    as Tenant Delay items or (ii) substitute materials that
                    would eliminate such delay. Notwithstanding the foregoing,
                    if any materials which Landlord did not designate as Tenant
                    Delay items, because of Landlord's reasonable reliance on
                    third party representations that such materials were
                    available, should become unavailable during the course of
                    construction for reasons beyond Landlord's reasonable
                    control, such that completion of the Tenant Improvements
                    for the Premises would be delayed, then Tenant shall
                    cooperate in good faith with Landlord to use substitute
                    materials which would avoid any such delay.

                c)  Landlord shall be responsible for causing the Architect to
                    certify to Landlord and Tenant that the proposed final
                    working drawings, specifications and the like will comply
                    with all state and local zoning laws, building laws, public
                    safety, or any other ordinances applicable hereunder.
                    Landlord's approval of the Drawings and Specifications
                    shall not relieve Tenant from its obligation hereunder.

                d)  For the purpose of this Agreement, Landlord shall retain
                    and supervise, as its agent, the general contractor.
                    Landlord agrees that the general contractor retained by
<PAGE>   52

                    Landlord as Landlord's Contractor shall perform the Tenant
                    Improvements. The aggregate cost for the Tenant
                    Improvements, shall hereinafter be referred to as "Tenant
                    Improvement Costs". Upon determination of the Tenant
                    Improvement Costs, Tenant shall be deemed to have given
                    final approval to the Drawings and Specifications and
                    Landlord shall be deemed to have been authorized to
                    proceed, through Landlord's Contractor, with the work of
                    constructing and installing the Tenant Improvements in
                    accordance with the Drawings and Specifications.

SECTION 3. PAYMENT OF COSTS.

Section 3.01.   Landlord's Allowance for Tenant Costs.

                Landlord shall pay the Tenant Costs up to, but not in excess
of, an amount equal to $24.00 per rentable square foot of the Premises (the
"Landlord's Allowance for Tenant Costs" and also sometimes referred to as the
"Tenant Improvement Allowance") as and when same are due. The Landlord's
Allowance for Tenant Costs" may be used by Tenant to cover the costs of (i) its
space planning, architectural and engineering firms, together with (ii)
Tenant's signage costs, and together with (iii) the acquisition and
installation of Tenant's furniture, fixtures and equipment, but not to exceed
$2.50 per rentable square foot of the Premises for such acquisition and
installation of Tenant's furniture, fixtures and equipment.

Section 3.02.   Tenant Costs.

                The aggregate of all costs described in the following
subparagraphs (a) through (d) of this Section 3.02 are hereinafter referred to
collectively as "Tenant Costs."

                a)  The Tenant Improvement Costs;

                b)  The cost of preparing and finalizing all drawings,
                    specifications, finish schedules and the like as set forth
                    in Sections 2.01(a) through (d) above;

                c)  Fees for architects, engineers required for Tenant's space,
                    interior designers, and other professionals and design
                    specialists reasonably incurred by Landlord or Tenant in
                    connection with the Tenant Improvements; and

                d)  The cost of making any and all changes in and to the
                    Drawings and Specifications and any increased or decreased
                    costs in the Tenant Improvement Costs resulting therefrom;

                In the event the aggregate of Tenant Costs, as defined above,
exceeds Landlord's Allowance for Tenant Costs, as specified in Section 3.01
above, then Tenant shall promptly pay the excess to Landlord upon demand;
provided, however, that Tenant may amortize up to $2.50 per rentable square
foot of the Premises of such excess amount as outlined in Special Stipulation 7
of this Lease.
<PAGE>   53

Section 3.03.   Changes in Drawings and Specifications.

                Landlord, at its option, may require Tenant to pay in lump sum
to Landlord any and all increases in the Tenant Improvement Costs which result
from approved changes to the Drawings and Specifications. Any delays in
completing the Tenant Improvements which result from either changes in the
Drawings and Specifications made by Tenant or from the unavailability of
materials specified by Tenant, shall not operate to delay or extend the
Commencement Date under the Lease nor the payment of the Base Monthly Rental or
other charges due under this Lease.

Section 3.04.   Failure to Pay Tenant Costs.

                Failure by Tenant to pay Tenant Costs, in accordance with this
Section 3, will constitute a failure by Tenant to pay rent when due under the
Lease and for such failure to pay Tenant Costs, Landlord shall have all of the
remedies available to it under this Lease and at law or in equity for
nonpayment of rent.

SECTION 4. INSPECTION.

         Landlord and Tenant each reserve the right to perform periodic
inspections prior to the Commencement Date of the Tenant Improvements and
Tenant shall notify Landlord at least twenty-four (24) hours in advance of such
inspection procedures by Tenant. Tenant and the Architect shall be permitted to
visit and walk through the Premises at any time during normal business hours.

         Any defective Tenant Improvement work discovered during either
Landlord's or Tenant's inspection or work failing to conform to the Drawings
and Specifications, together with any latent defects in the initial
improvements shall be promptly corrected by Landlord's Contractor at Landlord's
sole cost.


SECTION 5. FINISH WORK IN ADDITION TO TENANT IMPROVEMENTS.

         All work in or about the Premises which is not within the scope of the
work necessary to construct and install the Tenant Improvements, such as
delivering and installing furniture, telephone equipment, and wiring, and
office equipment, shall be furnished and installed by Tenant entirely at
Tenant's expense. Tenant shall be entitled to begin installing its wiring sixty
(60) days prior to completion of the Tenant Improvements. Tenant shall adopt a
schedule for performing such additional work consistent with the schedule of
Landlord's Contractor and shall see that such work is conducted in such a
manner as to maintain harmonious labor relations and as not to interfere
unreasonably with or to delay the work of constructing or installing the Tenant
Improvements. Landlord shall give access and entry to the Premises to Tenant
and its contract parties performing such additional work and reasonable
opportunity and time to enable Tenant and such contract parties to perform and
complete such work provided such additional work does not interfere with or
otherwise encumber Landlord's work or construction progress. All of such
additional work and Tenant's use (and the use by its contract parties) of the
Premises for such purposes shall be entirely in accordance with the Lease,
including without limitation this Work Letter.
<PAGE>   54

SECTION 6. TIME IS OF THE ESSENCE.

         Time is of the essence of this Agreement. Unless specifically provided
otherwise, all reference to days or months shall be construed as references to
calendar days or months, respectively. In the event of Tenant Delay, then the
date for completion by Landlord of Tenant Improvements shall be extended for
the period of such delay, but the Commencement Date of Tenant's payment
obligations hereunder, including, without limitation, Base Monthly Rental,
shall not be extended and shall commence as scheduled under this Lease without
regard to non-completion of Tenant Improvements.

SECTION 7. APPROVAL OF PLANS.

         Any approval by Landlord of or consent by Landlord to any plans,
specifications or other items to be submitted to and/or reviewed by Landlord
pursuant to this Lease shall be deemed to be strictly limited to an
acknowledgment of approval or consent by Landlord thereto and, whether or not
the work is performed by Landlord or by Tenant's contractor, such approval or
consent shall not constitute the assumption by Landlord of any responsibility
for the accuracy, sufficiency or feasibility of any plans, specifications or
other such items and shall not imply any acknowledgment, representation or
warranty by Landlord that the design is safe, feasible, structurally sound or
will comply with any legal or governmental requirements, and Tenant shall be
responsible for all of the same.
<PAGE>   55

                               MOUNT VERNON PLACE

                        OPERATING EXPENSES - DEFINITIONS

"Operating Expenses" for or attributable to the Premises shall mean the
operating costs and expenses for the Property and the Building, including all
expenses, costs and disbursements of every kind and nature, which Landlord
shall (i) pay and/or; (ii) become obligated to pay, including, but not limited
to, the following:

      -     Wages and salaries of all employees engaged in the operation and
            maintenance of the Property and Building, including, but not
            limited to, taxes, insurance and benefits relating thereto;

      -     All supplies and materials used in the operation and maintenance of
            the Property and Building;

      -     Cost of all service agreements and maintenance for the Property and
            Building and the equipment therein, including, but not limited to,
            trash removal, alarm services, window cleaning, janitorial service,
            HVAC maintenance, elevator maintenance and grounds maintenance;

      -     Cost of all insurance relating to the Property and Building,
            including, but not limited to, the cost of casualty and liability
            insurance applicable to the Property and Building and Landlord's
            personal property used in connection therewith;

      -     All taxes (ad valorem and otherwise), assessments and governmental
            charges, whether federal, state, county or municipal, and whether
            by taxing districts or authorities presently taxing the Property
            and Building, or by others, subsequently created or otherwise, and
            any other taxes (other than federal and state income taxes) and
            assessments attributable to the Property and Building or its
            operation and any reasonable consultants' fees incurred with
            respect to issues or concerns involving the taxes of the Building,
            the Property, or both;

      -     Cost of repairs and general maintenance of the interior and
            exterior of the Property and Building (including, but not limited
            to, glass breakage), parking areas and landscaping;

      -     A management fee for general operation and management of the
            Property and Building, such management fee to be no greater than
            three percent (3%) of Base Monthly Rental net of electricity for
            the Term of this Lease; and

      -     An amortization cost due to any capital expenditures incurred (i)
            which reduce or limit Operating Costs of the Property and Building,
            if such reduction or limitation


                                  EXHIBIT "E"
<PAGE>   56

OPERATING EXPENSE EXCLUSIONS - CONTINUED

            inures to Tenant's benefit (but only to the extent and in the
            amount that such Operating Costs of the Property and Building are
            reduced); (ii) which may be required by governmental authority or
            by Landlord's insurance carrier; or (iii) which are designed to
            protect or enhance the health, safety or welfare of the tenants in
            the Building or their invitees.
<PAGE>   57

OPERATING EXPENSE EXCLUSIONS - CONTINUED


                               MOUNT VERNON PLACE

                          OPERATING EXPENSE EXCLUSIONS

1.    Franchise, income, transfer, inheritance, capital stock taxes or taxes
      imposed upon or measured by the income of the Landlord;

2.    Depreciation of the Building, amortization and other non-cash charges;

3.    The cost of any alteration, additions, changes or decorations which are
      made in order to prepare space (including Premises) for Tenant's
      occupancy;

4.    The cost of performing work or furnishing services to or for any Tenant,
      other than Tenant, at Landlord's expense, to the extent that such work or
      service exceeds or is more favorable than comparable work or service
      provided to Tenant at Landlord's expense;

5.    The cost (including, without limitation, attorney's fees and
      disbursements) of any judgement, settlement or arbitration award
      resulting from any tort liability;

6.    The general overhead of Landlord and labor costs and all other
      compensation of all administrative personnel, officers, executives and
      staff members of Landlord or Landlord's agents above the grade of
      building manager or engineer.

7.    The cost of installing, operating and maintaining any specialty service
      such as an observatory, broadcasting facility, luncheon club, athletic or
      recreational club;

8.    The costs of defects in the construction, design or equipping of the
      Building with respect to the mechanical systems of the Building or with
      respect to any of the structural components of the Building;

9.    Any cost or expense incurred in connection with correcting latent defects
      or inadequacies in the Building;

10.   The cost of any special heating, ventilating, air-conditioning,
      janitorial or other special or extra services provided to tenants during
      other than regular business hours;

11.   Legal or auditing fees, other than those reasonably incurred in
      connection with the maintenance and operation of the Land and Building or
      in connection with the preparation of statements required pursuant to
      Additional Rent or lease escalation provisions;

12.   Any rent, additional rent or any other charge under any lease or sublease
      to or assumed directly or indirectly by Landlord;
<PAGE>   58

OPERATING EXPENSE EXCLUSIONS - CONTINUED


13.   Expenditure on account of Landlord acquisition of air rights;

14.   Any Operating Expenses related exclusively to any retail or storage space
      in, on or about the Property or appurtenant or adjacent thereto;

15.   Any accrued and unfunded pension or other benefits of any personnel;

16.   Any amount paid to any affiliate of Landlord to the extent such amount is
      in excess of the amount which would be paid in the absence of such
      relationship;

17.   Advertising, marketing or promotional expenditures;

18.   Any costs incurred in the removal, containment, encapsulation, or
      disposal of or repair or cleaning or monitoring of areas affected by any
      hazardous material including without limitation, asbestos;

19.   Costs incurred to correct any misrepresentation by Landlord expressly
      made herein;

20.   The value or loss of income to Landlord of any space in the Building
      which is utilized for the management of the Building;

21.   Any compensation paid to clerks, attendants or other persons in
      commercial concessions operated by Landlord or any affiliate of Landlord;

22.   Late fees, penalties, interest charges or similar costs incurred by
      Landlord;

23.   Costs associated with the operation of the business of the legal entity
      that constitute Landlord as the same is separate and apart from the costs
      of the operation of the Building, including the legal entity formation,
      internal accounting and legal matters;

24.   Unrecovered expenses resulting directly from the negligence of the
      Landlord, its agents, servants or employees;

25.   Costs incurred due to the violation by Landlord or any tenant of the
      Building of the terms of any lease or any laws, rules, regulations or
      ordinances applicable to the Building; and

26.   Brokerage commissions paid by Landlord in its leasing of the Building.
<PAGE>   59

                               MOUNT VERNON PLACE


                       PROJECTED 2000 OPERATING EXPENSES
                               (Per Square Foot)


<TABLE>
<S>                                          <C>
Building Maintenance                         .71

Janitorial Maintenance                       .85

Grounds Maintenance                          .33

Administrative                               .52

Property Tax                                1.50

Insurance                                    .13

Management Fee                               .63

Reserves                                     .20
- ------------------------------------------------

TOTAL PROJECTED 2000 OPERATING EXPENSES    $4.87
                                           =====
</TABLE>


                    EXHIBIT "E"
<PAGE>   60

                               MOUNT VERNON PLACE

                             RULES AND REGULATIONS

Tenant shall observe the following Rules and Regulations (as amended, modified
or supplemented from time to time by Landlord as provided in this Lease):

1.    The following provisions of this Rule and Regulation No. 1 shall be
      applicable only in the event Landlord determines to invoke such rule and
      regulation in the event of multiple tenants of the Building which could
      result in the event Landlord approves partial assignments and/or
      subletting by Tenant. So long as Tenant is the single tenant of the
      Building, the parties acknowledge that Landlord will not provide security
      services and that Tenant will be responsible for the same, and that as
      such, the provisions of the following Rule and Regulation No. 1 shall be
      inapplicable: "Normal business hours" shall mean the days Monday through
      Friday, inclusive, except legal holidays, during the hours from 8:00 a.m.
      to 6:00 p.m., and Saturdays, except legal holidays, from 8:00 a.m. to
      1:00 p.m. At all other times every person, including Tenant, Tenant's
      employees, agents clients, customers, invitees and guests entering and
      leaving the Building may be questioned by a security guard as to that
      person's business therein, and may be required to sign such person's name
      on a form for registering such person. Landlord reserves the right to
      exclude from the Building between the hours of 6:00 p.m. and 8:00 a.m.
      and at all hours on Saturdays, Sundays, and holidays all persons who are
      not occupants or their accompanied guests. Tenant shall be responsible
      for all persons for whom it allows to enter the Building and shall be
      liable to Landlord for all acts of such persons. Landlord reserves the
      right to exclude or expel from the Building any persons who, in the
      opinion of Landlord, are or appear to be intoxicated or under the
      influence of liquor or drugs or who is in violation of any of the rules
      and regulations of the Building. Landlord shall in no case be liable for
      damages for error with regard to the admission to or exclusion from the
      Building of any person. During the continuance of any invasion, mob,
      riot, public excitement or other circumstances rendering such action
      advisable in the opinion of Landlord, Landlord reserves the right to
      prevent access to the Building by closing the doors, or otherwise, for
      the safety of the occupants and protection of the Building and property
      in the Building.

2.    Subject to Section 42 of the Lease which shall be controlling, no sign,
      advertisement, notice or other lettering shall be exhibited, inscribed,
      painted or affixed by Tenant on any part of the Building.

3.    The sidewalks, entry passages, corridors, halls, elevators and stairways
      shall not be obstructed by Tenant, or used for any purpose other than for
      ingress and egress. Tenant will insure that movers take necessary
      measures required by Landlord to protect Building (e.g., windows,
      carpets, walls, doors and elevator cabs) from damage. The halls,
      passages, exits, entrances, elevators and stairways are for the use of
      Tenant and Tenant shall in all cases retain the right to control and
      prevent access thereto by all persons whose presence, in the judgment of
      Tenant, shall be prejudicial to the safety, character, reputation and
      interests of the Building and its occupants. The toilet rooms, toilets,
      urinals, wash bowls and other apparatus shall not be used


                                  EXHIBIT "F"
<PAGE>   61

MOUNT VERNON PLACE - RULES AND REGULATIONS (CONTINUED)


      for any purpose other than that for which they were constructed and no
      foreign substance of any kind whatsoever, including, but not limited to,
      coffee grounds shall be thrown therein, and the expense of any breakage,
      stoppage or damage resulting from the violation of this rule shall be
      borne by the Tenant, if Tenant's employees, agents, clients, customers,
      invitees and guests, shall have caused it.

4.    No curtains, draperies, blinds, shutters, shades, screens or other
      coverings, awnings, hangings or decorations shall be attached to, hung or
      placed in, or used in connection with, any window or door of the Premises
      without the prior written consent of Landlord. In any event with the
      prior written consent of Landlord, all such items shall be installed
      inboard of the Building standard window blinds and shall in no way be
      visible from the exterior of the Building. Tenant shall not remove the
      Building standard window blinds installed in the Premises. No articles
      shall be placed or kept on the window sills so as to be visible from the
      exterior of the Building.

5.    Tenant, Tenant's employees, agents, clients, customers, invitees and
      guests shall maintain order in the Building, shall not make or permit any
      improper noise in the Building or interfere in any way with other
      occupants or those having business with them. Nothing shall be thrown by
      Tenant, Tenant's employees, agents, clients, customers, invitees and
      guests out of the windows or doors, or down the passages or atrium of the
      Building. No rooms shall be occupied or used as sleeping or lodging
      apartments at any time. No part of the Building shall be used or in any
      way appropriated for gambling, immoral or other unlawful practices, and
      no intoxicating liquor or liquors shall be sold in the Premises or
      Building without the written consent of Landlord.

6.    Tenant shall not, without the written consent of Landlord, put up or
      operate any machinery or stove upon the Premises, or carry on any
      mechanical business thereon, or use or allow to be used upon the
      Premises, oil, burning fluids, camphene, gasoline or kerosene for
      heating, warming or lighting. No cooking shall be done or permitted by
      Tenant on the Premises except in conformity with law and then only in the
      utility kitchen, if any, as set forth in Tenant's layout, which is to be
      primarily used by Tenant's employees for heating beverages and light
      snacks. No article deemed extra hazardous on account of fire and no
      explosives shall be brought into the Premises. No offensive gases or
      liquids will be permitted.

7.    No sunscreen or other films shall be applied to the interior or exterior
      surface of any window glass. All glass, locks and trimmings in or upon
      the doors and windows of the Building shall be kept whole and, when any
      part shall be broken, the same shall be immediately replaced or repaired
      and put in order under the direction and to the satisfaction of Landlord,
      and shall be left whole and in good repair. Tenant shall not injure,
      overload or deface the Building.

8.    Upon commencement of this Lease, Landlord shall provide, at no expense to
      Tenant, two entrance door keys. The cost of providing additional keys to
      Tenant shall be borne by Tenant. At the termination of this Lease, Tenant
      shall return to Landlord all keys to doors in the
<PAGE>   62

MOUNT VERNON PLACE - RULES AND REGULATIONS (CONTINUED)


      Building and all plastic cards for parking and entry to Building
      furnished to Tenant by Landlord and those keys otherwise procured by
      Tenant.

9.    Tenant assumes any and all responsibility for protecting Premises from
      theft, robbery and pilferage, which includes keeping doors locked and
      other means of entry to the Premises closed.

10.   Tenant shall not place a load upon any floor of the Premises which
      exceeds the load per square foot which such floor was designed to carry
      (i.e. fifty (50) pounds per square foot of live load) and which is
      allowed by law. Tenant, Tenant's employees, agents, clients, customers,
      invitees and guests, shall not bring in or take out, position, construct,
      install or move any safe, business machine or other heavy office
      equipment without first obtaining the consent of the Landlord. In giving
      such consent, Landlord shall have the right, in its sole discretion, to
      prescribe the weight permitted and the position thereof, and the use and
      design of planks, skids or platforms to distribute the weight thereof.
      All damage done to the Building by moving or using any such heavy
      equipment or other office equipment or furniture shall be repaired at the
      expense of Tenant. Safes and other heavy office equipment will be moved
      through the halls and corridors only upon steel bearing plates.

11.   There shall not be used in any space, or in the public areas of the
      Building, either by Tenant or others, any hand trucks except those
      equipped with rubber tires and side guards or such other
      material-handling equipment as Landlord may approve.

12.   Tenant shall not cause any unnecessary labor by reason of such Tenant's
      carelessness or indifference in the preservation of good order and
      cleanliness of the Premises. Landlord shall in no way be responsible to
      Tenant for any loss of property on the Premises however occurring, or for
      any damage done to the effects of Tenant by the janitor or any other
      employee or any other person. Tenant shall at the end of each business
      day leave the Premises in a reasonably tidy condition for the purpose of
      the performance of cleaning.

13.   Landlord and its respective agents, employees and contractors shall have
      the right to enter the Premises upon one day (1) prior notice to Tenant
      (except in the event of emergency in which event no notice shall be
      required) at all reasonable hours for the purpose of making any repairs,
      alterations, or additions which it shall deem necessary for the safety,
      preservation, or improvement of the Building; and Landlord, its
      respective agents, employees and contractors shall be allowed to take all
      material into and upon said Premises that may be required to make such
      repairs, improvements, and additions, or any alterations for the benefit
      of the Tenant without in any way being deemed or held guilty of an
      eviction of the Tenant; and the rent reserved shall be in no way abate
      while said repairs, alterations, or additions are being made; and the
      Tenant shall not be entitled to maintain a setoff or counterclaim for
      damages against Landlord and its respective agents, employees and
      contractors by reason of loss or interruption to the business of the
      Tenant because of the prosecution of any such work. All such repairs,
<PAGE>   63

MOUNT VERNON PLACE - RULES AND REGULATIONS (CONTINUED)


      decorations, additions, and improvements shall be done during normal
      business hours, or, if any such work is at the request of the Tenant to
      be done during any other hours, the Tenant shall pay for all overtime
      costs.

14.   Tenant shall observe and obey all parking and traffic regulations as
      imposed by Landlord. The parking facilities shall be used by vehicles
      that may occupy a standard parking area only.

15.   Canvassing, soliciting, distributing of handbills or any other written
      material, and peddling in the Building are prohibited and Tenant shall
      cooperate to prevent the same. Tenant shall not make room-to-room
      solicitation of business from other occupants in the Building.

16.   Tenant will observe strict care and caution that all water faucets or
      water apparatus are entirely shut off before the Tenant, Tenant's
      employees, agents, clients, customers, invitees and guests leave the
      Premises, and that all utilities shall likewise be carefully shut off so
      as to prevent waste or damage, and for any default or carelessness, the
      Tenant shall make good all injuries sustained by other occupants of the
      Building. Tenant will comply with all energy conservation, safety, fire
      protection and evacuation procedures and regulations established by
      Landlord or any governmental agency.

17.   Tenant shall store all trash and garbage within the interior of the
      Premises. No materials shall be placed in the trash boxes or receptacles
      if such materials is of such nature that it may not be disposed of in the
      ordinary and customary manner of removing and disposing of trash and
      garbage in this area without violation of any law or ordinance governing
      such disposal. All trash, garbage and refuse disposal shall be made only
      through entryways and elevators provided for such purposes and at such
      times as Landlord may designate.

18.   Tenant shall give prompt notice to Landlord of any accidents to or
      defects in plumbing, electrical fixtures, or heating apparatus so that
      such accidents or defects may be attended to properly.

19.   Tenant shall be responsible for the observance of all of the foregoing
      Rules and Regulations by Tenant's employees, agents, clients, customers,
      invitees and guests. These Rules and Regulations are in addition to and
      as a supplement of, and shall not be construed to in any way otherwise
      modify, alter or amend, in whole or in part, the terms, covenants,
      agreements and conditions of the Lease Agreement.

<PAGE>   1
                                                                  EXHIBIT 10.11


                                ISS GROUP, INC.

                       RESTATED 1995 STOCK INCENTIVE PLAN

                (AMENDED AND RESTATED THROUGH JANUARY 18, 1999)

                                  ARTICLE ONE

                               GENERAL PROVISIONS

         I.       PURPOSE OF THE PLAN

                  This Restated 1995 Stock Incentive Plan is intended to
promote the interests of ISS Group, Inc., a Delaware corporation, by providing
eligible persons with the opportunity to acquire a proprietary interest, or
otherwise increase their proprietary interest, in the Corporation as an
incentive for them to remain in the service of the Corporation.

                  Capitalized terms herein shall have the meanings assigned to
such terms in the attached Appendix.

         II.      STRUCTURE OF THE PLAN

                  A.       The Plan shall be divided into three (3) separate
equity programs:

                           (i)      the Discretionary Option Grant Program
         under which eligible persons may, at the discretion of the Plan
         Administrator, be granted options to purchase shares of Common Stock,

                           (ii)     the Stock Issuance Program under which
         eligible persons may, at the discretion of the Plan Administrator, be
         issued shares of Common Stock directly, either through the immediate
         purchase of such shares or as a bonus for services rendered the
         Corporation (or any Parent or Subsidiary), and

                           (iii)    the Automatic Option Grant Program under
         which eligible non-employee Board members shall automatically receive
         options at periodic intervals to purchase shares of Common Stock.

                  B.       The provisions of Articles One and Five shall apply
to all equity programs under the Plan and shall accordingly govern the
interests of all persons under the Plan.

         III.     ADMINISTRATION OF THE PLAN

                  A.       Prior to the Section 12(g) Registration Date, the
Plan shall be administered by the Board.


<PAGE>   2


                  B.       Beginning with the Section 12(g) Registration Date,
the Board shall have the authority to administer the Discretionary Option Grant
and Stock Issuance Programs with respect to Section 16 Insiders but may
delegate such authority in whole or in part to the Primary Committee.
Administration of the Plan with respect to all other persons eligible to
participate may, at the Board's discretion, be vested in the Primary Committee
or a Secondary Committee, or the Board may retain the power to administer the
Plan with respect to all such persons.

                  C.       Members of the Primary Committee or any Secondary
Committee shall serve for such period of time as the Board may determine and
may be removed by the Board at any time. The Board may also at any time
terminate the functions of any Secondary Committee and reassume all powers and
authority previously delegated to such committee.

                  D.       Each Plan Administrator shall, within the scope of
its administrative functions under the Plan, have full power and authority to
establish such rules and regulations as it may deem appropriate for proper
administration of the Plan and to make such determinations under, and issue
such interpretations of, the provisions of such Plan and any outstanding
options or stock issuances thereunder as it may deem necessary or advisable.
Decisions of the Plan Administrator within the scope of its administrative
functions under the Plan shall be final and binding on all parties who have an
interest in the Plan or any option or stock issuance thereunder.

                  E.       Service on the Primary Committee or the Secondary
Committee shall constitute service as a Board member, and members of each such
committee shall accordingly be entitled to full indemnification and
reimbursement as Board members for their service on such committee. No member
of the Primary Committee or the Secondary Committee shall be liable for any act
or omission made in good faith with respect to the Plan or any option grants or
stock issuances under the Plan.

                  F.       Administration of the Automatic Option Grant Program
shall be self-executing in accordance with the terms of such program.

         IV.      ELIGIBILITY

                  A.       Prior to the Section 12(g) Registration Date, only
Employees shall be eligible to participate in the Plan.

                  B.       Beginning with the Section 12(g) Registration Date,
the persons eligible to participate in the Discretionary Option Grant and Stock
issuance Programs shall be as follows:

                           (i)      Employees,

                           (ii)     non-employee members of the Board or the
         board of directors of any Parent or Subsidiary, and

                           (iii)    consultants and other independent advisors
         who provide services to the Corporation (or any Parent or Subsidiary).

                  C.       Only non-employee Board members shall be eligible to
participate in the Automatic Option Grant Program.


                                       2
<PAGE>   3


                  D.       Each Plan Administrator shall, within the scope of
its administrative jurisdiction under the Plan, have full authority (subject to
the provisions of the Plan) to determine, (i) with respect to the option grants
under the Discretionary Option Grant Program, which eligible persons are to
receive option grants, the time or times when such option grants are to be
made, the number of shares to be covered by each such grant, the status of the
granted option as either an Incentive Option or a Non-Statutory Option, the
time or times at which each option is to become exercisable, the vesting
schedule (if any) applicable to the option shares and the maximum term for
which the option is to remain outstanding and (ii) with respect to stock
issuances under the Stock Issuance Program, which eligible persons are to
receive stock issuances, the time or times when such issuances are to be made,
the number of shares to be issued to each Participant, the vesting schedule (if
any) applicable to the issued shares and the consideration to be paid for such
shares.

                  E.       The Plan Administrator shall have the absolute
discretion either to grant options in accordance with the Discretionary Option
Grant Program or to effect stock issuances in accordance with the Stock
Issuance Program.

         V.       STOCK SUBJECT TO THE PLAN

                  A.       The stock issuable under the Plan shall be shares of
authorized but unissued or reacquired Common Stock. The maximum number of
shares of Common Stock which may be issued over the term of the Plan shall not
exceed 3,000,000 shares.

                  B.       The number of shares of Common Stock available for
issuance under the Plan shall automatically increase on the first trading day
of each calendar year, beginning with the 1999 calendar year, by an amount
equal to three percent (3.0%) of the total number of shares of Common Stock
outstanding on the last trading day of the immediately preceding calendar year.
No Incentive Options may be granted on the basis of the additional shares of
Common Stock resulting from such annual increases.

                  C.       No one person participating in the Plan may receive
options, separately exercisable stock appreciation rights and direct stock
issuances for more than 300,000 shares of Common Stock per calendar year
beginning with the calendar year in which the Section 12(g) Registration Date
occurs.

                  D.       Shares of Common Stock subject to outstanding
options shall be available for subsequent issuance under the Plan to the extent
(i) the options expire or terminate for any reason prior to exercise in full or
(ii) the options are cancelled in accordance with the cancellation-regrant
provisions of Article Two. Unvested shares issued under the Plan and
subsequently repurchased by the Corporation at the original issue price paid
per share pursuant to the Corporation's repurchase rights under the Plan shall
be added back to the number of shares of Common Stock reserved for issuance
under the Plan and shall accordingly be available for reissuance through one or
more subsequent option grants or direct stock issuances under the Plan.
However, should the exercise price of an option under the Plan be paid with
shares of Common Stock or should shares of Common Stock otherwise issuable
under the Plan be withheld by the corporation in satisfaction of the
withholding taxes incurred in connection with the exercise of an option or the
vesting of a stock issuance under the Plan, then the number of


                                       3
<PAGE>   4


shares of Common Stock available for issuance under the Plan shall be reduced by
the gross number of shares for which the option is exercised or which vest under
the stock issuance, and not by the net number of shares of Common Stock issued
to the holder of such option or stock issuance.

                  E.       Should any change be made to the Common Stock by
reason of any stock split, stock dividend, recapitalization, combination of
shares, exchange of shares or other change affecting the outstanding Common
Stock as a class without the Corporation's receipt of consideration,
appropriate adjustments shall be made to (i) the maximum number and/or class of
securities issuable under the Plan, (ii) the number and/or class of securities
for which any one person may be granted options, separately exercisable stock
appreciation rights and direct stock issuances per calendar year, (iii) the
number and/or class of securities for which grants are subsequently to be made
under the Automatic Option Grant Program to new and continuing non-employee
Board members, and (iv) the number and/or class of securities and the exercise
price per share in effect under each outstanding option in order to prevent the
dilution or enlargement of benefits thereunder. The adjustments determined by
the Plan Administrator shall be final, binding and conclusive.


                                       4
<PAGE>   5


                                  ARTICLE TWO

                       DISCRETIONARY OPTION GRANT PROGRAM

         I.       OPTION TERMS

                  Each option shall be evidenced by one or more documents in
the form approved by the Plan Administrator; provided, however, that each such
document shall comply with the terms specified below. Each document evidencing
an Incentive Option shall, in addition, be subject to the provisions of the
Plan applicable to such options.

                  A.       EXERCISE PRICE.

                           1.       The exercise price per share shall be fixed
by the Plan Administrator and may be equal to, greater than or less than the
Fair Market Value per share of Common Stock on the option grant date.

                           2.       The exercise price shall become immediately
due upon exercise of the option and shall, subject to the provisions of Section
I of Article Five and the documents evidencing the option, be payable in cash
or check made payable to the Corporation. Should the Common Stock be registered
under Section 12(g) of the 1934 Act at the time the option is exercised, then
the exercise price may also be paid as follows:

                                    (i)      in shares of Common Stock held for
         the requisite period necessary to avoid a charge to the Corporation's
         earnings for financial reporting purposes and valued at Fair Market
         Value on the Exercise Date, or

                                    (ii)     to the extent the option is
         exercised for vested shares, through a special sale and remittance
         procedure pursuant to which the Optionee shall concurrently provide
         irrevocable instructions (A) to a Corporation-designated brokerage
         firm to effect the immediate sale of the purchased shares and remit to
         the Corporation, out of the sale proceeds available on the settlement
         date, sufficient funds to cover the aggregate exercise price payable
         for the purchased shares plus all applicable Federal, state and local
         income and employment taxes required to be withheld by the Corporation
         by reason of such exercise and (B) to the Corporation to deliver the
         certificates for the purchased shares directly to such brokerage firm
         in order to complete the sale.

Except to the extent such sale and remittance procedure is utilized, payment of
the exercise price for the purchased shares must be made on the Exercise Date.

                  B.       EXERCISE AND TERM OF OPTIONS. Each option shall be
exercisable at such time or times, during such period and for such number of
shares as shall be determined by the Plan Administrator and set forth in the
documents evidencing the option grant. However, no option shall have a term in
excess of ten (10) years measured from the option grant date.


                                       5
<PAGE>   6


                  C.       EFFECT OF TERMINATION OF SERVICE.

                           1.       The following provisions shall govern the
exercise of any options held by the Optionee at the time of cessation of
Service or death:

                                    (i)      Should the Optionee cease to
         remain in Service for any reason other than Permanent Disability or
         Misconduct, then the Optionee shall have a period of three (3) months
         following the date of such cessation of Service during which to
         exercise each outstanding option held by such Optionee.

                                    (ii)     Should the Optionee's Service
         terminate by reason of Permanent Disability, then the Optionee shall
         have a period of twelve (12) months following the date of such
         cessation of Service during which to exercise each outstanding option
         held by such Optionee.

                                    (iii)    If the Optionee dies while holding
         an outstanding option, then the personal representative of his or her
         estate or the person or persons to whom the option is transferred
         pursuant to the Optionee's will or the laws of inheritance shall have
         a twelve (12)-month period following the date of the Optionee's death
         to exercise such option.

                                    (iv)     Under no circumstances, however,
         shall any such option be exercisable after the specified expiration of
         the option term.

                                    (v)      During the applicable post-Service
         exercise period, the option may not be exercised in the aggregate for
         more than the number of vested shares for which the option is
         exercisable on the date of the Optionee's cessation of Service. Upon
         the expiration of the applicable exercise period or (if earlier) upon
         the expiration of the option term, the option shall terminate and
         cease to be outstanding for any vested shares for which the option has
         not been exercised. However, the option shall, immediately upon the
         Optionee's cessation of Service, terminate and cease to be outstanding
         with respect to any and all option shares for which the option is not
         otherwise at the time exercisable or in which the Optionee is not
         otherwise at that time vested.

                                    (vi)     Should the Optionee's Service be
         terminated for Misconduct, then all outstanding options held by the
         Optionee shall terminate immediately and cease to remain outstanding.

                                    (vii)    In the event of a Corporate
         Transaction or Change in Control, the provisions of Section III of
         this Article Two shall govern the period for which outstanding options
         are to remain exercisable following the Optionee's cessation of
         Service and shall supersede any provisions to the contrary in this
         paragraph.


                                       6
<PAGE>   7


                           2.       The Plan Administrator shall have the
discretion, exercisable either at the time an option is granted or at any time
while the option remains outstanding, to:

                                    (i)      extend the period of time for
         which the option is to remain exercisable following the Optionee's
         cessation of Service or death from the limited period otherwise in
         effect for that option to such greater period of time as the Plan
         Administrator shall deem appropriate, but in no event beyond the
         expiration of the option term, and/or

                                    (ii)     permit the option to be exercised,
         during the applicable post-Service exercise period, not only with
         respect to the number of vested shares of Common Stock for which such
         option is exercisable at the time of the Optionee's cessation of
         Service but also with respect to one or more additional installments
         in which the Optionee would have vested under the option had the
         Optionee continued in Service.

                  D.       LIMITED TRANSFERABILITY OF OPTIONS. During the
lifetime of the Optionee, Incentive Options shall be exercisable only by the
Optionee and shall not be assignable or transferable other than by will or by
the laws of descent and distribution following the Optionee's death. However, a
Non-Statutory Option may, in connection with the Optionee's estate plan, be
assigned in whole or in part during the Optionee's lifetime to one or more
members of the Optionee's immediate family or to a trust established
exclusively for one or more such family members. The assigned portion may only
be exercised by the person or persons who acquire a proprietary interest in the
option pursuant to the assignment. The terms applicable to the assigned portion
shall be the same as those in effect for the option immediately prior to such
assignment and shall be set forth in such documents issued to the assignee as
the Plan Administrator may deem appropriate.

                  E.       STOCKHOLDER RIGHTS. The holder of an option shall
have no stockholder rights with respect to the shares subject to the option
until such person shall have exercised the option, paid the exercise price and
become a holder of record of the purchased shares.

                  F.       UNVESTED SHARES. The Plan Administrator shall have
the discretion to grant options which are exercisable for unvested shares of
Common Stock. Should the Optionee cease Service while holding such unvested
shares, the Corporation shall have the right to repurchase, at the exercise
price paid per share, any or all of those unvested shares. The terms upon which
such repurchase right shall be exercisable (including the period and procedure
for exercise and the appropriate vesting schedule for the purchased shares)
shall be established by the Plan Administrator and set forth in the document
evidencing such repurchase right.

                  G.       FIRST REFUSAL RIGHTS. Until the Section 12(g)
Registration Date, the Corporation shall have the right of first refusal with
respect to any proposed disposition by the Optionee (or any successor in
interest) of any shares of Common Stock issued under the Plan. Such right of
first refusal shall be exercisable in accordance with the terms established by
the Plan Administrator and set forth in the document evidencing such right.


                                       7
<PAGE>   8


                  H.       MARKET STAND-OFF. In connection with any
underwritten public offering by the Corporation of its equity securities
pursuant to an effective registration statement filed under the Securities Act
of 1933, including the Corporation's initial public offering, the Optionee may
not sell, make any short sale of, loan, hypothecate, pledge, grant any option
for the purchase of, or otherwise dispose or transfer for value or otherwise
agree to engage in any of the foregoing transactions with respect to, any
shares of Common Stock acquired upon exercise of an option granted under the
Plan without the prior written consent of the Corporation or its underwriters.
Such restriction (the "Market Stand-Off") shall be in effect for such period of
time from and after the effective date of the final prospectus for the offering
as may be requested by the Corporation or such underwriters. The Optionee shall
be required to execute such agreements as the Corporation or the underwriters
request in connection with the Market Stand-Off.

                  I.       FORFEITURE FOR COMPETITION. If, at any time while
the Optionee remains in Service or after the Optionee's termination of Service
while the option remains outstanding, the Optionee provides services to a
competitor of the Corporation (or any Parent or Subsidiary), whether as an
employee, officer, director, independent contractor, consultant, agent or
otherwise, such services being of a nature that can reasonably be expected to
involve the skills and experience used or developed by the Optionee while in
the Corporation's Service, then the Optionee's rights under any options
outstanding under the Plan shall be forfeited and terminated, subject to a
determination to the contrary by the Plan Administrator.

         II.      INCENTIVE OPTIONS

                  The terms specified below shall be applicable to all
Incentive Options. Except as modified by the provisions of this Section II, all
the provisions of the Plan shall be applicable to Incentive Options. Options
which are specifically designated as Non-Statutory Options shall not be subject
to the terms of this Section II.

                  A.       ELIGIBILITY. Incentive Options may only be granted
to Employees.

                  B.       EXERCISE PRICE. The exercise price per share shall
not be less than one hundred percent (100%) of the Fair Market Value per share
of Common Stock on the option grant date.

                  C.       DOLLAR LIMITATION. The aggregate Fair Market Value
of the shares of Common Stock (determined as of the respective date or dates of
grant) for which one or more options granted to any Employee under the Plan (or
any other option plan of the Corporation or any Parent or Subsidiary) may for
the first time become exercisable as Incentive Options during any one (1)
calendar year shall not exceed the sum of One Hundred Thousand Dollars
($100,000). To the extent the Employee holds two (2) or more such options which
become exercisable for the first time in the same calendar year, the foregoing
limitation on the exercisability of such options as Incentive Options shall be
applied on the basis of the order in which such options are granted.

                  D.       10% STOCKHOLDER. If any Employee to whom an
Incentive Option is granted is a 10% Stockholder, then the option term shall
not exceed five (5) years measured from the option grant date and the exercise
price per share of the option shall be equal to at least one


                                       8
<PAGE>   9


hundred ten percent (110%) of the Fair Market Value per share of Common Stock
on the option grant date.

         III.     CORPORATE TRANSACTION/CHANGE IN CONTROL

                  A.       In the event of any Corporate Transaction, each
outstanding option shall automatically accelerate so that each such option
shall, immediately prior to the effective date of the Corporate Transaction,
become fully exercisable for all of the shares of Common Stock at the time
subject to such option and may be exercised for any or all of those shares as
fully-vested shares of Common Stock. However, an outstanding option shall not
so accelerate if and to the extent: (i) such option is, in connection with the
Corporate Transaction, either to be assumed by the successor corporation (or
parent thereof) or to be replaced with a comparable option to purchase shares
of the capital stock of the successor corporation (or parent thereof), (ii)
such option is to be replaced with a cash incentive program of the successor
corporation which preserves the spread existing on the unvested option shares
at the time of the Corporate Transaction and provides for subsequent payout in
accordance with the same vesting schedule applicable to such option or (iii)
the acceleration of such option is subject to other limitations imposed by the
Plan Administrator at the time of the option grant. The determination of option
comparability under clause (i) above shall be made by the Plan Administrator,
and its determination shall be final, binding and conclusive.

                  B.       All outstanding repurchase rights shall also
terminate automatically, and the shares of Common Stock subject to those
terminated rights shall immediately vest in full, in the event of any Corporate
Transaction, except to the extent: (i) those repurchase rights are to be
assigned to the successor corporation (or parent thereof) in connection with
such Corporate Transaction or (ii) such accelerated vesting is precluded by
other limitations imposed by the Plan Administrator at the time the repurchase
right is issued.

                  C.       Immediately following the consummation of the
Corporate Transaction, all outstanding options shall terminate and cease to be
outstanding, except to the extent assumed by the successor corporation (or
parent thereof).

                  D.       If an outstanding option is assumed by the successor
corporation (or parent thereof) in connection with a Corporate Transaction, and
the Corporation's repurchase rights with respect to the unvested option shares
are assigned to such successor corporation (or parent thereof), and at the time
of or within twelve (12) months following such Corporate Transaction either (i)
the Optionee is offered a Lesser Position in replacement of the position held
by him or her immediately prior to the Corporate Transaction or (ii) the
Optionee's Service terminates by reason of an Involuntary Termination, then,
effective as of the date on which such Lesser Position is offered to the
Optionee or the effective date of such Involuntary Termination, respectively,
the option shall automatically accelerate in part so that, in addition to the
number of vested shares of Common Stock for which the option is exercisable at
such time, the option shall become exercisable with respect to the next annual
installment of option shares for which the option is scheduled to become
exercisable in accordance with the exercise schedule established for the option
(and the Corporation's repurchase rights shall automatically lapse with respect
to such option shares). Following such acceleration, to the extent the Optionee
continues in Service, the exercise schedule for the option shall be adjusted so
that the option shall become


                                       9
<PAGE>   10


exercisable, with respect to each subsequent annual installment of option
shares under the original exercise schedule, on each subsequent anniversary of
the effective date of such option acceleration. In the event that both the
offer of a Lesser Position and a subsequent Involuntary Termination of an
Optionee's Service occur within twelve (12) months following a Corporate
Transaction, then acceleration of the option shares shall occur only in
connection with the offer of such Lesser Position and no additional
acceleration shall occur in connection with such subsequent Involuntary
Termination. Following an Involuntary Termination that occurs within twelve
(12) months following a Corporate Transaction, the option shall remain
exercisable for any or all of the vested option shares until the earlier of (i)
the expiration of the option term or (ii) the expiration of the one (1)-year
period measured from the effective date of the Involuntary Termination.

                  E.       Each option which is assumed in connection with a
Corporate Transaction shall be appropriately adjusted, immediately after such
Corporate Transaction, to apply to the number and class of securities which
would have been issuable to the Optionee in consummation of such Corporate
Transaction had the option been exercised immediately prior to such Corporate
Transaction. Appropriate adjustments shall also be made to (i) the number and
class of securities available for issuance under the Plan following the
consummation of such Corporate Transaction, (ii) the exercise price payable per
share under each outstanding option, provided the aggregate exercise price
payable for such securities shall remain the same and (iii) the maximum number
of securities and/or class of securities for which any one person may be
granted stock options, separately exercisable stock appreciation rights and
direct stock issuances under the Plan.

                  F.       Notwithstanding Sections III.A., III.B. and III.D of
this Article Two, the Plan Administrator shall have the discretion, exercisable
either at the time the option is granted or at any time while the option
remains outstanding, to provide for the automatic acceleration of one or more
outstanding options (and the automatic termination of one or more outstanding
repurchase rights with the immediate vesting of the shares of Common Stock
subject to those rights) upon the occurrence of a Corporate Transaction,
whether or not those options are to be assumed or replaced (or those repurchase
rights are to be assigned) in the Corporate Transaction. The Plan Administrator
shall also have the discretion to grant options which do not accelerate whether
or not such options are assumed (and to provide for repurchase rights that do
not terminate whether or not such rights are assigned) in connection with a
Corporate Transaction.

                  G.       The Plan Administrator shall also have the
discretion, exercisable at the time the option is granted or at any time while
the option remains outstanding, to provide for the automatic acceleration, of
any options which are assumed or replaced in a Corporate Transaction and do not
otherwise accelerate at that time (and the termination of any of the
Corporation's outstanding repurchase rights which do not otherwise terminate at
the time of the Corporate Transaction) in the event that within twelve (12)
months following the effective date of such Corporate Transaction either (i)
the Optionee should be offered a Lesser Position in replacement of the position
held by him or her immediately prior to the Corporate Transaction or (ii) the
Optionee's Service should subsequently terminate by reason of an Involuntary
Termination. Following an Involuntary Termination that occurs within twelve
(12) months following a Corporate Transaction, any options accelerated under
this Section III. G shall remain exercisable for the vested option shares until
the earlier of (i) the expiration of the option term or (ii) the


                                      10
<PAGE>   11


expiration of the one (1)-year period measured from the effective date of the
Involuntary Termination.

                  H.       The Plan Administrator shall have the discretion,
exercisable either at the time the option is granted or at any time while the
option remains outstanding, to (i) provide for the automatic acceleration of
one or more outstanding options (and the automatic termination of one or more
outstanding repurchase rights with the immediate vesting of the shares of
Common Stock subject to those rights) upon the occurrence of a Change in
Control or (ii) condition any such option acceleration (and the termination of
any outstanding repurchase rights) upon the occurrence of either of the
following events within a specified period (not to exceed twelve (12) months)
following the effective date of such Change in Control: (a) the offer to the
Optionee of a Lesser Position in replacement of the position held by him or her
immediately prior to the Change in Control or (b) the Involuntary Termination
of the Optionee's Service. Any options accelerated in connection with a Change
in Control shall remain fully exercisable until the expiration or sooner
termination of the option term; provided, however, that following an
Involuntary Termination that occurs within twelve (12) months following a
Change in Control, any options accelerated under this Section III.H shall
remain exercisable for the vested option shares until the earlier of (i) the
expiration of the option term or (ii) the expiration of the one (1)-year period
measured from the effective date of the Involuntary Termination.

                  I.       The portion of any Incentive Option accelerated in
connection with a Corporate Transaction or Change in Control shall remain
exercisable as an Incentive Option only to the extent the applicable One
Hundred Thousand Dollar ($100,000) limitation is not exceeded. To the extent
such dollar limitation is exceeded, the accelerated portion of such option
shall be exercisable as a Non-Statutory Option under the Federal tax laws.

                  J.       The grant of options under the Option Grant Program
shall in no way affect the right of the Corporation to adjust, reclassify,
reorganize or otherwise change its capital or business structure or to merge,
consolidate, dissolve, liquidate or sell or transfer all or any part of its
business or assets.

         IV.      CANCELLATION AND REGRANT OF OPTIONS

                  The Plan Administrator shall have the authority to effect, at
any time and from time to time, with the consent of the affected option
holders, the cancellation of any or all outstanding options under the Plan and
to grant in substitution therefor new options covering the same or different
number of shares of Common Stock but with an exercise price per share based on
the Fair Market Value per share of Common Stock on the new option grant date.

         V.       STOCK APPRECIATION RIGHTS

                  A.       The Plan Administrator shall have full power and
authority to grant to selected Optionee's tandem stock appreciation rights
and/or limited stock appreciation rights.

                  B.       The following terms shall govern the grant and
exercise of tandem stock appreciation rights:


                                      11
<PAGE>   12


                           (i)      One or more Optionees may be granted the
         right, exercisable upon such terms as the Plan Administrator may
         establish, to elect between the exercise of the underlying option for
         shares of Common Stock and the surrender of that option in exchange
         for a distribution from the Corporation in an amount equal to the
         excess of (a) the Fair Market Value (on the option surrender date) of
         the number of shares in which the Optionee is at the time vested under
         the surrendered option (or surrendered portion thereof) over (b) the
         aggregate exercise price payable for such shares.

                           (ii)     No such option surrender shall be effective
         unless it is approved by the Plan Administrator. If the surrender is
         so approved, then the distribution to which the Optionee shall be
         entitled may be made in shares of Common Stock valued at Fair Market
         Value on the option surrender date, in cash, or partly in shares and
         partly in cash, as the Plan Administrator shall in its sole discretion
         deem appropriate.

                           (iii)    If the surrender of an option is rejected
         by the Plan Administrator, then the Optionee shall retain whatever
         rights the Optionee had under the surrendered option (or surrendered
         portion thereof) on the option surrender date and may exercise such
         rights at any time prior to the later of (a) five (5) business days
         after the receipt of the rejection notice or (b) the last day on which
         the option is otherwise exercisable in accordance with the terms of
         the documents evidencing such option, but in no event may such rights
         be exercised more than ten (10) years after the option grant date.

                  C.       The following terms shall govern the grant and
exercise of limited stock appreciation rights:

                           (i)      One or more Section 16 Insiders may be
         granted limited stock appreciation rights with respect to their
         outstanding options.

                           (ii)     Upon the occurrence of a Hostile Take-Over,
         each such individual holding one or more options with such a limited
         stock appreciation right shall have the unconditional right
         (exercisable for a thirty (30)-day period following such Hostile
         Take-Over) to surrender each such option to the Corporation, to the
         extent the option is at the time exercisable for vested shares of
         Common Stock. In return for the surrendered option, the Optionee shall
         receive a cash distribution from the Corporation in an amount equal to
         the excess of (a) the Take-Over Price of the shares of Common Stock
         which are at the time vested under each surrendered option (or
         surrendered portion thereof) over (b) the aggregate exercise price
         payable for such shares. Such cash distribution shall be paid within
         five (5) days following the option surrender date.

                           (iii)    The Plan Administrator shall pre-approve,
         at the time the limited right is granted, the subsequent exercise of
         that right in accordance with the terms of the grant and the
         provisions of this Section V.C. No


                                      12
<PAGE>   13


         additional approval of the Plan Administrator or the Board shall be
         required at the time of the actual option surrender and cash
         distribution.

                           (iv)     The balance of the option (if any) shall
         continue in full force and effect in accordance with the documents
         evidencing such option.


                                      13
<PAGE>   14


                                 ARTICLE THREE

                             STOCK ISSUANCE PROGRAM

         I.       STOCK ISSUANCE TERMS

                  Shares of Common Stock may be issued under the Stock Issuance
Program through direct and immediate issuances without any intervening option
grants. Each such stock issuance shall be evidenced by a Stock Issuance
Agreement which complies with the terms specified below.

                  A.       PURCHASE PRICE.

                           1.       The purchase price per share shall be fixed
by the Plan Administrator and may be less than, equal to or greater than the
Fair Market Value per share of Common Stock on the issue date.

                           2.       Subject to the provisions of Section I of
Article Four, shares of Common Stock may be issued under the Stock Issuance
Program for any of the following items of consideration which the Plan
Administrator may deem appropriate in each individual instance:

                                    (i)      cash or check made payable to the
         Corporation, or

                                    (ii)     past services rendered to the
         Corporation (or any Parent or Subsidiary).

                  B.       VESTING PROVISIONS.

                           1.       Shares of Common Stock issued under the
Stock Issuance Program may, in the discretion of the Plan Administrator, be
fully and immediately vested upon issuance or may vest in one or more
installments over the Participant's period of Service or upon attainment of
specified performance objectives.

                           2.       Any new, substituted or additional
securities or other property (including money paid other than as a regular cash
dividend) which the Participant may have the right to receive with respect to
the Participant's unvested shares of Common Stock by reason of any stock
dividend, stock split, recapitalization, combination of shares, exchange of
shares or other change affecting the outstanding Common Stock as a class
without the Corporation's receipt of consideration shall be issued subject to
(i) the same vesting requirements applicable to the Participant's unvested
shares of Common Stock and (ii) such escrow arrangements as the Plan
Administrator shall deem appropriate.

                           3.       The Participant shall have full stockholder
rights with respect to any shares of Common Stock issued to the Participant
under the Stock Issuance Program, whether or not the Participant's interest in
those shares is vested. Accordingly, the Participant shall have the right to
vote such shares and to receive any regular cash dividends paid on such shares.


                                      14
<PAGE>   15


                           4.       Should the Participant cease to remain in
Service while holding one or more unvested shares of Common Stock issued under
the Stock Issuance Program or should the performance objectives not be attained
with respect to one or more such unvested shares of Common Stock, then those
shares shall be immediately surrendered to the Corporation for cancellation,
and the Participant shall have no further stockholder rights with respect to
those shares. To the extent the surrendered shares were previously issued to
the Participant for consideration paid in cash or cash equivalent (including
the Participant's purchase-money indebtedness), the Corporation shall repay to
the Participant the cash consideration paid for the surrendered shares and
shall cancel the unpaid principal balance of any outstanding purchase-money
note of the Participant attributable to such surrendered shares.

                           5.       The Plan Administrator may in its
discretion waive the surrender and cancellation of one or more unvested shares
of Common Stock (or other assets attributable thereto) which would otherwise
occur upon the non-completion of the vesting schedule applicable to such
shares. Such waiver shall result in the immediate vesting of the Participant's
interest in the shares of Common Stock as to which the waiver applies. Such
waiver may be effected at any time, whether before or after the Participant's
cessation of Service or the attainment or non-attainment of the applicable
performance objectives.

                  C.       FIRST REFUSAL RIGHTS. Until the Section 12(g)
Registration Date, the Corporation shall have the right of first refusal with
respect to any proposed disposition by the Participant (or any successor in
interest) of any shares of Common Stock issued under the Stock Issuance
Program. Such right of first refusal shall be exercisable in accordance with
the terms established by the Plan Administrator and set forth in the document
evidencing such right.

         II.      CORPORATE TRANSACTION/CHANGE IN CONTROL

                  A.       All of the Corporation's outstanding repurchase
rights under the Stock Issuance Program shall terminate automatically, and all
the shares of Common Stock subject to those terminated rights shall immediately
vest in full, in the event of any Corporate Transaction, except to the extent
(i) those repurchase rights are assigned to the successor corporation (or
parent thereof) in connection with such Corporate Transaction or (ii) such
accelerated vesting is precluded by other limitations imposed in the Stock
Issuance Agreement.

                  B.       Notwithstanding Section II.A. of this Article Three,
the Plan Administrator shall have the discretionary authority, exercisable
either at the time the unvested shares are issued or any time while the
Corporation's repurchase rights remain outstanding under the Stock Issuance
Program, to provide that those rights shall automatically terminate in whole or
in part, and the shares of Common Stock subject to those terminated rights
shall immediately vest, in the event of a Corporate Transaction, whether or not
those repurchase rights are to be assigned to the successor corporation (or its
parent) in connection with such Corporate Transaction. The Plan Administrator
shall also have the discretion to provide for repurchase rights with terms
different from those in effect under this Section II in connection with a
Corporate Transaction.

                  C.       The Plan Administrator shall have the discretion,
exercisable either at the time the unvested shares are issued or at any time
while the Corporation's repurchase rights


                                      15
<PAGE>   16


remain outstanding, to provide that any repurchase rights that are assigned in
the Corporate Transaction shall automatically terminate, and the shares of
Common Stock subject to those terminated rights shall immediately vest in full,
in the event that either of the following events should occur either at the
time of or within a specified period (not to exceed twelve (12) months)
following the effective date of the Corporate Transaction: (a) the Participant
is offered a Lesser Position in replacement of the position held by him or her
immediately prior to the Corporate Transaction or (b) the Participant's Service
terminates by reason of an Involuntary Termination.

                  D.       The Plan Administrator shall have the discretion,
exercisable either at the time the unvested shares are issued or at any time
while the Corporation's repurchase right remains outstanding, to (i) provide
for the automatic termination of one or more outstanding repurchase rights and
the immediate vesting of the shares of Common Stock subject to those rights
upon the occurrence of a Change in Control or (ii) condition any such
accelerated vesting upon the occurrence of either of the following events at
the time of or within a specified period (not to exceed twelve (12) months)
following the effective date of such Change in Control: (a) the Participant is
offered a Lesser Position in replacement of the position held by him or her
immediately prior to the Change in Control or (b) the Involuntary Termination
of the Participant's Service.

         III.     SHARE ESCROW/LEGENDS

                  Unvested shares may, in the Plan Administrator's discretion,
be held in escrow by the Corporation until the Participant's interest in such
shares vests or may be issued directly to the Participant with restrictive
legends on the certificates evidencing those unvested shares.

         IV.      MARKET STAND-OFF

                  In connection with any underwritten public offering by the
Corporation of its equity securities pursuant to an effective registration
statement filed under the Securities Act of 1933, including the Corporation's
initial public offering, the Participant may not sell, make any short sale of,
loan, hypothecate, pledge, grant any option for the purchase of, or otherwise
dispose or transfer for value or otherwise agree to engage in any of the
foregoing transactions with respect to, any shares of Common Stock acquired
under the Plan without the prior written consent of the Corporation or its
underwriters. Such restriction (the "Market Stand-Off") shall be in effect for
such period of time from and after the effective date of the final prospectus
for the offering as may be requested by the Corporation or such underwriters.
The Participant shall be required to execute such agreements as the Corporation
or the underwriters request in connection with the Market Stand-Off.


                                      16
<PAGE>   17


                                 ARTICLE FOUR

                         AUTOMATIC OPTION GRANT PROGRAM

         I.       OPTION TERMS

                  A.       GRANT DATES. Options shall be made on the dates
specified below:

                           1.       Each individual who is first elected or
appointed as a non-employee Board member after January 18, 1999 shall
automatically be granted, on the date of such initial election or appointment,
a Non-Statutory Option to purchase 20,000 shares of Common Stock, provided that
individual has not previously been in the employ of the Corporation or any
Parent or Subsidiary.

                           2.       On the date of each Annual Stockholders
Meeting, beginning with the meeting held in 1999, each individual who is to
continue to serve as a non-employee Board member, whether or not that
individual is standing for re-election to the Board, shall automatically be
granted a Non-Statutory Option to purchase 2,500 shares of Common Stock,
provided such individual has served as a non-employee Board member for at least
six (6) months.

                  B.       EXERCISE PRICE.

                           1.       The exercise price per share shall be equal
to one hundred percent (100%) of the Fair Market Value per share of Common
Stock on the option grant date.

                           2.       The exercise price shall be payable in one
or more of the alternative forms authorized under the Discretionary Option
Grant Program. Except to the extent the sale and remittance procedure specified
thereunder is utilized, payment of the exercise price for the purchased shares
must be made on the Exercise Date.

                  C.       OPTION TERM. Each option shall have a term of ten
(10) years measured from the option grant date.

                  D.       EXERCISE AND VESTING OF OPTIONS. Each option shall
be immediately exercisable for any or all of the option shares. However, any
shares purchased under the option shall be subject to repurchase by the
Corporation, at the exercise price paid per share, upon the Optionee's
cessation of Board service prior to vesting in those shares. Each initial
20,000-share option shall vest, and the Corporation's repurchase right shall
lapse, in a series of four (4) successive equal annual installments upon the
Optionee's completion of each year of Board service over the four (4)-year
period measured from the option grant date. Each annual 2,500-share option
shall be fully-vested at the time of grant.


                                      17
<PAGE>   18


                  E.       CESSATION OF BOARD SERVICE. The following provisions
shall govern the exercise of any options outstanding at the time of the
Optionee's cessation of Board service:

                           (i)      The Optionee (or, in the event of
         Optionee's death, the personal representative of the Optionee's estate
         or the person or persons to whom the option is transferred pursuant to
         the Optionee's will or in accordance with the laws of descent and
         distribution) shall have a twelve (12)-month period following the date
         of such cessation of Board service in which to exercise each such
         option.

                           (ii)     During the twelve (12)-month exercise
         period, the option may not be exercised in the aggregate for more than
         the number of vested shares of Common Stock for which the option is
         exercisable at the time of the Optionee's cessation of Board service.

                           (iii)    Should the Optionee cease to serve as a
         Board member by reason of death or Permanent Disability, then all
         shares at the time subject to the option shall immediately vest so
         that such option may, during the twelve (12)-month exercise period
         following such cessation of Board service, be exercised for all or any
         portion of those shares as fully-vested shares of Common Stock.

                           (iv)     In no event shall the option remain
         exercisable after the expiration of the option term. Upon the
         expiration of the twelve (12)-month exercise period or (if earlier)
         upon the expiration of the option term, the option shall terminate and
         cease to be outstanding for any vested shares for which the option has
         not been exercised. However, the option shall, immediately upon the
         Optionee's cessation of Board service for any reason other than death
         or Permanent Disability, terminate and cease to be outstanding to the
         extent the option is not otherwise at that time exercisable for vested
         shares.

         II.      CORPORATE TRANSACTION/CHANGE IN CONTROL/HOSTILE TAKE-OVER

                  A.       In the event of any Corporate Transaction, the
shares of Common Stock at the time subject to each outstanding option but not
otherwise vested shall automatically vest in full so that each such option
shall, immediately prior to the effective date of the Corporate Transaction,
become fully exercisable for all of the shares of Common Stock at the time
subject to such option and may be exercised for all or any portion of those
shares as fully-vested shares of Common Stock. Immediately following the
consummation of the Corporate Transaction, each automatic option grant shall
terminate and cease to be outstanding, except to the extent assumed by the
successor corporation (or parent thereof).

                  B.       In connection with any Change in Control, the shares
of Common Stock at the time subject to each outstanding option but not
otherwise vested shall automatically vest in full so that each such option
shall, immediately prior to the effective date of the Change in Control, become
fully exercisable for all of the shares of Common Stock at the time subject to


                                      18
<PAGE>   19


such option and may be exercised for all or any portion of those shares as
fully-vested shares of Common Stock. Each such option shall remain exercisable
for such fully-vested option shares until the expiration or sooner termination
of the option term or the surrender of the option in connection with a Hostile
Take-Over.

                  C.       Upon the occurrence of a Hostile Take-Over, the
Optionee shall have a thirty (30)-day period in which to surrender to the
Corporation each of his or her outstanding automatic option grants. The
Optionee shall in return be entitled to a cash distribution from the
Corporation in an amount equal to the excess of (i) the Take-Over Price of the
shares of Common Stock at the time subject to each surrendered option (whether
or not the Optionee is otherwise at the time vested in those shares) over (ii)
the aggregate exercise price payable for such shares. Such cash distribution
shall be paid within five (5) days following the surrender of the option to the
Corporation.

                  D.       Each option which is assumed in connection with a
Corporate Transaction shall be appropriately adjusted, immediately after such
Corporate Transaction, to apply to the number and class of securities which
would have been issuable to the Optionee in consummation of such Corporate
Transaction had the option been exercised immediately prior to such Corporate
Transaction. Appropriate adjustments shall also be made to the exercise price
payable per share under each outstanding option, provided the aggregate
exercise price payable for such securities shall remain the same.

                  E.       The grant of options under the Automatic Option
Grant Program shall in no way affect the right of the Corporation to adjust,
reclassify, reorganize or otherwise change its capital or business structure or
to merge, consolidate, dissolve, liquidate or sell or transfer all or any part
of its business or assets.

         III.     REMAINING TERMS

                  The remaining terms of each option granted under the
Automatic Option Grant Program shall be the same as the terms in effect for
options made under the Discretionary Option Grant Program.


                                      19
<PAGE>   20


                                 ARTICLE FIVE

                                 MISCELLANEOUS

         I.       FINANCING

                  The Plan Administrator may permit any Optionee or Participant
to pay the option exercise price under the Discretionary Option Grant Program
or the purchase price of shares issued under the Stock Issuance Program by
delivering a full-recourse, interest bearing promissory note payable in one or
more installments. The terms of any such promissory note (including the
interest rate and the terms of repayment) shall be established by the Plan
Administrator in its sole discretion. In no event may the maximum credit
available to the Optionee or Participant exceed the sum of (i) the aggregate
option exercise price or purchase price payable for the purchased shares (less
the par value, if any, of those shares) plus (ii) any Federal, state and local
income and employment tax liability incurred by the Optionee or the Participant
in connection with the option exercise or share purchase.

         II.      TAX WITHHOLDING

                  A.       The Corporation's obligation to deliver shares of
Common Stock upon the exercise of options or upon the issuance or vesting of
such shares under the Plan shall be subject to the satisfaction of all
applicable Federal, state and local income and employment tax withholding
requirements.

                  B.       The Plan Administrator may, in its discretion,
provide any or all holders of Non-Statutory Options or unvested shares of
Common Stock under the Plan with the right to use shares of Common Stock in
satisfaction of all or part of the Taxes incurred by such holders in connection
with the exercise of their options or the vesting of their shares. Such right
may be provided to any such holder in either or both of the following formats:

                           (i)      STOCK WITHHOLDING: The election to have the
         Corporation withhold, from the shares of Common Stock otherwise
         issuable upon the exercise of such Non-Statutory Option or the vesting
         of such shares, a portion of those shares with an aggregate Fair
         Market Value equal to the percentage of the Taxes (not to exceed one
         hundred percent (100%)) designated by the holder.

                           (ii)     STOCK DELIVERY: The election to deliver to
         the Corporation, at the time the Non-Statutory Option is exercised or
         the shares vest, one or more shares of Common Stock previously
         acquired by such holder (other than in connection with the option
         exercise or share vesting triggering the Taxes) with an aggregate Fair
         Market Value equal to the percentage of the Taxes (not to exceed one
         hundred percent (100%)) designated by the holder.

         III.     EFFECTIVE DATE AND TERM OF PLAN

                  A.       The Plan became effective when adopted by the board
of directors of Internet Security Systems, Inc., a Georgia Corporation, (the
"Predecessor Corporation") on


                                      20
<PAGE>   21


September 6, 1995 and was approved by the stockholders of the Predecessor
Corporation on January 31, 1996. Effective as of February 28, 1997, the board
of directors of the Predecessor Corporation restated, subject to approval by
the stockholders, the Plan to make the following changes: (i) to re-name the
Plan the "Restated 1995 Stock Incentive Plan", (ii) to increase the number of
shares of the Predecessor Corporation's common stock available for issuance
thereunder by 600,000 shares from 948,029 to 1,548,029 shares, (iii) to add the
Stock Issuance Program, (iv) to give the Plan Administrator additional
discretion to structure options as immediately exercisable options, subject to
repurchase at the option exercise price paid per share, (v) to give the Plan
Administrator additional discretion to provide for the accelerated vesting of
options or issued shares of Common Stock in connection with a Corporate
Transaction or Change in Control or upon either (a) the offer to an Optionee or
Participant of a Lesser Position or (b) the Involuntary Termination of an
Optionee or Participant's Service following such Corporate Transaction or
Change in Control and (vi) to incorporate certain features which would be
appropriate after the Section 12(g) Registration Date including, in particular
the power to grant stock appreciation rights, certain amendments to the
administrative provisions of the Plan to comply with applicable Federal
securities and tax laws and the imposition of a 300,000-share limit on the
number of shares which may be awarded to any individual under the Plan after
the Section 12(g) Registration Date, as required by Section 162(m) of the Code.

                  The provisions of the February 28, 1997 restatement of the
Plan shall apply only to options granted and stock issuances made under the
Plan from and after February 28, 1997. All options outstanding under the Plan
at the time of the February 28, 1997 restatement shall continue to be governed
by the terms and conditions of the Plan (and the respective instruments
evidencing each such option) as in effect on the date each such option was
granted; provided, however, that one or more provisions of the restated Plan,
may, in the Plan Administrator's discretion, be extended to one or more such
options.

                  B.       On December 3, 1997, in connection with
incorporation of the Corporation, the Plan was assumed by the Corporation and
each option outstanding thereunder was assumed by the Corporation and converted
into an option to purchase shares of the Corporation's Common Stock on a
1-for-1 basis, at the original option exercise price per share and subject to
the original terms and conditions of each such option. Also on December 3,
1997, the Board, in anticipation of the initial public offering of the Common
Stock and subject to approval by the Corporation's stockholders, further
amended the Plan to (i) render non-employee Board members and consultants and
independent advisors eligible to receive option grants under the Plan after the
Section 12(g) Registration Date, (ii) add the Automatic Option Grant Program,
(iii) increase the number of shares of Common Stock issuable under the Plan
from 1,548,029 to 3,000,000 shares and (iv) provide for an automatic annual
increase in the total number of shares of Common Stock authorized for issuance
under the Plan.

                  C.       The Plan shall terminate upon the earliest of (i)
September 6, 2005, (ii) the date on which all shares available for issuance
under the Plan shall have been issued as vested shares or (iii) the termination
of all outstanding options in connection with a Corporate Transaction. All
options and unvested stock issuances outstanding at that time under the Plan
shall continue to have full force and effect in accordance with the provisions
of the documents evidencing such options or issuances.


                                      21
<PAGE>   22


         IV.      AMENDMENT OF THE PLAN

                  A.       The Board shall have complete and exclusive power
and authority to amend or modify the Plan in any or all respects. However, no
such amendment or modification shall adversely affect the rights and
obligations with respect to options or unvested stock issuances at the time
outstanding under the Plan unless the Optionee or the Participant consents to
such amendment or modification. In addition, certain amendments may require
stockholder approval pursuant to applicable laws and regulations.

                  B.       Options may be granted under the Discretionary
Option Grant Program and shares may be issued under the Stock Issuance Program
which are in each instance in excess of the number of shares of Common Stock
then available for issuance under the Plan, provided any excess shares actually
issued under those programs shall be held in escrow until there is obtained
stockholder approval of an amendment sufficiently increasing the number of
shares of Common Stock available for issuance under the Plan. If such
stockholder approval is not obtained within twelve (12) months after the date
the first such excess issuances are made, then (i) any unexercised options
granted on the basis of such excess shares shall terminate and cease to be
outstanding and (ii) the Corporation shall promptly refund to the Optionees and
the Participants the exercise or purchase price paid for any excess shares
issued under the Plan and held in escrow, together with interest (at the
applicable Short Term Federal Rate) for the period the shares were held in
escrow, and such shares shall thereupon be automatically cancelled and cease to
be outstanding.

         V.       USE OF PROCEEDS

                  Any cash proceeds received by the Corporation from the sale
of shares of Common Stock under the Plan shall be used for general corporate
purposes.

         VI.      WITHHOLDING

                  The Corporation's obligation to deliver shares of Common
Stock upon the exercise of any options or upon the vesting of any shares issued
under the Plan shall be subject to the satisfaction of all applicable Federal,
state and local income and employment tax withholding requirements.

         VII.     REGULATORY APPROVALS

                  A.       The implementation of the Plan, the granting of any
options under the Plan and the issuance of any shares of Common Stock (i) upon
the exercise of any option or (ii) under the Stock Issuance Program shall be
subject to the Corporation's procurement of all approvals and permits required
by regulatory authorities having jurisdiction over the Plan, the options
granted under it and the shares of Common Stock issued pursuant to it.

                  B.       No shares of Common Stock or other assets shall be
issued or delivered under the Plan unless and until there shall have been
compliance with all applicable requirements of Federal and state securities
laws and all applicable listing requirements of any stock exchange (or the
Nasdaq National Market, if applicable) on which Common Stock is then listed for
trading.


                                      22
<PAGE>   23


         VIII.    NO EMPLOYMENT OR SERVICE RIGHTS

                  Nothing in the Plan shall confer upon the Optionee or the
Participant any right to continue in Service for any period of specific
duration or interfere with or otherwise restrict in any way the rights of the
Corporation (or any Parent or Subsidiary employing or retaining such person) or
of the Optionee or the Participant, which rights are hereby expressly reserved
by each, to terminate such person's Service at any time for any reason, with or
without cause.


                                      23
<PAGE>   24


                                    APPENDIX

                  The following definitions shall be in effect under the Plan:

                  A.       AUTOMATIC OPTION GRANT PROGRAM shall mean the
automatic option grant program in effect under the Plan.

                  B.       BOARD shall mean the Corporation's Board of
Directors.

                  C.       CHANGE IN CONTROL shall mean a change in ownership
or control of the Corporation effected through either of the following
transactions:

                           (i)      the acquisition, directly or indirectly, by
         any person or related group of persons (other than the Corporation or
         a person that directly or indirectly controls, is controlled by, or is
         under common control with, the Corporation), of beneficial ownership
         (within the meaning of Rule 13d-3 of the 1934 Act) of securities
         possessing more than fifty percent (50%) of the total combined voting
         power of the Corporation's outstanding securities pursuant to a tender
         or exchange offer made directly to the Corporation's stockholders, or

                           (ii)     a change in the composition of the Board
         over a period of thirty-six (36) consecutive months or less such that
         a majority of the Board members ceases, by reason of one or more
         contested elections for Board membership, to be comprised of
         individuals who either (A) have been Board members continuously since
         the beginning of such period or (B) have been elected or nominated for
         election as Board members during such period by at least a majority of
         the Board members described in clause (A) who were still in office at
         the time the Board approved such election or nomination.

                  D.       CODE shall mean the Internal Revenue Code of 1986,
as amended.

                  E.       COMMITTEE shall mean a committee of one (1) or more
Board members appointed by the Board to exercise one or more administrative
functions under the Plan.

                  F.       COMMON STOCK shall mean the Corporation's common
stock.

                  G.       CORPORATE TRANSACTION shall mean either of the
following stockholder-approved transactions to which the Corporation is a
party:

                           (i)      a merger or consolidation in which
         securities possessing more than fifty percent (50%) of the total
         combined voting power of the Corporation's outstanding securities are
         transferred to a person or persons different from the persons holding
         those securities immediately prior to such transaction, or

                           (ii)     the sale, transfer or other disposition of
         all or substantially all of the Corporation's assets in complete
         liquidation or dissolution of the Corporation.


                                      A-1
<PAGE>   25


                  H.       CORPORATION shall mean ISS Group, Inc., a Delaware
corporation.

                  I.       DISCRETIONARY OPTION GRANT PROGRAM shall mean the
option grant program in effect under the Plan.

                  J.       EMPLOYEE shall mean an individual who is in the
employ of the Corporation (or any Parent or Subsidiary), subject to the control
and direction of the employer entity as to both the work to be performed and
the manner and method of performance.

                  K.       EXERCISE DATE shall mean the date on which the
Corporation shall have received written notice of the option exercise.

                  L.       FAIR MARKET VALUE per share of Common Stock on any
relevant date shall be determined in accordance with the following provisions:

                           (i)      If the Common Stock is at the time traded
         on the Nasdaq National Market, then the Fair Market Value shall be the
         closing selling price per share of Common Stock on the date in
         question, as such price is reported by the National Association of
         Securities Dealers on the Nasdaq National Market. If there is no
         closing selling price for the Common Stock on the date in question,
         then the Fair Market Value shall be the closing selling price on the
         last preceding date for which such quotation exists.

                           (ii)     If the Common Stock is at the time listed
         on any Stock Exchange, then the Fair Market Value shall be the closing
         selling price per share of Common Stock on the date in question on the
         Stock Exchange determined by the Plan Administrator to be the primary
         market for the Common Stock, as such price is officially quoted in the
         composite tape of transactions on such exchange. If there is no
         closing selling price for the Common Stock on the date in question,
         then the Fair Market Value shall be the closing selling price on the
         last preceding date for which such quotation exists.

                           (iii)    For purposes of any option grants made on
         the Underwriting Date, the Fair Market Value shall be deemed to be
         equal to the price per share at which the Common Stock is sold in the
         initial public offering pursuant to the Underwriting Agreement.

                           (iv)     For purposes of any option grants made
         prior to the Underwriting Date, the Fair Market Value shall be
         determined by the Plan Administrator after taking into account such
         factors as the Plan Administrator shall deem appropriate.

                  M.       HOSTILE TAKE-OVER shall mean the acquisition,
directly or indirectly, by any person or related group of persons (other than
the Corporation or a person that directly or indirectly controls, is controlled
by, or is under common control with, the Corporation) of beneficial ownership
(within the meaning of Rule 13d-3 of the 1934 Act) of securities possessing
more than fifty percent (50%) of the total combined voting power of the
Corporation's


                                      A-2
<PAGE>   26


outstanding securities pursuant to a tender or exchange offer made directly to
the Corporation's stockholders which the Board does not recommend such
stockholders to accept.

                  N.       1934 ACT shall mean the Securities Exchange Act of
1934, as amended.

                  O.       INCENTIVE OPTION shall mean an option which
satisfies the requirements of Code Section 422.

                  P.       INVOLUNTARY TERMINATION shall mean the termination
of the Service of any individual which occurs by reason of:

                           (i)      such individual's involuntary dismissal or
         discharge by the Corporation for reasons other than Misconduct, or

                           (ii)     such individual's voluntary resignation
         following the offer to such individual of a Lesser Position in
         replacement of the position held by him or her immediately prior to
         the Corporate Transaction or Change in Control.

                  Q.       LESSER POSITION FOR AN OPTIONEE OR PARTICIPANT shall
mean a new position or a change in the Optionee or Participant's position
which, compared with such individual's position with the Corporation
immediately prior to the Corporate Transaction or Change in Control, (i) offers
a lower level of compensation (including base salary, fringe benefits and
target bonuses under any corporate-performance based bonus or incentive
programs), or (ii) materially reduces such individual's duties or level of
responsibility.

                  R.       MISCONDUCT shall mean the commission of any act of
fraud, embezzlement or dishonesty by the Optionee or Participant, any
unauthorized use or disclosure by such person of confidential information or
trade secrets of the Corporation (or any Parent or Subsidiary), or any other
intentional misconduct by such person adversely affecting the business or
affairs of the Corporation (or any Parent or Subsidiary) in a material manner.
The foregoing definition shall not be deemed to be inclusive of all the acts or
omissions which the Corporation (or any Parent or Subsidiary) may consider as
grounds for the dismissal or discharge of any Optionee, Participant or other
person in the Service of the Corporation (or any Parent or Subsidiary).

                  S.       1934 ACT shall mean the Securities Exchange Act of
1934, as amended.

                  T.       NON-STATUTORY OPTION shall mean an option not
intended to satisfy the requirements of Code Section 422.

                  U.       OPTIONEE shall mean any person to whom an option is
granted under the Plan.

                  V.       PARENT shall mean any corporation (other than the
Corporation) in an unbroken chain of corporations ending with the Corporation,
provided each corporation in the unbroken chain (other than the Corporation)
owns, at the time of the determination, stock


                                      A-3
<PAGE>   27


possessing fifty percent (50%) or more of the total combined voting power of
all classes of stock in one of the other corporations in such chain.

                  W.       PARTICIPANT shall mean any person who is issued
shares of Common Stock under the Stock Issuance Program.

                  X.       PERMANENT DISABILITY OR PERMANENTLY DISABLED shall
mean the inability of the Optionee or the Participant to engage in any
substantial gainful activity by reason of any medically determinable physical
or mental impairment expected to result in death or to be of continuous
duration of twelve (12) months or more. However, solely for purposes of the
Automatic Option Grant Program, Permanent Disability or Permanently Disabled
shall mean the inability of the non-employee Board member to perform his or her
usual duties as a Board member by reason of any medically determinable physical
or mental impairment expected to result in death or to be of continuous
duration of twelve (12) months or more.

                  Y.       PLAN shall mean the Corporation's Restated 1995
Stock Incentive Plan, as set forth in this document.

                  Z.       PLAN ADMINISTRATOR shall mean the particular entity,
whether the Primary Committee, the Board or the Secondary Committee, which is
authorized to administer the Option Grant and Stock Issuance Programs with
respect to one or more classes of eligible persons, to the extent such entity
is carrying out its administrative functions under those programs with respect
to the persons under its jurisdiction.

                  AA.      PRIMARY COMMITTEE shall mean the committee of two
(2) or more non-employee Board members appointed by the Board to administer the
Option Grant and Stock Issuance Programs with respect to Section 16 Insiders.

                  BB.      SECONDARY COMMITTEE shall mean a committee of one
(1) or more Board members appointed by the Board to administer the Option Grant
and Stock Issuance Programs with respect to eligible persons other than Section
16 Insiders.

                  CC.      SECTION 12(G) REGISTRATION DATE shall mean the date
on which the Common Stock is first registered under Section 12(g) of the 1934
Act.

                  DD.      SECTION 16 INSIDER shall mean an officer or director
of the Corporation subject to the short-swing profit liabilities of Section 16
of the 1934 Act.

                  EE.      SERVICE shall mean the provision of services to the
Corporation (or any Parent or Subsidiary) by a person in the capacity of an
Employee, a non-employee member of the board of directors or a consultant or
independent advisor, except to the extent otherwise specifically provided in
the documents evidencing the option grant.

                  FF.      STOCK EXCHANGE shall mean either the American Stock
Exchange or the New York Stock Exchange.


                                      A-4
<PAGE>   28


                  GG.      STOCK ISSUANCE AGREEMENT shall mean the agreement
entered into by the Corporation and the Participant at the time of issuance of
shares of Common Stock under the Stock Issuance Program.

                  HH.      STOCK ISSUANCE PROGRAM shall mean the stock issuance
program in effect under the Plan.

                  II.      SUBSIDIARY shall mean any corporation (other than
the Corporation) in an unbroken chain of corporations beginning with the
Corporation, provided each corporation (other than the last corporation) in the
unbroken chain owns, at the time of the determination, stock possessing fifty
percent (50%) or more of the total combined voting power of all classes of
stock in one of the other corporations in such chain.

                  JJ.      TAKE-OVER PRICE shall mean the greater of (i) the
Fair Market Value per share of Common Stock on the date the option is
surrendered to the Corporation in connection with a Hostile Take-Over or (ii)
the highest reported price per share of Common Stock paid by the tender offeror
in effecting such Hostile Take-Over. However, if the surrendered option is an
Incentive Option, the Take-Over Price shall not exceed the clause (i) price per
share.

                  KK.      TAXES shall mean the Federal, state and local income
and employment tax liabilities incurred by the holder of Non-Statutory Options
or unvested shares of Common Stock in connection with the exercise of those
options or the vesting of those shares.

                  LL.      10% STOCKHOLDER shall mean the owner of stock (as
determined under Code Section 424(d)) possessing more than ten percent (10%) of
the total combined voting power of all classes of stock of the Corporation (or
any Parent or Subsidiary).

                  MM.      UNDERWRITING AGREEMENT shall mean the agreement
between the Corporation and the underwriter or underwriters managing the
initial public offering of the Common Stock.

                  NN.      UNDERWRITING DATE shall mean the date on which the
Underwriting Agreement is executed and the initial public offering price of the
Common Stock is established.


                                      A-5

<PAGE>   1
                                                                    EXHIBIT 21.1


                         Subsidiaries of the Registrant


1.  Internet Security Systems, Inc. (Georgia)
2.  Internet Security Systems, Inc. (Delaware)
3.  ISS Group Ltd. (United Kingdom)
4.  ISS Investment Holdings, Inc. (Delaware)
5.  Internet Security Systems NV (Belgium)
6.  Internet Security Systems KK (Japan)
7.  Netrex, Inc. (Michigan)
8.  NJH Security Consulting, Inc. (Georgia)
9.  Intelligent Shopping, Inc. (Georgia)

<PAGE>   1
                                                                    EXHIBIT 23.1


                        Consent of Independent Auditors


     We consent to the incorporation by reference in the Registration
Statements and in the related prospectuses of ISS Group, Inc. listed below of
our report dated January 21, 2000, with respect to the consolidated financial
statements and schedule of ISS Group, Inc. included in this Annual Report (Form
10-K) for the year ended December 31, 1999:

          Registration Statement No. 333-53279 on Form S-8 (Restated 1995 Stock
          Incentive Plan)

          Registration Statement No. 333-89563 on Form S-8 (ISS Group Inc. 1995
          Stock Incentive Plan, 1999 Employee Stock Purchase Plan, 1999
          International Employee Stock Purchase Plan, Netrex, Inc. 1998 Stock
          Plan)

          Registration Statement No. 333-87557 on Form S-3 for the registration
          of 723,987 shares of Common Stock

                                                  /s/ ERNST & YOUNG LLP

Atlanta, Georgia
March 29, 2000

<PAGE>   1
                                                                    EXHIBIT 23.2



                       CONSENT OF INDEPENDENT ACCOUNTANTS





We hereby consent to the incorporation by reference in the Registration
Statements on Form S-3 (No. 333-87557) and on Forms S-8 (No. 333-53279 and No.
333-89563) of ISS Group, Inc. of our report dated May 17, 1999 relating to the
financial statements, which appears in this Form 10-K.





PricewaterhouseCoopers LLP


Bloomfield Hills, Michigan
March 27, 2000

<PAGE>   1
                                                                    EXHIBIT 23.3


                       REPORT OF INDEPENDENT ACCOUNTANTS


To the Board of Directors and
Shareholders of Netrex, Inc.:


In our opinion, the balance sheets as of December 31, 1998 and the related
statements of income, stockholders' equity and cash flows for the year ended
December 31, 1998 of Netrex, Inc., (not presented separately herein) present
fairly, in all material respects, the financial position, results of operations
and cash flows of Netrex, Inc. at December 31, 1998 and for the year ended
December 31, 1998, in conformity with generally accepted accounting principles.
These financial statements are the responsibility of the Company's management;
our responsibility is to express an opinion on these financial statements based
on our audit. We conducted our audit of these statements in accordance with
generally accepted auditing standards, which require that we plan and perform
the audit to obtain reasonable assurance about whether the financial statements
are free of material misstatement. An audit includes examining, on a test basis,
evidence supporting the amounts and disclosures in the financial statements,
assessing the accounting principles used and significant estimates made by
management, and evaluating the overall financial statement presentation. We
believe that our audit provides a reasonable basis for the opinion expressed
above. We have not audited the financial statements of Netrex, Inc. for any
period subsequent to December 31, 1998.


PricewaterhouseCoopers LLP


Bloomingfield Hills, Michigan
May 17, 1999


<TABLE> <S> <C>

<ARTICLE> 5
<LEGEND>
THIS SCHEDULE CONTAINS SUMMARY FINANCIAL INFORMATION EXTRACTED FROM THE
CONSOLIDATED FINANCIAL STATEMENTS OF ISS GROUP, INC. AS OF AND FOR THE TWELVE
MONTHS ENDED DECEMBER 31, 1999 AND IS QUALIFIED IN ITS ENTIRETY BY REFERENCE TO
SUCH FINANCIAL STATEMENTS.
</LEGEND>
<RESTATED>
<MULTIPLIER> 1,000

<S>                             <C>
<PERIOD-TYPE>                   YEAR
<FISCAL-YEAR-END>                          DEC-31-1999
<PERIOD-START>                             JAN-01-1999
<PERIOD-END>                               DEC-31-1999
<CASH>                                          70,090
<SECURITIES>                                    56,693
<RECEIVABLES>                                   27,782
<ALLOWANCES>                                       848
<INVENTORY>                                        473
<CURRENT-ASSETS>                               168,812
<PP&E>                                          16,210
<DEPRECIATION>                                   7,277
<TOTAL-ASSETS>                                 184,845
<CURRENT-LIABILITIES>                           29,177
<BONDS>                                              0
                                0
                                          0
<COMMON>                                            41
<OTHER-SE>                                     155,112
<TOTAL-LIABILITY-AND-EQUITY>                   184,845
<SALES>                                              0
<TOTAL-REVENUES>                               116,487
<CGS>                                                0
<TOTAL-COSTS>                                  113,787
<OTHER-EXPENSES>                                   136
<LOSS-PROVISION>                                     0
<INTEREST-EXPENSE>                                   0
<INCOME-PRETAX>                                  8,466
<INCOME-TAX>                                       976
<INCOME-CONTINUING>                              7,490
<DISCONTINUED>                                       0
<EXTRAORDINARY>                                      0
<CHANGES>                                            0
<NET-INCOME>                                     7,490
<EPS-BASIC>                                       0.19
<EPS-DILUTED>                                     0.17


</TABLE>


© 2022 IncJournal is not affiliated with or endorsed by the U.S. Securities and Exchange Commission