Tumbleweed Communications Chooses Fortify Software to Boost Security of Internet Communication

February 5 2007

Fortify Software Inc., the market-leading provider of software security products, announced that Tumbleweed(R) Communications Corp. has adopted Fortify(R) Source Code Analysis (SCA) as its software security solution. Tumbleweed's comprehensive approach to securing online communications allows organizations to ensure that all their email, file transfer, and Web interactions and transactions are private, reliable, and efficient.

"Our products enable customers to protect themselves from spam, validate their employees' and customers' identities, and provide secure Web transactions," said Dr. Taher Elgamal, Chief Technology Officer at Tumbleweed. "Tumbleweed is proactive about securing the technology that enables these products, and Fortify allows us to ensure that security while meeting our customers' demands."

Founded in 1993, Tumbleweed is trusted by over 2,300 customers in the enterprise and government markets. Tumbleweed is using Fortify SCA to eliminate security vulnerabilities from its three comprehensive product suites:

*MailGate(R) provides protection against spam, viruses and attacks, and

enables policy-based message filtering, encryption and routing.

*SecureTransport(TM) enables business to safely exchange large files and

transactions without proprietary software.

*Validation Authority(TM) is the world-leading solution for determining

the validity of digital certificates.

About Fortify Source Code Analysis

Fortify SCA is the world's most proven and widely used source code security analysis solution. Its advanced features enable security professionals to review more code and prioritize issues in less time, while helping development teams identify and fix issues early and with less effort. Fortify SCA supports a wide variety of languages, frameworks and operating systems and delivers depth and accuracy in its results. It can be tuned to be comprehensive when completeness is needed or extremely targeted for day-to-day use in development. It makes triage, full-scale audits and remediation fast and effective.

About Fortify Software, Inc.

Fortify Software products protect companies from the threats posed by security flaws in business-critical software applications. Its software security products, Fortify SCA, Fortify Manager, Fortify Tracer and Fortify Defender, drive down costs and security risks by automating key processes of developing and deploying secure applications. Fortify Software's customers include government agencies and Fortune 500 companies in a wide variety of industries such as financial services, healthcare, e-commerce, telecommunications, publishing, insurance, systems integration and information management. The company is backed by a world-class team of software security experts and partners. More information is available at http://www.fortifysoftware.com

About Tumbleweed Communications Corp.

Tumbleweed provides world-class innovative messaging security solutions for organizations of all sizes. Organizations rely on Tumbleweed's solutions to securely manage their Internet communications, spanning email management to file transfers. Tumbleweed has more than 2,300 customers worldwide, representing industries such as Finance, Healthcare, and the U.S. Government. The world's most security conscious organizations rely upon Tumbleweed technology including Bank of America Securities, JP Morgan Chase & Co., the U.S. Food and Drug Administration, and the U.S. Department of Defense. Our award-winning products build on thirteen years of R&D and 25 security patents in the U.S. alone -- many of which are licensed by other security vendors, http://www.tumbleweed.com/company/patents/patent_licenses.html . For more information, visit http://www.tumbleweed.com .

Tumbleweed Safe Harbor Statement

Tumbleweed cautions that forward-looking statements contained in this press release are based on current plans and expectations as of the date of this press release, and that a number of factors could cause the actual results to differ materially from the guidance given at this time. These factors are described in the Safe Harbor statement below.

Except for the historical information contained herein, the matters discussed in this press release may constitute forward-looking statements that involve risks and uncertainties that could cause actual results to differ materially from those projected, particularly with respect to Tumbleweed's continued use of Fortify's products and services, as well as the effectiveness of those products and services. In some cases, forward-looking statements can be identified by terminology such as "may," "will," "should," "potential," "continue," "expects," "anticipates," "intends," "plans," "believes," "estimates," and similar expressions. For further cautions about the risks of investing in Tumbleweed, we refer you to the documents Tumbleweed files from time to time with the Securities and Exchange Commission, particularly Tumbleweed's Form 10-K filed March 16, 2006 and Form 10-Q filed November 9, 2006.

Tumbleweed assumes no obligation to update information contained in this press release. Although this release may remain available on Tumbleweed's website or elsewhere, its continued availability does not indicate that Tumbleweed is reaffirming or confirming any of the information contained herein.

NOTE: Tumbleweed, MailGate, SecureTransport and Validation Authority are either registered trademarks or trademarks of Tumbleweed Communications Corp. in the United States and/or other countries. All other trademarks are the property of their respective owners.