<PAGE>   1
                                                                   EXHIBIT 10.4


[LOGO WITNESS SYSTEMS INC]    OPTION AGREEMENT


1.       EXERCISE PERIOD OF OPTION. Subject to the terms and conditions of this
Option Agreement and the Plan, and unless otherwise modified by a written
modification signed by the Company and Optionee, this Option may be exercised
with respect to all of the Shares, but only according to the vesting schedule
below and as described in Section 10 below, prior to the date which is the last
day of the Term set forth herein following the date of grant (hereinafter
"Expiration Date").

2.       RESTRICTIONS ON EXERCISE. This Option may not be exercised, unless
such exercise is in compliance with the Securities Act of 1933 and all
applicable state securities laws, as they are in effect on the date of
exercise, and the requirements of any stock exchange or national market system
on which the Company's Common Stock may be listed or traded at the time of
exercise. Optionee understands that the Company is under no obligation to
register, qualify or list the Shares with the Securities and Exchange
Commission ("SEC"), any state securities commission or any stock exchange to
effect such compliance.

3.       TERMINATION OF OPTION. Except as provided below in this Section, this
Option may not be exercised after the date which is thirty (30) days after
Optionee ceases to perform services for the Company, or any Parent or
Subsidiary. Optionee shall be considered to perform services for the Company,
or any Parent or Subsidiary, for all purposes under this Section and Section 10
hereof, if Optionee is an officer or full-time employee of the Company, or any
Parent or Subsidiary, or if the Board determines that Optionee is rendering
substantial services as a part-time employee, consultant, contractor or advisor
to the Company, or any Parent or Subsidiary. The Board shall have discretion to
determine whether Optionee has ceased to perform services for the Company, or
any Parent or Subsidiary, and the effective date on which such services cease
(the


<PAGE>   2


"Termination Date"). Notwithstanding anything contained herein to the contrary,
if the corporate position of Optionee is, at any time, altered or revised such
that Optionee's responsibilities are materially reduced or decreased for any
reason, as determined by the Board in its sole discretion, the vesting of
Shares under Section 10 shall cease, effective as of the date of such reduction
in Optionee's employment responsibilities; provided, however, except as
otherwise provided in this Option and the Plan, Optionee shall have the right
to exercise this Option with respect to Shares which have vested under Section
10 as of the date of such reduction of Optionee's responsibilities.

         (a)      Termination Generally. If Optionee ceases to perform services
for the Company, or any Parent or Subsidiary, for any reason, except death or
disability (within the meaning of Code Section 22(e)(3)), this Option shall
immediately be forfeited, along with any and all rights or subsequent rights
attached thereto, thirty (30) days following the Termination Date, but in no
event later than the Expiration Date.

         (b)      Death or Disability. If Optionee ceases to perform services
for the Company, or any Parent or Subsidiary, as a result of the death or
disability of Optionee (as determined by the Board in its sole discretion),
this Option, to the extent (and only to the extent) that it would have been
exercisable by Optionee on the Termination Date, may be exercised by Optionee
(or, in the event of Optionee's death, by Optionee's legal representative)
within ninety (90) days after the Termination Date, but in no event later than
the Expiration Date.

         (c)      No Right to Employment. Nothing in the Plan or this Stock
Option Grant Agreement shall confer on Optionee any right to continue in the
employ of, or other relationship with, the Company, or any Parent or
Subsidiary, or limit in any way the right of the Company, or any Parent or
Subsidiary, to terminate Optionee's employment or other relationship at any
time, with or without cause.

4.       MANNER OF EXERCISE.

         (a)      Exercise Agreement. This Option shall be exercisable by
delivery to the Company of an executed Exercise Agreement ("Exercise
Agreement") in the form delivered to Optionee, if applicable, or in such other
form as may be approved or accepted by the Company from time to time, which
shall set forth Optionee's election to


<PAGE>   3


exercise this Option, the number of Shares being purchased, any restrictions
imposed on the Shares, and such other representations and agreements as may be
required by the Company to comply with applicable securities laws.

         (b)      Exercise Price. Such notice shall be accompanied by full
payment of the Exercise Price for the Shares being purchased. Payment for the
Shares may be made in U.S. dollars in cash (by check) or, where permitted by
law and approved in advance and in writing by the Board in its sole discretion:
(i) by cancellation of indebtedness of the Company to Optionee; (ii) by
surrender of shares of Common Stock of the Company that have been owned by
Optionee for more than six (6) months (and which have been paid for within the
meaning of SEC Rule 144, and, if such shares were purchased from the Company by
use of a promissory note, such note has been fully paid with respect to such
shares), or were obtained by Optionee in the open public market, having a Fair
Market Value equal to the Exercise Price of the Shares being purchased; (iii)
by instructing the Company to withhold Shares otherwise issuable pursuant to
the exercise of the Option having a Fair Market Value equal to the Exercise
Price of the Shares being purchased (including the withheld Shares); (iv) by
waiver of compensation accrued by Optionee for services rendered; (v) by
delivery to the Company of a promissory note executed by Optionee which shall
include such terms and conditions as the Board shall approve in accordance with
the terms and conditions of the Plan; or (vi) a combination of the foregoing.

         (c)      Withholding Taxes. Prior to the issuance of Shares upon
exercise of this Option, Optionee must pay, or make adequate provision for, any
applicable federal or state withholding obligations of the Company. Where
approved by the Board or its Compensation Committee, Optionee may provide for
payment of withholding taxes upon exercise of the Option by requesting that the
Company retain Shares with a Fair Market Value equal to the minimum amount of
taxes required to be withheld. In such case, the Company shall issue the net
number of Shares to Optionee by deducting the Shares retained from the Shares
exercised.


<PAGE>   4


         (d)      Issuance of Shares. Provided that such notice and payment are
in form and substance satisfactory to counsel for the Company, the Company
shall cause the Shares to be issued in the name of Optionee or Optionee's legal
representative.

5.       NOTICE OF DISQUALIFYING DISPOSITION OF ISO SHARES. If this Option is
an ISO, and if Optionee sells or otherwise disposes of any of the Shares
acquired pursuant to the ISO on or before the later of: (a) the date two (2)
years after the Date of Grant, or (b) the date one (1) year after exercise of
the ISO, with respect to the Shares to be sold or disposed, Optionee shall
immediately notify the Company in writing of such sale or disposition. Optionee
acknowledges and agrees that Optionee may be subject to income tax withholding
by the Company on the compensation income recognized by Optionee from any such
early disposition by payment in cash or out of the current wages or earnings
payable to Optionee.

6.       NONTRANSFERABILITY OF OPTION. This Option may not be transferred in
any manner, other than by will or by the laws of descent and distribution, and
may be exercised during Optionee's lifetime only by Optionee. The terms of this
Option shall be binding upon the executor, administrators, successors and
assigns of Optionee.


7.       TAX CONSEQUENCES. OPTIONEE UNDERSTANDS THAT THE GRANT AND EXERCISE OF
THIS OPTION, AND THE SALE OF SHARES OBTAINED THROUGH THE EXERCISE OF THIS
OPTION, MAY HAVE TAX IMPLICATIONS THAT COULD RESULT IN ADVERSE TAX CONSEQUENCES
TO OPTIONEE. OPTIONEE REPRESENTS THAT OPTIONEE HAS CONSULTED WITH, OR WILL
CONSULT WITH, HIS OR HER TAX ADVISOR AND OPTIONEE FURTHER ACKNOWLEDGES THAT
OPTIONEE IS NOT RELYING OF THE COMPANY FOR ANY FINANCIAL, TAX OR OTHER ADVICE.

8.       INTERPRETATION. Any dispute regarding the interpretation of this
Option Agreement shall be submitted by Optionee or the Company to the Board,
which shall review such dispute at its next regular meeting. The resolution of
such a dispute by the Board shall be final and binding on the Company and
Optionee.

9.       ENTIRE AGREEMENT. The Plan and the Exercise Agreement are incorporated
herein by this reference. Optionee acknowledges and agrees that the granting of
this Option constitutes a full accord, satisfaction and release of all
obligations or commitments made


<PAGE>   5


to Optionee by the Company or any of its officers, directors, shareholders or
affiliates with respect to the issuance of any securities, or rights to acquire
securities, of the Company or any of its affiliates. This Option Agreement, the
Plan and the Exercise Agreement constitute the entire agreement of the parties
hereto, and supersede all prior undertakings and agreements with respect to the
subject matter hereof.

10.      EXERCISABILITY OF OPTION. Subject to the terms of the Plan, this
Option and the Exercise Agreement, the issuance of Shares pursuant to the
exercise of this Option shall be subject to the limitations set forth in this
Option Agreement and defined below. For purposes of this Section, "Continuous
Service" means a period of continuous performance of services by Optionee for
the Company, a Parent, or a Subsidiary, as determined by the Board.

                           [Insert Vesting Schedule]

         If Optionee's employment with the Company is terminated by the Company
other than for Cause (as defined below) or by Optionee for Good Reason (as
defined below) at any time (i) during the ninety (90) day period before a
Change of Control (as defined below) and (ii) for [Insert Time Period] after a
Change of Control, then (A) the Option granted hereby, if less that fully
vested as of the Date of Termination (as defined herein), shall be deemed fully
vested and exercisable; provided, that acceleration in vesting does not
adversely impact the availability of pooling of interests accounting treatment,
as such determination is made by the Board in its reasonable discretion and (B)
Section 3 (other than the second sentence thereof) shall be deleted and
replaced with the following: "This Option may not be exercised more than one
hundred eighty (180) days from the later of: Optionee's Date of Termination or
date Optionee ceases to perform services for the Company, or any Parent or
Subsidiary (which date shall be determined by the Board in its reasonable
discretion)."

         Definitions. For purposes of Section 10 of this Option, the following
         definitions shall apply:

         1.       Change of Control. A "Change of Control" shall be
         conclusively deemed to have occurred if (and only if) any of the
         following shall have taken place: (i) a Change of Control is reported
         by the Company in


<PAGE>   6


         response to either Item 6(e) of Schedule 14A of Regulation 14A
         promulgated under the Securities Exchange Act of 1934, as amended
         ("Exchange Act"), or Item 1 of Form 8-K promulgated under the Exchange
         Act; (ii) any person (as such term is used in Section 13(d) and
         14(d)(2) of the Exchange Act) is or becomes the beneficial owner (as
         defined in Rule 13d-3 under the Exchange Act) directly or indirectly,
         of securities of the Company representing fifty percent (50%) or more
         of the combined voting power of the Company's then outstanding
         securities; or (iii) following the election or removal of directors, a
         majority of the Board consists of individuals who were not members of
         the Board two years before such election or removal, unless the
         election of each director who was not a director at the beginning of
         such two-year period has been approved in advance by directors
         representing at least a majority of the directors then in office who
         were directors at the beginning of the two-year period.

         2.       Date of Termination. "Date of Termination" means the date on
         which a notice of termination is given either by the Company or by
         Optionee.

         3.       Good Reason. "Good Reason" means Optionee's termination of
         employment for any of the following events, unless such event occurs
         with Optionee's express prior written consent:

                  (a)      The assignment to Optionee of any duties materially
                  inconsistent with, or a material diminution of, [Insert
                  Scope] with the Company as in effect immediately prior to the
                  Change of Control of the Company, except in connection with
                  the termination of Optionee's employment for disability,
                  retirement, or Cause or as a result of Optionee's death or
                  termination of employment other than for Good Reason;

                  (b)      A reduction of fifteen percent (15%) or more in
                  Optionee's base salary as in effect on the date hereof or as
                  the same may be increased from time to time;


<PAGE>   7


                  (c)      A change in the location of Optionee's principal
                  place of employment by more than one hundred (100) miles from
                  the location where he was principally employed immediately
                  prior to the Change of Control;

                  (d)      Any material breach by the Company of any provision
                  of this Option; or

                  (e)      Any failure by the Company to obtain the assumption
                  of this Option by any successor or assign of the Company.

         4.       Cause. "Cause" means termination of Optionee's employment
         under any one or more of the following events:

                  (a)      Optionee's knowing and willful misconduct with
                  respect to the business and affairs of the Company;

                  (b)      Any material violation by Optionee of any policy of
                  the Company relating to ethical conduct or practices or
                  fiduciary duties of a similarly situated executive;

                  (c)      Knowing and willful material breach of any provision
                  of this Agreement which is not remedied within thirty (30)
                  days after Optionee's receipt of notice thereof;

                  (d)      Optionee's commission of a felony or any illegal act
                  involving moral turpitude or fraud or Optionee's dishonesty
                  which may reasonably be expected to have a material adverse
                  effect on the Company; and/or

                  (e)      Failure to comply with reasonable directives of the
                  Board which are consistent with Optionee's duties, if not
                  remedied within thirty (30) days after Optionee's receipt of
                  notice thereof.