LOAN MODIFICATION AGREEMENT

This Loan Modification Agreement is entered into as of November    , 2002 by and betweenWITNESS
SYSTEMS, INC.,a Delaware corporation ("Borrower") whose address is 300 Colonial Center Parkway, Roswell, Georgia 30076, andSILICON VALLEY
BANK("Lender"), a California-chartered bank with a principal place of business at 3003 Tasman Drive, Santa Clara, CA 95054 and with a loan production office located at 3343
Peachtree Road, Suite 312, Atlanta, GA 30326.

A.DESCRIPTION OF EXISTING INDEBTEDNESS:Among other indebtedness which may be owing by Borrower to Lender, Borrower is or may
become indebted to Lender pursuant to, among other documents, a Loan and Security Agreement, dated April 3, 2002, as may be amended from time to time, in the original principal amount of Seven
Million Five Hundred Thousand Dollars ($7,500,000) (the "Loan Agreement"). The Loan Agreement provides for, among other things, a Committed Line in the original principal amount of Seven Million Five
Hundred Thousand Dollars ($7,500,000) (the "Revolving Facility"). Hereinafter, all indebtedness owing by Borrower to Lender shall be referred to as the "Indebtedness."

B.DESCRIPTION OF COLLATERAL.Repayment of the Indebtedness is secured by the Collateral as described in the Loan Agreement.

Hereinafter,
the above-described security documents, together with all other documents securing repayment of the Indebtedness shall be referred to as the "Security Documents".
Hereinafter, the Security Documents, together with all other documents evidencing or securing the Indebtedness shall be referred to as the "Existing Loan Documents".

C.MODIFICATION(S) TO LOAN AGREEMENT.

1.    Section 2.1
of the Loan Agreement is hereby amended by deleting clause (a) of subsection 2.1.1 thereof in its entirety and by substituting therefor a new
clause (a) to read as follows:



2.    Section 2.1
of the Loan Agreement is hereby amended by deleting subsection 2.1.2 thereof in its entirety and by substituting therefor a new subsection 2.1.2 to
read as follows:



3.    Section 2.1
of the Loan Agreement is hereby further amended by adding at the end thereof a new subsection 2.1.4 to read as follows:



---



4.    Section 2.3
of the Loan Agreement is hereby amended by deleting the first sentence in clause (a) thereof in its entirety and by substituting therefor a new
sentence to read as follows:



5.    Section 6.7
of the Loan Agreement is hereby amended by changing the period at the end of clause (ii) thereof to a semi-colon and by inserting
after the semi-colon the phrase "; provided, however, at any time that the Quick Ratio is less than 2.0 to 1.0, this covenant will be tested on a monthly basis."

6.    Section 13.1
of the Loan Agreement is hereby amended by deleting in their entirety the definitions of "Borrowing Base," "Committed Revolving Line," "Revolving
Maturity Date" and Revolving Promissory Note" contained therein and by substituting therefor new definitions of "Borrowing Base," "Committed Revolving Line," "Revolving Maturity Date" and Revolving
Promissory Note" to read as follows:



7.    The
Loan Agreement is hereby further amended by adding as Exhibit E thereto the LIBOR Supplement to Loan Agreement, in the form attached hereto and incorporated
herein by reference.

D.CONSISTENT CHANGES.The Existing Loan Documents are hereby amended wherever necessary to reflect the changes described
above.

E.PAYMENT OF LOAN FEE.Borrower shall pay to Lender a fee in the amount of Thirty Thousand Dollars ($30,000) (the "Loan Fee")
plus all out-of-pocket expenses. The Loan Fee shall be payable as follows: $10,000 shall be payable on the date hereof and the balance of the Loan Fee shall

2

---

be payable on the date of the first Advance made to the Borrower on or after the date hereof. If the Revolving Facility expires without any Advance having been made under it, the Borrower's
obligation to pay the $20,000 balance of the Loan Fee shall terminate.

F.NO DEFENSES OF BORROWER.Borrower (and each guarantor and pledgor signing below) agrees that it has no defenses against the
obligations to pay any amounts under the Indebtedness.

G.CONTINUING VALIDITY.Borrower (and each guarantor and pledgor signing below) understands and agrees that in modifying the
existing Indebtedness, Lender is relying upon Borrower's representations, warranties, and agreements, as set forth in the Existing Loan Documents. Except as expressly modified pursuant to this Loan
Modification Agreement, the terms of the Existing Loan Documents remain unchanged and in full force and effect. Lender's agreement to modifications to the existing Indebtedness pursuant to this Loan
Modification Agreement in no way shall obligate Lender to make any future modifications to the Indebtedness. Nothing in this Loan Modification Agreement shall constitute a satisfaction of the
Indebtedness. It is the intention of Lender and Borrower to retain as liable parties all makers and endorsers of Existing Loan Documents, unless the party is expressly released by Lender in writing.
No maker, endorser, or guarantor will be released by virtue of this Loan Modification Agreement. The terms of this paragraph apply not only to this Loan Modification Agreement, but also to all
subsequent loan modification agreements.

H.CONDITIONS.The effectiveness of this Loan Modification Agreement is conditioned upon the following:

1.    Borrower's
payment of the Loan Fee;

2.    Delivery
of a Revolving Credit Note reflecting the terms of this Loan Modification Agreement; and

3.    Such
other instruments, documents and agreements as the Bank or its counsel shall request.

This
Loan Modification Agreement is executed as of the date first written above.

|BORROWER:             |  | LENDER:            
|--------------------- |  | -------------------
|WITNESS SYSTEMS, INC. |  | SILICON VALLEY BANK
|By:                   |  |                    
|                      |  |                    
|Name:                 |  |                    
|                      |  |                    
|Title:                |  |                    
|                      |  |                    

3

---

Exhibit E  To  Loan and Security Agreement

LIBOR SUPPLEMENT TO LOAN AGREEMENT

This LIBOR Supplement to Loan Agreement (the "Supplement") is a supplement to the Loan and Security Agreement (as heretofore, now or hereafter amended, the "Loan
Agreement") dated as of April 3, 2002, betweenSILICON VALLEY BANK("Bank") andWITNESS
SYSTEMS, INC.("Borrower"), and forms a part of and is incorporated into the Loan Agreement.

1.Definitions.

"Business
Day" means a day of the year (a) that is not a Saturday, Sunday or other day on which banks in the State of California or the City of London are authorized or required
to close and (b) on which dealings are carried on in the interbank market in which Bank customarily participates.

"Interest
Period" means for each LIBOR Rate Loan, a period of approximately one, two or three months as the Borrower may elect,providedthat the last day of an Interest Period for a LIBOR Rate Loan shall be determined in accordance with the practices of the LIBOR interbank market as from time to time in effect, provided,further, in all cases such period shall expire not later than the Revolving Maturity Date.

"Interest
Rate" shall mean as to: (a) Prime Rate Loans, a rate of 0% per annum in excess of the Prime Rate; and (b) LIBOR Rate Loans, a rate of 3% per annum in excess of
the LIBOR Rate (based on the LIBOR Rate applicable for the Interest Period selected by the Borrower).

"LIBOR
Base Rate" means, for any Interest Period for a LIBOR Rate Loan, the rate of interest per annum determined by Bank to be the per annum rate of interest as which deposits in United
States Dollars are offered to Bank in the London interbank market in which Bank customarily participates at 11:00 A.M. (local time in such interbank market) two (2) Business Days before
the first day of such
Interest Period for a period approximately equal to such Interest Period and in an amount approximately equal to the amount of such Loan.

"LIBOR
Rate" shall mean, for any Interest Period for a LIBOR Rate Loan, a rate per annum (rounded upwards, if necessary, to the nearest 1/16 of 1%) equal to (i) the LIBOR Base
Rate for such Interest Period divided by (ii) 1 minus the Reserve Requirement for such Interest Period.

"LIBOR
Rate Loans" means any Loans made or a portion thereof on which interest is payable based on the LIBOR Rate in accordance with the terms hereof.

"Prime
Rate" means the variable rate of interest per annum, most recently announced by Bank as its "prime rate," whether or not such announced rate is the lowest rate available from
Bank. The interest rate applicable to the Prime Rate Loans shall change on each date there is a change in the Prime Rate.

"Prime
Rate Loans" means any Loans made or a portion thereof on which interest is payable based on the Prime Rate in accordance with the terms hereof.

"Regulatory
Change" means, with respect to Bank, any change on or after the date of this Loan Agreement in United States federal, state or foreign laws or regulations, including
Regulation D, or the adoption or making on or after such date of any interpretations, directives or requests applying to a class of lenders including Bank of or under any United States federal
or state, or any foreign, laws or regulations (whether or not having the force of law) by any court or governmental or monetary authority charged with the interpretation or administration thereof.

"Reserve
Requirement" means, for any Interest Period, the average maximum rate at which reserves (including any marginal, supplemental or emergency reserves) are required to be
maintained during such Interest Period under Regulation D against "Eurocurrency liabilities" (as such term is used in Regulation D) by member banks of the Federal Reserve System. Without
limiting the effect of the

---

foregoing, the Reserve Requirement shall reflect any other reserves required to be maintained by Bank by reason of any Regulatory Change against (i) any category of liabilities which includes
deposits by reference to which the LIBOR Rate is to be determined as provided in the definition of "LIBOR Base Rate" or (ii) any category of extensions of credit or other assets which include
Loans.

2.Requests for Loans; Confirmation of Initial Loans.Each LIBOR Rate Loan shall be made upon the irrevocable
written request of Borrower received by Bank not later than 11:00 a.m. (Eastern time) on the Business Day three (3) Business Days prior to the date such Loan is to be made. Each such
notice shall specify the date such Loan is to be made, which day shall be a Business Day; the amount of such Loan, the Interest Period for such Loan, and comply with such other requirements as Bank
determines are reasonable or desirable in connection therewith.

Each
written request for a LIBOR Rate Loan shall be in the form of a LIBOR Rate Loan Borrowing Certificate as set forth on Exhibit A, which shall be duly executed by the Borrower.

Each
Prime Rate Loan shall be made upon the irrevocable written request of Borrower received by Bank not later than 3:00 p.m. (Eastern time) on the Business Day such Loan is to be
made. Each such notice shall specify the date such Loan is to be made, which day shall be a Business Day and the amount of such Loan, and comply with such other requirements as Bank determines are
reasonable or desirable in connection therewith.

3.Conversion/Continuation of Loans.

(a)  Borrower
may from time to time submit in writing a request that Prime Rate Loans be converted to LIBOR Rate Loans or that any existing LIBOR Rate Loans continue for an
additional Interest Period. Such request shall specify the amount of the Prime Rate Loans which will constitute LIBOR Rate Loans (subject to the limits set forth below) and the Interest Period to be
applicable to such LIBOR Rate Loans. Each written request for a conversion to a LIBOR Rate Loan or a continuation of a LIBOR Rate Loan shall be substantially in the form of a LIBOR Rate
Conversion/Continuation Certificate as set forth on Exhibit B, which shall be duly executed by the Borrower. Subject to the terms and conditions contained herein, three (3) Business Days
after Bank's receipt of such a request from Borrower, such Prime Rate Loans shall be converted to LIBOR Rate Loans or such LIBOR Rate Loans shall continue, as the case may be.

(b)  Any
LIBOR Rate Loans shall automatically convert to Prime Rate Loans upon the last day of the applicable Interest Period, unless Bank has received and approved a
complete and proper request to continue such LIBOR Rate Loan at least three (3) Business Days prior to such last day in accordance with the terms hereof. Any LIBOR Rate Loans shall, at Bank's
option, convert to Prime Rate Loans in the event that (i) an Event of Default, or event which with the notice or passage of time or both would constitute an Event of Default, shall exist,
(ii) this Supplement or the Loan Agreement shall terminate, or (iii) the aggregate principal amount of the Prime Rate Loans which have previously been converted to LIBOR Rate Loans, or
the aggregate principal amount of existing LIBOR Rate Loans continued, as the case may be, at the beginning of an Interest Period shall at any time during such Interest Period exceeds the Borrowing
Base. Borrower agrees to pay to Bank, upon demand by Bank (or Bank may, at its option, charge Borrower's loan account) any amounts required to compensate Bank for any loss (including loss of
anticipated profits), cost or expense incurred by such person, as a result of the conversion of LIBOR Rate Loans to Prime Rate Loans pursuant to any of the foregoing.

4.Additional Requirements/Provisions Regarding LIBOR Rate Loans; Etc.

(a)  Except
as provided in Section 4(e) hereof, if for any reason (including voluntary or mandatory prepayment or acceleration), Bank receives all or part of the
principal amount of a LIBOR Rate Loan prior to the last day of the Interest Period for such Loan, Borrower shall immediately notify Borrower's account officer at Bank and, on demand by Bank, pay Bank
the amount (if any) by which (i) the additional interest which would have been payable on the amount so received had it not been received

2

---

until the last day of such Interest Period exceeds (ii) the interest which would have been recoverable by Bank by placing the amount so received on deposit in the certificate of deposit
markets or the offshore currency interbank markets or United States Treasury investment products, as the case may be, for a period starting on the date on which it was so received and ending on the
last day of such Interest Period at the interest rate determined by Bank in its reasonable discretion. Bank's determination as to such amount shall be conclusive absent manifest error.

(b)  Borrower
shall pay to Bank, upon demand by Bank, from time to time such amounts as Bank may determine to be necessary to compensate it for any costs incurred by Bank
that Bank determines are attributable to its making or maintaining of any amount receivable by Bank hereunder in respect of any Loans relating thereto (such increases in costs and reductions in
amounts receivable being herein called "Additional Costs"), in each case resulting from any Regulatory Change which:



Bank
will notify Borrower of any event occurring after the date of the Loan Agreement which will entitle Bank to compensation pursuant to this section as promptly as practicable after it obtains
knowledge thereof and determines to request such compensation. Bank will furnish Borrower with a statement setting forth the basis and amount of each request by Bank for compensation under this
Section 4. Determinations and allocations by Bank for purposes of this Section 4 of the effect of any Regulatory Change on its costs of maintaining its obligations to make Loans or of
making or maintaining Loans or on amounts receivable by it in respect of Loans, and of the additional amounts
required to compensate Bank in respect of any Additional Costs, shall be conclusive absent manifest error.

(c)  Borrower
shall pay to Bank, upon the request of Bank, such amount or amounts as shall be sufficient (in the sole good faith opinion of such Bank) to compensate it for
any loss, costs or expense incurred by it as a result of any failure by Borrower to borrow a Loan on the date for such borrowing specified in the relevant notice of borrowing hereunder.

(d)  If
Bank shall determine that the adoption or implementation of any applicable law, rule, regulation or treaty regarding capital adequacy, or any change therein, or any
change in the interpretation or administration thereof by any governmental authority, central bank or comparable agency charged with the interpretation or administration thereof, or compliance by Bank
(or its applicable lending office) with any respect or directive regarding capital adequacy (whether or not having the force of law) of any such authority, central bank or comparable agency, has or
would have the effect of reducing the rate of return on capital of Bank or any person or entity controlling Bank (a "Parent") as a consequence of its obligations hereunder to a level below that which
Bank (or its Parent) could have achieved but for such adoption, change or compliance (taking into consideration its policies with respect to capital adequacy) by an amount deemed by Bank to be
material, then from time to time, within 15 days after demand by Bank, Borrower shall pay to Bank such additional amount or amounts as will compensate Bank for such reduction. A statement of
Bank claiming compensation under this Section and setting forth the additional amount or amounts to be paid to it hereunder shall be conclusive absent manifest error.

3

---

(e)  If
at any time Bank, in its sole and absolute discretion, determines that: (i) the amount of the LIBOR Rate Loans for periods equal to the corresponding Interest
Periods are not available to Bank in the offshore currency interbank markets, or (ii) the LIBOR Rate does not accurately reflect the cost to Bank of lending the LIBOR Rate Loan, then Bank shall
promptly give notice thereof to Borrower, and upon the giving of such notice Bank's obligation to make the LIBOR Rate Loans shall terminate, unless Bank and the Borrower agree in writing to a
different interest rate applicable to LIBOR Rate Loans. If it shall become unlawful for Bank to continue to fund or maintain any Loans, or to perform its obligations hereunder, upon demand by Bank,
Borrower shall prepay the Loans in full with accrued interest thereon and all other amounts payable by Borrower hereunder (provided, however, that no amount shall be payable pursuant to
Section 4(a) in connection with such prepayment).

(f)    The
Bank's obligation to make any LIBOR Rate Loan or to convert any Prime Rate Loan to a LIBOR Rate Loan shall be subject to the requirements that:



Any
request by Borrower to receive a LIBOR Rate Loan, to convert Prime Rate Loans to LIBOR Rate Loans or continue any existing LIBOR Rate Loans shall be irrevocable. Notwithstanding
anything to the contrary contained herein, Bank shall not be required to purchase United States Dollar deposits in the London interbank market or other applicable LIBOR Rate market to fund any LIBOR
Rate Loans, but the provisions hereof shall be deemed to apply as if Bank had purchased such deposits to fund the LIBOR Rate Loans.

4

---



EXHIBIT A    LIBOR RATE LOAN BORROWING CERTIFICATE

The
undersigned hereby certifies as follows:

I,                        ,
am the duly elected and acting                        of Witness Systems, Inc. ("Borrower").

This
certificate is delivered pursuant to Section 2 of that certain LIBOR Supplement to Agreement together with theLoan and Security
Agreementby and between Borrower and Silicon Valley Bank ("Bank") (the "Loan Agreement"). The terms used in this Borrowing Certificate which are defined in the Loan Agreement
have the same meaning herein as ascribed to them therein.

Borrower
hereby requests on                        , 20    LIBOR Rate Loan (the "Loan") as follows:

(a)  The
date on which the Loan is to be made is                        20    .

(b)  The
amount of the Loan is to be                        
($                        ), for an Interest Period
of                        month(s).

All
representations and warranties of Borrower stated in the Loan Agreement are true, correct and complete in all material respects as of the date of this request for a loan; provided,
however, that those representations and warranties expressly referring to another date shall be true, correct and complete in all material respects as of such date.

IN
WITNESS WHEREOF, this Borrowing Base Certificate is executed by the undersigned as of this                        day
of                        , 20    .

| |  | WITNESS SYSTEMS, INC.
| |  | ---------------------
| |  | By:                  
| |  |                      
| |  | Title:               
| |  |                      

For Internal Bank Use Only

|LIBOR Pricing Date |  | LIBOR Rate |  | LIBOR Rate Variance |  | Maturity Date
|------------------ |  | ---------- |  | ------------------- |  | -------------
|                   |  |            |  |                     |  |              
|                   |  |            |  | %                   |  |              

5

---

EXHIBIT B    LIBOR RATE CONVERSION/CONTINUATION CERTIFICATE

The
undersigned hereby certifies as follows:

I,                        ,
am the duly elected and acting                        of Witness Systems, Inc. ("Borrower").

This
certificate is delivered pursuant to Section 3 of that certain LIBOR Supplement to Agreement together with the Loan and Security Agreement by and between Borrower and Silicon
Valley Bank ("Bank") (the "Loan Agreement"). The terms used in this LIBOR Rate Conversion/Continuation Certificate which are defined in the Loan Agreement have the same meaning herein as ascribed to
them therein.

Borrower
hereby requests on                        , 20    a LIBOR Rate Loan (the "Loan") as follows:

|(a) |  | / /                                                                                                                                             |  | (i)  |  | A rate conversion of an existing Prime Rate Loan from a Prime Rate Loan to a LIBOR Rate Loan; or
|--- |  | ----------------------------------------------------------------------------------------------------------------------------------------------- |  | ---- |  | ------------------------------------------------------------------------------------------------
|    |  | / /                                                                                                                                             |  | (ii) |  | A continuation of an existing LIBOR Rate Loan as a LIBOR Rate Loan;                             
|    |  |                                                                                                                                                 |  |      |  | [Check (i) or (ii) above]                                                                       
|(b) |  | The date on which the Loan is to be made is                        20    .                                                                     
|(c) |  | The amount of the Loan is to be                        
($                        ), for an Interest Period
of                        month(s).

All
representations and warranties of Borrower stated in the Loan Agreement are true, correct and complete in all material respects as of the date of this request for a loan; provided,
however, that those representations and warranties expressly referring to another date shall be true, correct and complete in all material respects as of such date.

IN
WITNESS WHEREOF, this LIBOR Rate Conversion/Continuation Certificate is executed by the undersigned as of
this                        day
of                        , 20    .

| |  | WITNESS SYSTEMS, INC.
| |  | ---------------------
| |  | By:                  
| |  |                      
| |  | Title:               
| |  |                      

For Internal Bank Use Only

|LIBOR Pricing Date |  | LIBOR Rate |  | LIBOR Rate Variance |  | Maturity Date
|------------------ |  | ---------- |  | ------------------- |  | -------------
|                   |  |            |  |                     |  |              
|                   |  |            |  | %                   |  |              

6

---

QuickLinks