This summer we asked Zeek users, contributors, and curious newcomers from around the world to take our 2025 Zeek Project Survey. Your feedback was honest, actionable and sometimes quite direct—which was exactly what we needed. Here are a few key themes that stood out, what we took away from them, and how we’re putting your input to work.

Zeek has a global and diverse user base (and it’s growing!).

The survey included 90 responses from 20 countries, with strong participation from the U.S., Canada, India, and various countries across Europe representing a wide range of roles: SOC analysts, security engineers, researchers, educators, students and more.

We saw thoughtful feedback from experienced and advanced users, pointing to Zeek’s depth and long-term value. At the same time, a number of newcomers chimed in, signaling growing interest, curiosity, and new adoption.

Survey respondents came from a wide range of roles, with many selecting more than one.

The survey included a healthy mix of newcomers and experienced users, a strong signal of both growth and depth in the community.

Zeek is powerful. Getting started shouldn’t be the hard part.

Many of you described the early learning experience as slow, dense, or overwhelming:

“It takes too long to get comfortable.”
“The docs are dense.”
“I want to contribute, but I don’t know where to start.”

Zeek remains a go-to tool for network visibility, threat hunting, and detection engineering. But for too many users, the barrier to entry is still too high.

Improving that experience is a priority. We’re starting with our documentation—an ongoing effort to make it easier to navigate and understand for both new and advanced users. We’re also experimenting with new content formats: tutorials, walkthroughs, videos, and other resources designed to meet you where you are.

The goal is simple: faster ramp-up, less friction, and more value from day one.

Many of you want to contribute but need help taking the first step.

About half of you said you’ve contributed to Zeek in some way before. The other half haven’t, but many said you want to.

Respondents shared where they’re most interested in contributing, with sharing use cases, writing blogs, and contributing packages leading the list.

That interest matters. In open source projects, contributions help the project grow, stay relevant, and reflect real-world use cases. We want more contributors, and we want to make the contribution process easier to navigate.

Here’s what you said would help:

• Hands-on opportunities and clear tasks
• Encouragement or direct invites
• Better documentation and contribution guides

We’re following up with those who expressed interest in contributing via the survey. Together, we’ll carve more accessible contribution paths to explore. The goal is to lower the barrier and strengthen the contributor pipeline over time.

You have ideas. We’re taking notes.

We asked what you’d like to see on the Zeek roadmap and got a wide range of responses—some simple, some ambitious, many worth a closer look.

With the Zeek 8.0 release underway, our near-term focus is on landing the release. New feature work isn’t our top priority just yet, but your feedback is on our radar, and we’ll revisit it once 8.0 is out.

Here’s a sample of what you asked for:

• Python support for scripting and integrations
• Improved TLS decryption (broader version and cipher suite support)
• Deeper integration with Suricata and Wireshark
• A GUI or web dashboard for management and visibility
• Easier deployment options (Docker, Kubernetes, NetFlow ingestion)
• More protocol analyzers (IMAP, ICS/SCADA, modern transport protocols)

If any of these areas are important to you (or if you’d like to contribute!) we’d love to hear from you. The survey may be closed, but the conversation isn’t.

What’s Next

Here’s how we’re putting your feedback to work:

In the short term, we are:

• Reaching out to survey respondents who expressed interest in contributing
• Identifying low-lift, high-impact contribution opportunities
• Reviewing current onboarding resources and identifying gaps for different types of users

In the longer term, we’re focused on several key initiatives to improve the contributor and user experience. This includes restructuring the documentation site to improve clarity and navigation, developing a new content series with tutorials, walkthroughs, and real-world use cases, and building a pilot contributor program with clearer roles, better support, and meaningful recognition.

These efforts are directly informed by the survey results. The pain points, ideas, and suggestions you shared are already shaping our roadmap.

So, thank you to everyone who took the time to respond. It’s helping us build the best version of Zeek yet.