2026 Zeek Project Survey Results: What We Heard and What’s Next
A huge thank you to the 63 of you who took the time to fill out this year’s community survey. Your feedback gives us a clear, honest look at how Zeek fits into your work, and where the community is (and isn’t yet) pulling its weight.
How Central is Zeek to What You Do?
78% of respondents said they would be very disappointed if they could no longer use Zeek at all. The community itself tells a different story: When we asked the same question about the Zeek community, only 57% said they’d be very disappointed if it disappeared. Both numbers clear the bar for what’s considered strong reliance, but the 20-point gap between them is real. “Zeek the tool” has clearly earned more loyalty than “Zeek the community” has, so far.
What Makes the Community Valuable?
We asked what matters most about the community, and four things rose to the top: Learning directly from other practitioners running Zeek in production, seeing real-world deployment examples, having direct access to maintainers and the core team, and getting depth of discussion that goes beyond what the docs cover.
As one respondent put it, the value is in “leveraging the experience of previous developers” instead of starting from scratch every time.
That lines up with what you told us you want more content on, too. Detection techniques and real-world deployment examples were the two most requested content types. That’s a clear signal for where we put our effort next.
The Impact of Being a Contributor
Among people who’ve contributed to Zeek, 66% said they’d be very disappointed without the community. Among people who are interested in contributing but haven’t yet, that drops to 50%. Among people who aren’t interested in contributing at all, it’s 36%. People who contribute feel more attached to this community than people who don’t, and by a wide margin.
What’s holding people back from contributing matters. When we asked, the two most common answers were tied: not feeling qualified and not having the time. The new Contribution Guide was built to lower that first barrier, but this data tells us that barrier hasn’t fully come down yet. We’re continuing to offer new ways to become a Zeek contributor so that not feeling qualified stops being the reason people hold back.
The Biggest Area for Improvement
Onboarding friction came up again this year, including from people who’ve been using Zeek for years. At the end of last year, Evan put together a scripting tutorial with a video walkthrough to help people get started. It’s a good first step, but Zeek is still known for a steep learning curve and we know there’s more to do here to make it easier for beginners.
What We Are Doing Next
We’re still digesting everything else you shared. Some of it will take time to work through, and some we’re still figuring out what to do with.
The biggest thing on our calendar: small group conversations with community members and the core team about what goes into future Zeek releases. We haven’t done something quite like this before, and we’re looking forward to seeing where these direct conversations take the roadmap.
If you want to talk to the team and the community in person, the Berkeley workshop is coming up on September 10-11 and registration is still open. We’d love for in-person gatherings like this to become a regular part of how the Zeek community connects.
One more thing: even among those who told us they rarely or never engage with the community, every single one said they’d feel at least some loss if it disappeared. If that’s you, you’re getting something real out of this, even quietly. We hope that you continue to engage in a way that feels good to you!
Thank you again to everyone who shared their time and perspective. If you’re joining a roadmap conversation, we’ll be in touch soon!