The PCNSE exam has been retired since July 31, 2025. The new role-based portfolio, the Next-Generation Firewall Engineer exam and a preparation path.
If you are looking to take the PCNSE in 2026, the first thing to know is that the exam is no longer offered: Palo Alto Networks retired it on July 31, 2025, as part of the move to a role-based certification portfolio. To validate firewall engineering skills today, the closest certification is the Next-Generation Firewall Engineer. This guide explains what has happened to the PCNSE, how the new portfolio is structured and how to prepare for the exam that has effectively replaced it.
The Palo Alto Networks Certified Network Security Engineer certified the ability to deploy and configure the vendor's next-generation firewalls, drawing on the rest of its platform. It was aimed at network security engineers, systems engineers, integrators and support teams.
There are three key points for holders:
Other legacy exams had already been retired before this, notably the PCNSA and the PCCET. Palo Alto Networks states that there is no direct equivalence between old and new certifications, because the former program focused on product knowledge while the new one targets job-related skills.
The vendor's certification page now organizes the offering into four levels:
At the Specialist level, the vendor distinguishes two profiles. "Engineer" certifications cover deployment (so-called "Day One" operations), while "Analyst" certifications cover ongoing operations ("Day Two"). There are no prerequisites to register for a Specialist exam.
For roles related to next-generation firewalls, Palo Alto Networks directs candidates toward several credentials depending on their role:
For most engineers who would have prepared for the PCNSE, the Next-Generation Firewall Engineer is therefore the natural goal.
Launched in late January 2025, this certification validates the configuration of network settings and device settings on PAN-OS equipment, the creation of objects and policies, integration, automation, and firewall management and operations. The datasheet published by the vendor divides the exam into three domains:
In terms of format, the vendor states for its program:
The PAN-OS version covered may change with exam updates. Check the exam guide published by Palo Alto Networks when you register to find out the reference version and the detailed objectives.
The Next-Generation Firewall Engineer datasheet recommends two to three years of IT security experience, including two years on Palo Alto Networks firewalls. It also lists the Network Security Professional and Network Security Analyst as useful certifications beforehand, without making them mandatory.
The expected knowledge covers:
This last point marks a difference from the former approach: an engineer who only uses the graphical interface would do well to become familiar with the API and automation tools before the exam.
Here is a realistic progression for a network administrator aiming for the Next-Generation Firewall Engineer:
If you work in a multi-vendor environment, our article on Fortinet certifications in 2026 presents the equivalent logic at Fortinet, and our overview of cybersecurity certification paths helps position these credentials relative to vendor-neutral certifications.
Securevalley Training offers, in Casablanca, in Témara or remotely, Palo Alto Networks certification preparation courses and complementary paths:
Yes, until its expiration date, which is two years after you passed. After that, you will need to earn one of the new certifications, as no PCNSE recertification exam is planned.
No. Since August 1, 2025, Palo Alto Networks only administers its certification exams at Pearson VUE test centers. Find out where your nearest center is before setting your date.
It is not mandatory. The vendor presents them as recommended steps, but no prerequisites apply at the Specialist level. An engineer who already works with PAN-OS can go straight for the exam.
The Engineer profile covers deploying and integrating solutions, the Analyst profile their day-to-day operation. Choose based on your actual role, not on the title that seems highest.
The PCNSE is now part of the history of the Palo Alto Networks program, but the skills it validated remain in demand. For a firewall engineer, the most direct approach is to prepare for the Next-Generation Firewall Engineer, building on EDU-210 and Panorama, then to strengthen the automation side. Always check the current exam guide before scheduling your exam.