Skip to content
CertGPS

Palo Alto Retired the PCNSE: What Replaced It and What Holders Should Do

News and updates

The PCNSE exam retired on July 31, 2025. What Palo Alto Networks offers firewall engineers now, what each exam costs, and how long an existing PCNSE stays active.

Published
Updated
Read time
4 min
C
CertGPS

Not independently reviewed

AI-assisted content. Editorial policy · Suggest a correction

On this page

Palo Alto Retired the PCNSE: What Replaced It and What Holders Should Do

Palo Alto Networks stopped offering the PCNSE exam on July 31, 2025, and nothing replaced it one for one. Its firewall engineers now certify through a set of role-based exams, with the Next-Generation Firewall Engineer closest to the old PCNSE's ground. If you still hold a PCNSE, it can't be renewed, so plan the move before the date on your certificate.

What Palo Alto retired, and when

The retirement came in stages. On January 30, 2025, Palo Alto's education team announced the Next-Generation Firewall Engineer and XSIAM Engineer certifications and said the PCNSA, PCSFE and PCCET exams would retire on January 31. A May 1, 2025 post on its LIVE community, titled "What Is Replacing the PCNSE?", said only three legacy exams were left (PCNSE, PCCSE and PCSAE) and that all three would retire on July 31, 2025.

That post answered its own question carefully. The legacy certifications tested product knowledge, it said, while the new framework tests job skills, "therefore, there is no direct equivalence between the old and new certifications." For firewall work it pointed to three role-based credentials: Network Security Generalist, Network Security Analyst and Next-Generation Firewall Engineer. Two weeks later Palo Alto renamed the Generalist level to Professional, effective May 30, 2025, so the first of those is now the Network Security Professional.

Two policy changes landed in the same summer. From August 1, 2025, every Palo Alto Networks exam is taken in person at a Pearson VUE test center, with no online proctoring. And the program kept growing: an Architect level arrived with the Network Security Architect on October 30, 2025, and a Security Operations Architect followed on February 24, 2026.

What your PCNSE is worth now

Your credential is still valid until it expires. The May 2025 post said a PCNSE "will remain active for two years from the date of achievement", and Palo Alto's September 2026 certification FAQ gives the same rule for any certification whose exam has retired. Renewal for PCNSE always meant passing the exam again, and that exam no longer exists. By our arithmetic, the last PCNSE certificates, earned on July 31, 2025, lapse by the end of July 2027.

Palo Alto's FAQ says legacy holders can still download their eCertificate from the Certification Management System. Current certifications issue Credly badges instead.

The exams that exist now

The FAQ lists fees by level. Taxes and local fees can add to these.

LevelNetwork security credentialsExam fee
FoundationalCybersecurity Apprentice, Cybersecurity Practitioner$150
ProfessionalNetwork Security Professional$200
SpecialistNetwork Security Analyst, Next-Generation Firewall Engineer, SD-WAN Engineer, Security Service Edge Engineer$250
ArchitectNetwork Security Architect$300

The Specialist level also carries XSIAM, XDR, XSOAR and Cloud Security exams for security operations and cloud teams.

How the NGFW Engineer exam compares with what PCNSE asked

Palo Alto's November 2025 datasheet splits the NGFW Engineer exam into three domains: PAN-OS networking configuration at 40%, PAN-OS device settings at 40%, and integration and automation at 20%. The first two will look familiar to a PCNSE holder: interfaces and zones, high availability, routing including the Advanced Routing Engine, GlobalProtect, IPSec tunnels, virtual systems, logging, certificates and decryption, and User-ID. The third domain deserves a separate review. You'll need to install and manage PA-Series, VM-Series, CN-Series, Cloud NGFW and AI Runtime Security, automate deployment through APIs and tools such as Terraform and Ansible, and run Panorama templates and device groups. Quantum-resistant cryptography also appears under tunnels.

The datasheet recommends two to three years in IT security, two of them on Palo Alto firewalls, and suggests holding the Network Security Professional and Network Security Analyst first. Neither is required. Every Palo Alto exam is in English, with 30 extra minutes by default for candidates testing in non-English-speaking countries, and the handbook sets the pass mark at a scaled 860 on a 300 to 1,000 scale for all exams.

Renewal works differently from PCNSE in one useful way. Certifications still last two years and you still recertify by retaking the exam, but passing a higher-level exam in the same track now extends your active lower-level certifications by two years. The rules also got stricter: after a pass you can't retake the same exam for 545 days, and after a fail you wait 15 days, then 30, then 90 between attempts.

What to do this month

If you hold a PCNSE and run Palo Alto firewalls every day, book the NGFW Engineer exam well before your PCNSE lapses, and read the datasheet's integration domain first, and compare it with what you already know rather than assuming old PCNSE materials cover the current outline. If you want one credential that renews several, start at Network Security Professional, because a later Analyst or Engineer pass will extend it. If you work across vendors, CCNP Security is the closest independent comparison on the Cisco side, and our network security certifications overview covers the vendor-neutral options. Whichever exam you choose, you'll sit it at a Pearson VUE test center, since online delivery ended in August 2025.

Sources (10)