If you spent the first half of this year studying for the PCNSE or PCNSA and suddenly can’t find an open registration slot, you’re not doing anything wrong. Palo Alto Networks spent 2025 dismantling the certification lineup that network and security engineers have relied on for over a decade, replacing it with a role based framework built around fourteen separate credentials spread across four levels.
The PCNSE is retired. The PCNSA is retired. In their place sit exams named for the job itself rather than a single product line: NGFW Engineer, Network Security Professional, XDR Analyst, and several others most candidates haven’t heard of yet.
This matters beyond nostalgia for a familiar exam code. It changes what you should book next, what it costs, how it’s delivered, and whether the credential sitting on your resume still means anything to a hiring manager scanning applications in 2026.
Why Palo Alto Networks Blew Up Its Own Certification Lineup
Palo Alto Networks stopped being a firewall company a long time ago. The portfolio now spans SASE, cloud security posture management, extended detection and response through Cortex XDR, and automation tooling through XSOAR. A certification built around PAN-OS configuration alone stopped reflecting what most of these job titles actually require day to day.
The company addressed that gap by rebuilding its certification program around roles instead of products. A handful of changes define the new setup:
- Legacy product specific exams, including PCNSA, PCNSE, and PCCSA, were phased out during 2025
- Fourteen new certifications now sit across four levels: Foundational, Professional, Specialist, and Architect
- Three tracks organize the whole catalog: Network Security, Security Operations, and Cloud Security
- Every exam is now delivered exclusively at in-person Pearson VUE testing centers, with online proctoring discontinued entirely
That last point catches a lot of candidates off guard. Anyone used to scheduling a Palo Alto Networks exam from a home office needs to plan around an actual test center visit going forward.
Palo Alto Networks isn’t the only vendor rewriting its certification playbook this way. Oracle retired its original OCI foundational exams and replaced them with updated codes on a similar timeline, and the pattern shows up across the industry as platforms consolidate faster than exam blueprints can keep pace.
What Happens to Existing PCNSA and PCNSE Holders
Your Certification Doesn’t Vanish at Retirement
Retirement affects new registrations, not credentials you already earned. If you passed the PCNSE or PCNSA before it was retired, the certification stays listed as valid on your Palo Alto Networks transcript and on LinkedIn through its original two year expiration date. Nobody needs to scramble to retake anything the day a replacement exam launches.
What changes is what happens at renewal.
There’s No Direct Transition Exam
Palo Alto Networks did not build a shortened bridge exam between the old credentials and the new ones. When a PCNSE or PCNSA reaches its expiration date, the only way to stay certified is to sit the relevant new exam in full, at full length and full price. A few practical points worth planning around:
- Your existing PCNSE or PCNSA remains valid until its original two year expiration date, not the exam’s retirement date
- No discounted or abbreviated transition exam exists between the retired credentials and their replacements
- Recertification means passing the applicable new exam in full, the same as any first time candidate
- Job postings and internal vendor requirements are expected to phase out references to PCNSE specifically over the next 12 to 18 months, according to certification training provider Red Education
That timeline is worth taking seriously if you’re job hunting with a legacy credential as your main Palo Alto Networks proof point. Juniper Networks holders went through a comparable adjustment period after HPE’s acquisition reshaped that certification lineup, and the transition there took longer than most candidates expected.
The Three Certifications Now Doing PCNSE’s Job
Fourteen new credentials is a lot to evaluate at once. For anyone whose background is rooted in PCNSE or PCNSA style work, three of them matter far more than the rest.
NGFW Engineer: The Closest Thing to a Direct PCNSE Successor
NGFW Engineer sits at the Specialist level and picks up almost exactly where PCNSE left off. The official NGFW Engineer certification validates configuration of PAN-OS networking, device settings, security and NAT policy creation, and the automation and integration work that’s become standard on modern firewall deployments. Anyone who spent years living inside Panorama and PAN-OS will recognize the subject matter immediately.
Exam Format and Cost
The NGFW Engineer exam runs 90 minutes across 121 questions and costs $175. Palo Alto Networks recommends candidates have two to three years of general IT security experience, including at least two years working directly with its NGFW product line, before scheduling it.
Network Security Professional: Built for Multi-Platform, SASE-Era Roles
Network Security Professional, exam code NetSec-Pro, sits one tier up at the Professional level and covers more ground than a single product. Instead of testing deep configuration knowledge of one firewall platform, it spans network security fundamentals, NGFW and SASE solution functionality, and how Palo Alto Networks’ broader platform and services fit together. It’s the better fit for engineers managing a mixed environment of on premises firewalls, SASE, and cloud delivered security rather than a single appliance.
Exam Format and Cost
NetSec-Pro runs 90 minutes across 75 questions, with a passing score of 860 on a 300 to 1000 scale. Pricing generally lands around $200, though candidates should confirm current pricing directly with Palo Alto Networks before registering, since professional level exam fees have shifted more than once since the framework launched.
XDR Analyst: A New Door Into Security Operations
XDR Analyst isn’t a renamed version of anything from the old lineup. It’s a genuinely new credential built for security operations center analysts and specialists who investigate and respond to incidents inside Cortex XDR, rather than engineers who configure network infrastructure. For a PCNSE holder considering a move from pure network engineering into security operations, this is the most direct path Palo Alto Networks currently offers.
Exam Format and Cost
The XDR Analyst exam runs 90 minutes with a required scaled score of 860 out of 1000 and costs $250. Content splits across four weighted domains:
- Incident handling and response: 34 percent
- Data analysis using XQL: 28 percent
- Alerting and detection: 23 percent
- Endpoint security management: 15 percent
Cost, Format, and Difficulty Across the New Exams
Seeing the three side by side makes the decision easier than reading three separate exam blueprints.
| Certification | Level | Cost | Duration | Passing Standard |
|---|---|---|---|---|
| NGFW Engineer | Specialist | $175 | 90 minutes | 121 questions, scaled score not publicly disclosed |
| Network Security Professional | Professional | Roughly $200 | 90 minutes | 75 questions, 860 of 1000 |
| XDR Analyst | Specialist | $250 | 90 minutes | Scaled score of 860 of 1000 |
XDR Analyst costs the most of the three, which tracks with its scope. Security operations content, especially anything touching query languages like XQL, tends to price higher across the industry than infrastructure configuration exams, largely because fewer instructors and study resources exist to support it yet.
Should You Study for the Old Exam or the New One Right Now?
The honest answer depends on where you’re starting from.
If You Already Hold PCNSA or PCNSE
Nothing about your existing certification requires immediate action. Work through the transition in roughly this order:
- Confirm your actual expiration date inside your Palo Alto Networks certification portal account rather than relying on memory
- Mark that date somewhere you’ll actually see it again, not just in the confirmation email
- Start budgeting study time for the matching new exam six to eight months before that date arrives, rather than waiting for a renewal notice
- Re-evaluate which new exam actually fits your current role, since the obvious name match isn’t always the right one
If your day to day work has shifted toward SASE or multi-platform management since you passed PCNSE, Network Security Professional is worth evaluating over NGFW Engineer even though it’s the less obvious successor by name. If your PCNSA hasn’t expired yet, DirectCertify’s PCNSA practice material is still available while you plan that transition timeline.
If You’re Starting From Zero in 2026
Skip any study guide still built around PCNSA or PCNSE. Palo Alto Networks doesn’t offer either exam anymore, and secondhand exam vouchers or bootcamp seats tied to the old codes are effectively worthless. Start at the Foundational level if you’re new to the platform entirely, or go straight to NGFW Engineer if you already have hands on firewall experience from a previous role. A few things worth checking before registering for anything:
- Confirm the exact exam code and current price on Palo Alto Networks’ own certification page, since professional and specialist level pricing has changed more than once since 2025
- Book a Pearson VUE test center appointment early in cities where slots run out during exam voucher promotion periods
- Match your prerequisite experience honestly against what Palo Alto Networks recommends rather than the bare minimum candidates report online, since exam difficulty tends to track the stated experience recommendation closely at Specialist level and above
Browse DirectCertify’s Palo Alto Networks practice test library to see which exams currently have prep material available, since coverage for brand new exam codes takes time to catch up across the entire training industry, not just any single provider.
What the Job Market Actually Pays for Palo Alto Networks Skills
Data specific to brand new credentials like NGFW Engineer and XDR Analyst hasn’t accumulated yet, since neither has been available long enough to generate a meaningful salary survey sample. The closest available benchmark comes from the exam they’re replacing.
Payscale reports an average base salary of $107,000 for PCNSE certified professionals in the United States, with a broader reported range between $110,000 and $130,000 depending on role and location. Expect NGFW Engineer, as the direct functional successor, to track close to that same range once independent salary data catches up.
The bigger tailwind is the security field overall rather than any single vendor. The U.S. Bureau of Labor Statistics projects employment for information security analysts to grow 29 percent between 2024 and 2034, among the fastest growth rates of any occupation the agency tracks, with roughly 16,000 openings projected annually over the decade. A Palo Alto Networks credential, old or new, sits inside a job category that isn’t shrinking any time soon. That growth also shows up in adjacent decisions, like choosing between cloud security certifications when a role spans more than firewall management alone.
DirectCertify is an independent certification preparation provider and has no affiliation with, endorsement from, or sponsorship by Palo Alto Networks. Exam codes, pricing, and policy details above reflect research at the time of writing, so confirm current specifics on Palo Alto Networks’ own certification page before registering or building a study plan, since vendor pricing and requirements can change without much public notice.