- Palo Alto Networks retired the PCNSE and PCNSA in 2025, replacing both with a restructured role-based credential framework.
- Three new professional-level certifications are now the primary pathway: Key credentials in the new framework include: NGFW Engineer (Specialist level), Network Security Professional (Professional level), and XDR Analyst (Specialist level). The full program contains 14 role-based credentials across three tracks.
- Existing PCNSE holders have a defined transition path to the NGFW Engineer credential without sitting the full exam from scratch. Existing PCNSE holders retain their credential until its original two-year expiry date. There is no formal transition exam or exemption — when the credential expires, holders sit the NGFW Engineer exam in full.
- The new framework separates firewall engineering, broad network security, and threat detection into distinct credential tracks.
- Red Education is Palo Alto Networks Training Partner of the Year (JAPAC) for 11 consecutive years and delivers authorised Palo Alto Networks training across Australia, Singapore, and India.
What the Palo Alto Networks certification restructure means
If you hold a current PCNSE (Palo Alto Networks Certified Network Security Engineer) or PCNSA (Palo Alto Network Security Administrator), your credential remains valid until its expiry date. After expiry, renewal requires engagement with the new framework. The restructure is not retroactive, but it is permanent.
The rationale behind the change is practical. The PCNSE was a single credential that covered an increasingly broad product platform.
As Palo Alto Networks expanded from NGFW-centric deployments into Prisma Access, Cortex XDR, and cloud-delivered security, a single exam struggled to validate depth across all domains. The new structure separates those domains into role-aligned credentials.
For organisations managing Palo Alto Networks environments, this matters because job descriptions and vendor certifications will now reference the new credential names. PCNSE will progressively disappear from hiring requirements over the next 12 to 18 months.
What replaced PCNSE and what replaced PCNSA
The PCNSE and PCNSA mapped to different seniority and scope levels within the old framework. The new credentials do not map directly on a one-to-one basis, but the functional equivalents are clear.
| Old Credential | New Equivalent | Primary Domain | Notes |
| PCNSE | NGFW Engineer | Next-generation firewall configuration, security policy, threat prevention on Strata platform | No formal transition exam — sit NGFW Engineer exam in full at renewal |
| PCNSA | NGFW Engineer (entry track) | Core NGFW administration and security policy | PCNSA holders sit the NGFW Engineer exam; no direct bridge exam |
| PCNSE (Prisma focus) | Network Security Professional | Broad network security including SASE, cloud-delivered security, and Prisma Access | Covers engineers managing multi-platform PAN deployments |
| No direct equivalent | XDR Analyst | Cortex XDR: threat detection, investigation, and response in SOC environments | New credential targeting SOC analysts and threat hunters |
The key shift is that breadth is no longer bundled into one credential. An engineer managing Palo Alto Networks NGFWs pursues the NGFW Engineer.
An engineer managing both NGFW deployments and Prisma Access pursues the Network Security Professional. A SOC analyst working with Cortex XDR pursues the XDR Analyst. The credentials can be combined and do not compete with each other.
The three new credentials explained
NGFW Engineer
The NGFW Engineer is the primary firewall engineering credential in the new Palo Alto Networks framework. It validates the ability to configure, manage, and troubleshoot Palo Alto Networks next-generation firewalls on the Strata platform.
Exam content covers security policy construction, application identification, user-ID, content-ID, threat prevention profiles, VPN configuration, and high-availability deployments.
Engineers who held a current PCNSE will recognise this scope as consistent with their existing knowledge base. This is the credential most directly relevant to firewall administrators and network security engineers in enterprise environments. It is the replacement for PCNSE in most job descriptions and procurement requirements.
Network Security Professional
The Network Security Professional credential covers a broader scope than the NGFW Engineer, extending to Prisma Access SSE, cloud-delivered security architecture, and multi-platform Palo Alto Networks deployments.
This credential suits engineers responsible for enterprise-wide security architecture rather than device-level administration. It assumes working knowledge of NGFW fundamentals and builds on that base with SASE and zero-trust network access concepts.
For engineers transitioning from PCNSE, the Network Security Professional represents the next step if their rolehas expanded beyond pure firewall management into cloud-delivered security.
XDR Analyst
The XDR Analyst is a new credential with no direct predecessor in the old Palo Alto Networks framework. It validates the ability to use Cortex XDR for threat detection, investigation, alert triage, and incident response.
This credential targets SOC analysts, threat hunters, and security operations engineers. It does not cover firewall configuration and is not a replacement for the NGFW Engineer. The two credentials serve different roles within the same security stack.
Migration path for existing PCNSE and PCNSA holders
Your existing credential does not expire as a result of the restructure. It expires on the date printed on your certificate. Migration is required at renewal, not immediately.
Palo Alto Networks has confirmed on its LIVEcommunity portal that there is no direct equivalence between legacy and new certifications, as the frameworks assess different competencies. When a legacy credential expires, holders sit the relevant new-framework exam in full.
| Your Situation | Recommended Action | Timeline Consideration |
| Current PCNSE, valid for 12+ months | No immediate action required. Begin NGFW Engineer exam preparation ahead of renewal. | PCNSE will not appear on new job descriptions. Early transition has career benefit. |
| Current PCNSE, expiring within 6 months | Begin NGFW Engineer preparation now. | No formal transition exam exists — sit the full NGFW Engineer exam at renewal. |
| Current PCNSA, valid | No immediate action required. Begin NGFW Engineer preparation as PCNSA phases out of recognition. | PCNSA has a shorter market half-life than PCNSE given its entry-level positioning. |
| Expired PCNSE or PCNSA | Sit the NGFW Engineer exam directly. No transition path applies to lapsed credentials. | Treat this as a fresh certification decision. |
| Neither PCNSE nor PCNSA | Begin with NGFW Engineer as the primary firewall engineering entry point. | No old-framework prerequisite is required. |
Red Education delivers official Palo Alto Networks NGFW Engineer training as part of its Palo Alto Networks training courses offering, including transition-aligned courses for PCNSE holders. Contact Red Education to confirm current exam availability and recommended preparation for your credential status.
How the new framework affects your career path
The restructure creates a clearer credential ladder than the old framework provided. Engineers can now signal specialisation in a way that the PCNSE alone did not support.
For network security engineers in Australia, Singapore, and India, the NGFW Engineer will become the baseline expectation in job descriptions that previously listed PCNSE. The restructure does not reduce that expectation; it reframes which credential satisfies it.
Engineers managing Palo Alto Networks environments at scale will benefit from pairing the NGFW Engineer with the Network Security Professional. This combination signals capability across firewall management and cloud-delivered security, which reflects the way most enterprise environments are actually deployed.
For those operating in security operations functions, the XDR Analyst addresses a genuine gap. Cortex XDR is widely deployed, but formal certification for its operation has historically been absent from the Palo Alto Networks framework. The XDR Analyst credential changes that.
Frequently Asked Questions
What replaced PCNSE in the Palo Alto Networks certification framework?
The NGFW Engineer is the primary replacement for PCNSE as the benchmark firewall engineering credential. The Network Security Professional covers broader multi-platform deployments including Prisma Access. Existing PCNSE holders retain their credential until its original expiry date, after which they sit the NGFW Engineer exam in full. No formal transition exam or exemption pathway exists.
Do I need to recertify immediately if I hold a current PCNSE?
No. Your current PCNSE remains valid until its expiry date. Recertification under the new framework is required at renewal. However, the PCNSE credential is being phased out of job descriptions and vendor requirements, so transitioning ahead of expiry has practical career benefit.
What is the difference between the NGFW Engineer and the Network Security Professional?
The NGFW Engineer validates configuration and management of Palo Alto Networks next-generation firewalls on the Strata platform. The Network Security Professional covers a broader scope including Prisma Access SSE, SASE architecture, and cloud-delivered security. The Network Security Professional assumes working knowledge of NGFW fundamentals.
Is the XDR Analyst certification relevant for firewall engineers?
Not directly. The XDR Analyst targets SOC analysts and threat hunters working with Cortex XDR. It does not cover NGFW configuration. For firewall engineers, the relevant credential is the NGFW Engineer. The two credentials are complementary rather than interchangeable for engineers whose role spans both domains.
How does Red Education support the transition to the new Palo Alto Networks certifications?
Red Education is Palo Alto Networks Training Partner of the Year (JAPAC) for 11 consecutive years and
delivers official transition-aligned training for PCNSE holders. This includes structured preparation for the NGFW Engineer exam and guidance on the Network Security Professional pathway. Contact Red Education directly for current course dates and transition-specific training options across Australia, Singapore, and India.
Next steps
The Palo Alto Networks certification restructure is a significant change, but the path forward is well-defined. If you hold a PCNSE or PCNSA, your credential is still valid. What changes is the credential you pursue at renewal and what hiring managers will expect to see on your profile from this point forward.
The NGFW Engineer is the correct starting point for the majority of current PCNSE and PCNSA holders. Engineers with broader platform responsibility should consider the Network Security Professional as a follow-on. SOC analysts working with Cortex XDR have a clear credential in the XDR Analyst.
Red Education delivers official Palo Alto Networks training across Australia, Singapore, and India. Our NGFW Engineer certification guide provides detailed exam and preparation information. For transition-specific guidance, Prisma Access training, or to confirm current course dates, contact Red Education directly.