Palo Alto Networks certifications have undergone the most significant structural change in the program’s history. If you studied for the PCNSE, PCNSA, or PCCET — or were planning to — those exams are now retired. The entire program has shifted to a role-based framework that maps each credential directly to real job functions across network security, security operations, and cloud security.
This guide covers every active certification in the 2026 program, what each exam validates, how much it costs, how to pass, and what salary you can realistically expect after earning it.
Quick Answer:
Palo Alto Networks now offers certifications across four levels — Foundational, Professional, Specialist, and Architect — organized into three tracks: Network Security, Security Operations, and Cloud Security. All exams are delivered in person at Pearson VUE test centers. Prices range from $150 for Foundational exams to $250+ for Specialist credentials, with a passing score of 860 on a 300–1000 scale.
What Is the Palo Alto Networks Certification Program?
The Palo Alto Networks Certification Program is a portfolio of role-based credentials designed to validate knowledge and skills across the Palo Alto Networks product ecosystem. As one of the world’s most widely deployed cybersecurity platforms — used by the majority of Fortune 100 companies — Palo Alto Networks certifications carry significant weight with enterprise employers globally.
The program covers the full technology stack: Next-Generation Firewalls (NGFW) and the Strata platform for network security, Cortex XDR, XSIAM, and XSOAR for security operations, and the Cortex Cloud platform for cloud security. Each certification maps to a specific role and a specific product area, making it easier for hiring managers to understand exactly what a certified professional can do on day one.
The Major Restructure: What Changed in 2026
Before diving into individual certifications, it’s essential to understand what has changed — because the program that existed even two years ago looks very different today.
Legacy exams that have been retired:
- PCCET (Certified Entry-Level Technician) — retired September 31, 2025
- PCNSA (Certified Network Security Administrator) — retired September 31, 2024
- PCSFE (Certified Security Fundamentals Engineer) — retired September 31, 2025
- PCDRA (Certified Detection and Remediation Analyst) — retired September 30, 2025
- PCNSE (Certified Network Security Engineer) — retired September 31, 2025
- PCCSE (Certified Cloud Security Engineer) — retired September 31, 2025
- PCSAE (Certified Security Automation Engineer) — retired September 31, 2025
If you hold any of these legacy certifications, they remain valid through their original two-year expiry date. But new candidates can no longer sit these exams.
What replaced them:
The new role-based program introduces four certification levels across three tracks. The “Generalist” tier was renamed “Professional” effective September 30, 2025, signaling a stronger, job-ready positioning. Online proctored testing was discontinued as of September 1, 2025 — all exams are now in-person only at Pearson VUE centers.
The New Role-Based Framework: Four Levels, Three Tracks
The current Palo Alto Networks certification path is built around a clean matrix: choose your track based on your job function, then progress through the levels as your skills deepen.
| Level | Purpose |
|---|---|
| Foundational | Validates core cybersecurity knowledge — no product depth required |
| Professional | Validates job-ready skills for operating and managing a platform |
| Specialist | Validates ability to deploy, configure, and manage a specific product |
| Architect | Validates design skills for complex enterprise security architectures |
Three tracks:
- Network Security — Strata NGFW, Prisma Access (SASE), Strata Cloud Manager, SD-WAN
- Security Operations — Cortex XDR, Cortex XSIAM, Cortex XSOAR, SOC operations
- Cloud Security — Cortex Cloud, cloud workload protection, application security, CSPM
The Foundational certifications — Cybersecurity Apprentice and Cybersecurity Practitioner — sit at the base of all three tracks and are the recommended starting point for anyone new to the program.
Foundational Certifications: Where Every Path Begins
Cybersecurity Apprentice
The Cybersecurity Apprentice is the entry point to the entire Palo Alto Networks certification ecosystem. It validates foundational knowledge of networking and cybersecurity concepts without requiring any Palo Alto-specific product experience.
- Best for: Students, career changers, non-technical IT professionals, and anyone transitioning into cybersecurity who wants a credible starting credential.
- Exam fee: $150 (via Palo Alto Store on Pearson VUE)
- Prerequisites: None
- Validity: 2 years
The Cybersecurity Apprentice is product-agnostic — it covers attack types, network fundamentals, firewall concepts, and general security principles. It does not require you to know PAN-OS or Cortex. It is the credential that proves you understand the language of cybersecurity before specializing.
Cybersecurity Practitioner
The Cybersecurity Practitioner is one level above the Apprentice and introduces Palo Alto Networks products into the picture. It validates knowledge of how Palo Alto solutions fit into real security architectures, touching on Cortex XDR, Prisma Cloud, and cross-domain security principles.
- Best for: Early-career SOC analysts, IT support technicians, and professionals ready to move from generic security concepts into Palo Alto-specific roles.
- Exam fee: $150
- Prerequisites: None (Apprentice recommended)
- Validity: 2 years
After earning the Practitioner, you are ready to enter the Professional or Specialist tiers in any of the three tracks.
Network Security Track
This is the most populated track in the Palo Alto Networks certification path, with credentials spanning the Strata NGFW platform, Prisma Access SASE, Strata Cloud Manager (SCM), and SD-WAN.
Network Security Professional
The Network Security Professional certification validates knowledge across the full Palo Alto Networks network security portfolio — including PAN-OS, Prisma Access, and SASE technologies — at an operational level. It covers installation, maintenance, and deployment of these products.
- Best for: Network administrators and security engineers who manage Palo Alto environments and want a broad credential demonstrating platform fluency.
- Exam fee: $200
- Prerequisites: None formally required (Cybersecurity Practitioner recommended)
- Validity: 2 years
- Exam format: ~90 minutes, multiple-choice, Pearson VUE in-person
Network Security Analyst (Specialist)
The Network Security Analyst focuses specifically on Strata Cloud Manager (SCM) — validating skills in object configuration, policy creation, logging, and day-to-day firewall and subscription management through the centralized SCM platform.
- Best for: Firewall admins and NOC/SOC hybrid roles where daily platform operations in Strata Cloud Manager are a core responsibility.
- Exam fee: $250
- Validity: 2 years
Next-Generation Firewall Engineer (Specialist)
The NGFW Engineer is the certification for hands-on PAN-OS specialists. It validates the ability to deploy, configure, and manage Palo Alto Networks Next-Generation Firewalls at scale — including networking configuration, identity integration, SSL decryption, Panorama templates, and automation.
- Best for: Security engineers who design and operate NGFW environments. This is the direct successor to the retired PCNSE for engineers focused on firewall deployment and management.
- Exam fee: $250
- Validity: 2 years
Domain areas include PAN-OS networking and device configuration, Panorama management, and integration and automation workflows.
SD-WAN Engineer (Specialist)
The SD-WAN Engineer certification validates the knowledge to plan, deploy, configure, operate, monitor, and troubleshoot modern SD-WAN environments, including both standalone SD-WAN and integrated SD-WAN for SASE solutions.
- Best for: Network engineers working with Prisma SD-WAN or managing hybrid WAN infrastructure for distributed organizations.
- Exam fee: $250
- Validity: 2 years
Security Service Edge Engineer (Specialist)
The SSE Engineer covers the deployment, configuration, management, and troubleshooting of Security Service Edge (SSE) and Secure Access Service Edge (SASE) environments using Prisma Access.
- Best for: Engineers responsible for cloud-delivered security for remote users and branch locations — a fast-growing role as enterprises adopt SASE architectures.
- Exam fee: $250
- Validity: 2 years
Network Security Architect
The Network Security Architect is the pinnacle of the Network Security track. It validates the ability to understand technical and business requirements, architect Zero Trust security systems using the full Palo Alto Networks network security portfolio, and oversee complex security blueprints using industry frameworks.
- Best for: Senior security architects with broad Palo Alto Networks experience who design enterprise-scale, highly available security infrastructure.
- Exam fee: Check the Palo Alto Store for current pricing
- Prerequisites: Professional or Specialist-level experience strongly recommended
- Validity: 2 years
Security Operations Track
The Security Operations track covers the Cortex platform — Palo Alto’s detection, investigation, automation, and response suite. It includes credentials for both analysts (who use the platform) and engineers (who deploy and configure it).
Security Operations Professional
The Security Operations Professional validates job-ready skills for working in a Security Operations Center (SOC) using Palo Alto Networks Cortex products. It bridges the Foundational tier and the Specialist certs, covering Cortex XDR and XSIAM at an operational level.
- Best for: SOC analysts and incident responders who want a recognized credential for their Cortex platform skills.
- Exam fee: $200
- Validity: 2 years
XSIAM Analyst (Specialist)
The XSIAM Analyst certification validates the skills required to use Cortex XSIAM — Palo Alto’s AI-driven Security Operations Platform — for automation, threat detection, and incident response.
- Best for: SOC analysts focused on XSIAM-based operations, detection, and response workflows.
- Exam fee: $250
- Validity: 2 years
XDR Analyst (Specialist)
The XDR Analyst credential validates skills in Cortex XDR architecture, components, and daily SOC operations. It is designed for analysts who use XDR as their primary detection and investigation tool.
- Best for: SOC analysts, threat hunters, and incident responders in environments running Cortex XDR.
- Exam fee: $250
- Validity: 2 years
XSIAM Engineer (Specialist)
The XSIAM Engineer certification goes deeper than the Analyst tier, validating the knowledge to deploy, configure, manage, onboard data sources, and create playbooks in Cortex XSIAM environments.
- Best for: Security operations engineers responsible for building and maintaining XSIAM infrastructure.
- Exam fee: $250
- Validity: 2 years
XDR Engineer (Specialist)
The XDR Engineer mirrors the XSIAM Engineer but for Cortex XDR deployments — validating deployment, configuration, data onboarding, and playbook development in XDR-based security operations centers.
- Best for: Engineers who deploy and maintain Cortex XDR across endpoint, network, and cloud data sources.
- Exam fee: $250
- Validity: 2 years
XSOAR Engineer (Specialist)
The XSOAR Engineer validates skills in deploying, configuring, integrating, and troubleshooting Cortex XSOAR — Palo Alto’s Security Orchestration, Automation, and Response platform. It covers custom integrations, playbook development, and automation architecture.
- Best for: Security engineers building automation workflows and orchestrating incident response at scale.
- Exam fee: $250
- Validity: 2 years
Cloud Security Track
Cloud Security Professional
The Cloud Security Professional is currently the sole certification in the Cloud Security track. It validates the skills required to secure cloud environments using the Cortex Cloud platform — covering Cloud Runtime Security, Application Security (AppSec), Cloud Posture Security (CSPM), and SOC processes.
- Best for: Cloud security engineers, DevSecOps professionals, and security architects working with Palo Alto’s cloud-native security platform.
- Exam fee: $200
- Prerequisites: Cybersecurity Practitioner recommended
- Validity: 2 years
This certification replaced the retired PCCSE (Prisma Cloud Certified Security Engineer) and reflects the consolidation of Palo Alto’s cloud security products under the Cortex Cloud brand.
Exam Details, Fees & Scheduling
Official Exam Fee Summary
| Level | Certification | Fee (USD) |
|---|---|---|
| Foundational | Cybersecurity Apprentice | $150 |
| Foundational | Cybersecurity Practitioner | $150 |
| Professional | Network Security Professional | $200 |
| Professional | Security Operations Professional | $200 |
| Professional | Cloud Security Professional | $200 |
| Specialist | Network Security Analyst | $250 |
| Specialist | NGFW Engineer | $250 |
| Specialist | SD-WAN Engineer | $250 |
| Specialist | SSE Engineer | $250 |
| Specialist | XDR Analyst | $250 |
| Specialist | XSIAM Analyst | $250 |
| Specialist | XDR Engineer | $250 |
| Specialist | XSIAM Engineer | $250 |
| Specialist | XSOAR Engineer | $250 |
Source: Palo Alto Networks official voucher store via Pearson VUE. Prices September vary by country.
Exam Format
- Delivery: In-person only at Pearson VUE test centers (online proctoring discontinued September 1, 2025)
- Duration: Approximately 90 minutes per exam (includes NDA agreement and survey)
- Question types: Multiple-choice, matching, and ordering questions
- Passing score: 860 on a scaled 300–1000 score range
- Language: English; candidates in non-English-speaking countries receive a 30-minute time extension
- Rescheduling: Changes must be made at least 48 hours before your appointment to avoid forfeiting fees
Scheduling Your Exam
All exams are booked directly through Pearson VUE’s Palo Alto Networks portal. Create a Pearson VUE account using your legal name and a business email address. Once registered, select your exam, locate a test center, and choose a date. Book early — popular exams at high-demand centers fill up weeks in advance.
Validity and Recertification
All Palo Alto Networks certifications are valid for two years from the date earned. To recertify, you can:
- Pass the current version of the same exam before expiry
- Earn a higher-level certification within the same track — this automatically extends your active lower-level certifications by two additional years
This creates a strategic incentive to advance through the certification levels: earning a Specialist cert, for example, extends your Professional cert without requiring a separate renewal exam.
Career Paths and Salary Expectations
Palo Alto Networks-certified professionals are in demand across enterprise IT, managed security services, government, and financial services globally. The role-based certification titles map directly to job descriptions, which makes the credentials highly legible to recruiters.
Job Titles by Certification Track
Network Security track certifications align with roles such as:
- Network Security Engineer
- Firewall Administrator
- Network Security Analyst
- SASE/SSE Architect
- Security Infrastructure Engineer
Security Operations track certifications align with roles such as:
- SOC Analyst (Tier 1–3)
- Threat Intelligence Analyst
- Incident Response Engineer
- Security Automation Engineer
- SOAR Developer
Cloud Security track certifications align with roles such as:
- Cloud Security Engineer
- DevSecOps Engineer
- Cloud Architect
- CSPM Analyst
Salary Ranges (United States)
The figures below represent market compensation for professionals in roles that leverage Palo Alto Networks certifications. Data sourced from Glassdoor and Zippia.
| Role | Average Annual Salary (US) |
|---|---|
| Network Security Engineer | $131,000–$162,000 |
| SOC Analyst | $75,000–$110,000 |
| Cloud Security Engineer | $120,000–$160,000 |
| Security Architect | $150,000–$200,000+ |
| Security Automation Engineer | $130,000–$175,000 |
Professionals at the Specialist and Architect level with hands-on Palo Alto platform experience typically command compensation toward the higher end of these ranges. In high-cost markets such as California, New York, and Seattle — and in senior roles — total compensation packages can substantially exceed base salary figures when equity and bonuses are included.
Global salary context: Outside the US, Palo Alto Networks-certified professionals in the UK, Australia, and the UAE also command strong premiums over non-certified peers, particularly for roles requiring SASE, XDR, or cloud security expertise.
How to Study and Prepare for Palo Alto Networks Exams
- Step 1: Read the Official Exam Datasheet
Every Palo Alto Networks certification has an official exam datasheet — available on the Palo Alto Networks education site — that lists the exam domains and their percentage weightings. This is your primary study blueprint. Spend proportionally more time on high-weight domains.
- Step 2: Complete Free Digital Learning Modules
Palo Alto Networks offers a library of free digital learning modules through its education portal. These bite-sized, self-paced modules cover product fundamentals and exam-relevant concepts at no cost. For Foundational certifications, this free content is often sufficient for preparation.
- Step 3: Take Instructor-Led or Lab-Based Training
For Professional and Specialist certifications — especially the NGFW Engineer, XSIAM Engineer, and XSOAR Engineer — hands-on lab experience is critical. Palo Alto Networks offers instructor-led training through authorized learning partners that provides structured, lab-based exposure to real product environments.
- Step 4: Use Practice Tests
Practice tests help you assess your readiness, identify knowledge gaps, and build exam confidence before sitting the real assessment. PassITExams offers Palo Alto Networks practice tests and study guides that mirror the format and difficulty of the actual exams — useful for both Foundational and Professional-tier candidates.
- Step 5: Build a 6–8 Week Study Plan
For Professional and Specialist exams, a structured 6–8 week plan works well:
- Weeks 1–2: Review exam datasheet; complete digital learning modules
- Weeks 3–5: Hands-on lab practice; study guide review by domain
- Weeks 6–7: Practice tests and timed mock exams
- Week 8: Gap review; book your Pearson VUE seat
- Step 6: Book Your Exam Center Seat Early
Since online proctoring is no longer available, factor in travel time and local test center availability. In some regions, popular exam slots fill up 3–4 weeks in advance. Book your seat as soon as you have a target exam date in mind.
Common Mistakes to Avoid
- Studying for retired exams: If your study materials reference PCNSE, PCNSA, or PCCET as active credentials, they are outdated. Confirm which exam you are sitting before purchasing any preparation materials.
- Skipping the exam datasheet: The datasheet is not optional reading — it defines exactly what the exam tests and in what proportion. Candidates who skip it frequently over-study low-weight topics and under-prepare for high-weight ones.
- Underestimating hands-on requirements: Especially for Specialist-level exams, theoretical knowledge is not enough. Scenario-based questions test your ability to apply configuration knowledge in realistic PAN-OS, XSIAM, or XSOAR contexts. Lab time is non-negotiable.
- Ignoring the 48-hour rescheduling window: Missing this window means forfeiting your exam fee. Set a calendar reminder 72 hours before your appointment so you have time to act if something comes up.
- Planning for online proctoring: As of 2026, this option no longer exists. All exams require an in-person Pearson VUE appearance. Account for travel and potential test center booking lead times.
- Not planning your recertification ladder: Because earning a higher-level cert in the same track extends your lower-level cert by two years, it is worth planning your certification progression strategically rather than waiting until a cert expires.
Comparison: Palo Alto Networks Certification Tracks at a Glance
| Track | Entry Point | Mid Level (Professional) | Advanced (Specialist) | Top Level (Architect) |
|---|---|---|---|---|
| Network Security | Cybersecurity Apprentice / Practitioner | Network Security Professional | Network Security Analyst, NGFW Engineer, SD-WAN Engineer, SSE Engineer | Network Security Architect |
| Security Operations | Cybersecurity Practitioner | Security Operations Professional | XSIAM Analyst, XDR Analyst, XSIAM Engineer, XDR Engineer, XSOAR Engineer | — |
| Cloud Security | Cybersecurity Apprentice / Practitioner | Cloud Security Professional | — | — |
Frequently Asked Questions FAQ’s
What happened to the PCNSE certification?
The PCNSE (Palo Alto Networks Certified Network Security Engineer) was retired on September 31, 2025. Existing PCNSE holders retain their certification until its original two-year expiry date. New candidates should pursue the NGFW Engineer (Specialist) certification as the primary successor for deep NGFW expertise, alongside the Network Security Professional for broader platform coverage.
Are Palo Alto Networks exams available online?
No. In the 2026, all exams are delivered in person only at authorized Pearson VUE test centers. Online proctoring is no longer an option.
What is the passing score for Palo Alto Networks exams?
The passing score is 860 on a scaled score of 300–1000. Exams include unscored pretest items, so the number of scored questions September vary.
How long are Palo Alto Networks certifications valid?
All certifications are valid for two years from the date earned. You can recertify by retaking the current exam before expiry, or by earning a higher-level certification in the same track — which also extends any active lower-level certs by two years.
Do I need to take the Foundational exams before Professional or Specialist?
There are no formal prerequisites for most certifications, but completing the Cybersecurity Practitioner before attempting Professional or Specialist exams is strongly recommended and will improve your exam readiness.
Is there a free way to prepare for Palo Alto Networks certifications?
Yes. Palo Alto Networks offers free digital learning modules through its education portal for Foundational-level content. These are self-paced, multimedia-rich modules available to anyone. For Professional and Specialist levels, paid instructor-led training and practice tests provide more targeted preparation.
What is the cheapest Palo Alto Networks certification to start with?
Both the Cybersecurity Apprentice and Cybersecurity Practitioner cost $150 per exam and require no prerequisites. The Practitioner is the better starting point if you already have some IT or security background.
Can I take multiple Palo Alto Networks certifications?
Yes — and it is encouraged. Earning a Specialist certification in the same track as your Professional cert extends the validity of both. Many professionals pursue certifications in multiple tracks to demonstrate breadth across network security, security operations, and cloud security.
Which Palo Alto Networks certification is best for a firewall admin?
The NGFW Engineer (Specialist, Network Security track) is the most directly relevant for firewall administrators who manage and deploy PAN-OS environments. The Network Security Analyst is the better fit if your daily work centers on Strata Cloud Manager operations rather than deep PAN-OS configuration.
Is the Palo Alto Networks certification worth it in 2026?
Yes — for professionals working in environments that use Palo Alto products, these credentials directly validate the skills employers are hiring for. The role-based naming convention makes certified professionals immediately recognizable to recruiters, and salary data shows a consistent premium for security professionals with vendor-specific expertise on widely deployed platforms.
Final Thoughts
The Palo Alto Networks certifications path in 2026 is cleaner, more job-relevant, and more strategically structured than it has ever been. The shift from product-centric exams to a role-based framework means your credential now speaks directly to what you can do — not just which exam you passed.
Whether you are starting fresh with the Cybersecurity Apprentice, moving into platform management with the Network Security Professional, or specializing in XDR and XSIAM for SOC roles, there is a clear, logical path from where you are now to where you want to be.
Take time to read the official exam datasheets on the Palo Alto Networks education portal, build in hands-on lab practice, and supplement your preparation with quality practice tests. For ready-made Palo Alto Networks practice tests and exam prep materials, PassITExams provides exam-format resources that help you benchmark your readiness before test day.
Book your Pearson VUE seat early, study the right domains at the right depth, and you will be well positioned to earn one of the most recognized credentials in enterprise cybersecurity.
