Network Security Certifications (2026): Network+, CCNA, CCNP Security, Fortinet NSE, Palo Alto and GCIA

Published November 12, 2026. Exam facts come from CompTIA, Cisco, Fortinet, Palo Alto Networks and GIAC pages linked in each section, checked on that date. Fees vary by country and change, so we link to each vendor’s price page instead of listing prices.

Network security certifications fall into two groups. Vendor-neutral exams, such as CompTIA Network+ and GIAC GCIA, test concepts that apply to any network. Vendor exams from Cisco, Fortinet and Palo Alto Networks test whether you can run that company’s routers and firewalls. A common plan is one of each: a vendor-neutral exam for the concepts and a vendor exam for the firewall you run.

Two of the big firewall vendors have renamed their certifications since 2025. Palo Alto Networks retired the PCNSA and PCNSE exams by mid-2025 and replaced them with role-based certifications. Fortinet moved its program back to NSE levels on July 15, 2026, so the old FCP and FCSS titles now map to NSE 4 through NSE 7. This guide uses the current names.

Short answer: if you are new to networking, start with Network+ or the CCNA, then add Security+. After that, certify on the firewall your employer runs: CCNP Security for Cisco, NSE 4 FortiOS for Fortinet, or Network Security Professional and then Next-Generation Firewall Engineer for Palo Alto Networks. Choose GIAC GCIA if your job is watching network traffic for attacks rather than configuring the devices.

Network security certifications at a glance

Sources: each certification links to its official page; the sections below cite the specific pages for each fact.

Which network security certification fits your job

• Help desk or junior network admin moving toward security: Network+ or CCNA first, then Security+. Our CompTIA cybersecurity certifications pathway shows how Network+ leads to Security+ and CySA+.
• Network engineer in a Cisco shop: CCNA, then CCNP Security. The CCNP concentration exams let you pick firewalls, identity (ISE), secure cloud access or security design.
• Firewall admin running FortiGate: NSE 4 FortiOS, then NSE 5 or NSE 6 Secure Networking, then NSE 7 if you design or troubleshoot large deployments.
• Firewall admin running Palo Alto Networks: Network Security Professional, then Network Security Analyst (policy and Strata Cloud Manager work) or Next-Generation Firewall Engineer (PAN-OS networking, Panorama and automation).
• SOC or detection analyst: GIAC GCIA, which tests packet analysis and intrusion detection with Snort and Zeek. See our blue team certifications comparison.
• Security engineer who designs networks: pair a vendor certification with a broader one. Our cybersecurity engineer certifications guide covers SecurityX and CISSP-ISSEP.

CompTIA Network+ (N10-009)

CompTIA says Network+ tests network connectivity, documentation, service configuration, data centers, cloud, virtual networking, monitoring, troubleshooting and security hardening. The current exam, N10-009 (V9), launched June 20, 2024, and CompTIA estimates its retirement in 2027. It has up to 90 multiple-choice and performance-based questions in 90 minutes, a passing score of 720, and is offered in English, German, Japanese, Portuguese and Spanish (CompTIA).

The five domains are networking concepts (23%), network implementation (20%), network operations (19%), network security (14%) and network troubleshooting (24%). Security is the smallest of the five domains. If your goal is a security role, Security+ adds the depth.

CompTIA recommends A+ plus 9 to 12 months as a junior network administrator or network support technician, and lists Network+ against the NICE and DoD 8140 work roles of technical support specialist, network operations specialist and system administrator (CompTIA). Network+ renews on CompTIA’s three-year continuing education cycle (CompTIA). Study plan: our Network+ guide.

Security+ next. CompTIA says Security+ V8 is expected on or around November 17, 2026, and that V7 “remains a strong option” if you are ready to certify now (CompTIA). Our Security+ guide covers the objectives.

Cisco CCNA and CCNP Security

CCNA (200-301)

Cisco describes the CCNA as a starting point that “assumes you have little to no networking knowledge.” The 200-301 exam covers network fundamentals, network access, IP connectivity, IP services, security fundamentals, and automation and programmability. It runs 120 minutes, is graded pass/fail with results online within 48 hours, has no prerequisites, and the certification is valid for three years. You recertify by passing the current CCNA or a higher Cisco exam, or by earning 30 continuing education credits. After a failed attempt you must wait five calendar days to retake (Cisco).

The current exam is version 1.1. Cisco published the exam topics for a refreshed CCNA on May 20, 2026, and says the new exam will be available on February 3, 2027 (Cisco). Our CCNA exam guide compares the two versions.

CCNP Security

CCNP Security takes two exams: the 350-701 SCOR core exam and one concentration exam of your choice. Each exam you pass also earns a Cisco Certified Specialist certification. All of them are pass/fail, have no prerequisites and count for three years (Cisco).

For a firewall-focused path, SCOR plus SNCF is the closest match. You can renew with continuing education credits or by retaking exams (Cisco).

Fortinet NSE certifications (formerly FCP and FCSS)

On July 15, 2026, Fortinet moved its program from five certification levels to eight NSE levels, made every certification valid for two years, and added industry certifications for MSSP and OT security (Fortinet). Holders of active older certifications were mapped across: FCF became NSE 1 and NSE 2, FCA became NSE 3, an FCP earned with the FortiGate or FortiOS exam became NSE 4, other FCP exams map to NSE 5 or NSE 6, and FCSS maps to NSE 6 or NSE 7 (Fortinet).

Source: Fortinet’s certification page and 2026 program update.

NSE 4 FortiOS is the FortiGate administrator certification. The current exam, NSE 4 – FortiOS 8.0 Administrator, has 50 to 60 questions in 100 minutes, is pass/fail, is offered in English, and is delivered at Pearson test centers or online through OnVUE. Its topics are deployment and system configuration (25 to 35%), firewall policies and authentication (20 to 25%), content inspection (25 to 30%), routing (10 to 15%) and VPNs (10 to 15%) (Fortinet). Answers must be fully correct to score, and you wait 15 days to retake a failed exam (Fortinet).

NSE 4 stays active for two years from the exam date. You renew by passing the next exam version, by taking an online recertification assessment where one is offered, by earning or renewing NSE 7, or by passing an NSE 8 practical exam (Fortinet). The Secure Networking track then runs through NSE 5 (exams such as FortiSwitch, SD-WAN Core and Secure Wireless LAN Administrator), NSE 6 (FortiAnalyzer, FortiManager, FortiNAC and FortiVoice Administrator) and NSE 7 Secure Networking Architect (Fortinet, Fortinet).

Fortinet’s self-paced courses are free; on-demand labs are sold separately (Fortinet). If you run FortiGates, our coverage of actively exploited Fortinet vulnerabilities shows why patching skills matter as much as the certificate.

Palo Alto Networks: what replaced PCNSA and PCNSE

Palo Alto Networks has been moving to a role-based certification framework. By May 1, 2025, only three legacy exams were left in its catalog, including the PCNSE, and the PCNSE exam was scheduled to retire on July 31, 2025. The company said there is “no direct equivalence” between the old and new certifications, and pointed firewall candidates to the Network Security Generalist, Network Security Analyst and Next-Generation Firewall Engineer certifications (Palo Alto Networks). Its certification page now lists the entry network security credential as Network Security Professional (Palo Alto Networks).

Sources: the Network Security Professional, Network Security Analyst and NGFW Engineer datasheets. The NGFW Engineer datasheet recommends 2 to 3 years in an IT security role and 2 years with Palo Alto Networks firewalls, and lists Network Security Professional and Network Security Analyst as recommended certifications first. Palo Alto Networks exams are delivered in English, with a 30-minute extension by default for candidates testing in non-English-speaking countries (Palo Alto Networks).

All Palo Alto Networks certifications are valid for two years, and you recertify by retaking the exam. Passing a higher-level exam recertifies your active lower-level certifications in the same track. After a failed attempt you wait 15 days, then 30 days after a second failure and 90 days after a third. If you hold a PCNSE, it stays active for two years from the date you earned it (Palo Alto Networks FAQ).

GIAC GCIA: network intrusion analysis

GCIA (GIAC Certified Intrusion Analyst) is for people who watch the network rather than configure it. GIAC says it validates network and host monitoring, traffic analysis and intrusion detection, and lists security analysts, network engineers and administrators, and hands-on security managers among its audience. The exam has 106 questions in 4 hours with a passing score of 67% for versions released on or after January 21, 2023, and it includes CyberLive hands-on questions in lab virtual machines (GIAC).

Its objectives cover TCP/IP, IPv6, fragmentation, IDS rules with Snort and Zeek, tcpdump filters, Wireshark, SiLK flow analysis and network forensics. The matching SANS course is SEC503: Network Monitoring and Threat Detection In-Depth, a six-day course with 37 hands-on labs (SANS). GIAC certifications stay active for four years; you renew with 36 CPE credits or by retaking the exam, and pay a renewal fee (GIAC). Our GIAC certifications guide maps every GIAC cert to a job.

Network security certification cost: who pays

Exam fees differ by vendor, level and country, so check the official price pages: CompTIA’s Buy Now section on each certification page, Cisco’s certification pages, Palo Alto Networks’ certification FAQ (which lists a fee for each level), Fortinet’s booking through Pearson VUE, and GIAC pricing. Our certification cost calculator adds up exam and renewal fees for several of these. Before you pay yourself, check who else might:

• Your employer. If your company runs the vendor’s firewalls, ask whether it will pay. Cisco accepts Cisco Learning Credits for its exams (Cisco), and GIAC’s GCIA page links a SANS letter template for justifying SEC503 training to a manager (GIAC).
• Schools and academies. Cisco Networking Academy students who complete a qualifying course and score 70% or higher on the first try at its final exam can request a CCNA exam discount (Cisco Networking Academy). Fortinet gives students at its academic partners a free exam voucher on course completion (Fortinet).
• Veterans and the GI Bill. Fortinet’s Veterans Program lists free exam vouchers for service members, veterans and military spouses (Fortinet). The VA reimburses certification tests approved for the GI Bill, up to a per-test limit, and pays even for a failed attempt (VA).
• DoD 8140 roles. CompTIA lists Network+ against DoD 8140 work roles (CompTIA), and GIAC publishes which of its certifications count under DoD 8140 (GIAC). If your role requires one, ask your training office what it funds. See our DoD 8140 guide.
• Second attempts. CompTIA sells Network+ bundles with Retake Assurance (CompTIA), and Cisco sells Exam Safeguard Plus for the CCNA, which gives you a second attempt if you fail the first (Cisco).

Renewal at a glance

Sources: CompTIA, Cisco CCNA, Cisco CCNP Security, Fortinet, Palo Alto Networks, GIAC.

More on building a path from here: our cybersecurity certification path and map, cloud security certifications if your network is moving to the cloud, and network security and firewalls for the concepts behind the exams.

Sources

• CompTIA, Network+
• CompTIA, Security+
• CompTIA, Earn continuing education units
• Cisco, CCNA
• Cisco, AI updates to CCNA, CCIE and Automation (Cisco blog)
• Cisco, CCNP Security
• Cisco Networking Academy, certification exam discounts
• Fortinet, Cybersecurity certification (NSE program)
• Fortinet, NSE Certification Program 2026 updates
• Fortinet Training Institute, certification transition on July 15, 2026
• Fortinet Training Institute, NSE 4 FortiOS
• Fortinet Training Institute, FortiOS Administrator exam
• Fortinet Training Institute, NSE 5 Secure Networking
• Fortinet Training Institute, NSE 7 Secure Networking
• Fortinet Training Institute, recertification policy
• Fortinet, Academic Partner Program
• Fortinet, Veterans Program
• Palo Alto Networks, Certification program
• Palo Alto Networks, Certification FAQ (September 2026)
• Palo Alto Networks, What is replacing the PCNSE?
• Palo Alto Networks, Network Security Professional datasheet
• Palo Alto Networks, Network Security Analyst datasheet
• Palo Alto Networks, Next-Generation Firewall Engineer datasheet
• GIAC, GCIA
• GIAC, How to renew
• GIAC, Pricing
• GIAC, DoD 8140
• SANS, SEC503
• VA, Licensing and certification tests

Donald Korinchak, MBA, PMP, CISSP, SecurityX, ITILv3

Donald Korinchak is a Cybersecurity Professional in the Washington DC area. Donald holds an MBA from the University of Pittsburgh Katz School of Business. Donald is considered a thought leader in business, leadership, and cybersecurity issues.