Fortinet Certification in 2026: The New NSE 1–8 Program, FortiGate, Secure Networking, SASE, Cloud, and Security Operations

Fortinet certification entered a major new phase on July 15, 2026. The company retired the FCF, FCA, FCP, FCSS, and FCX certification names and expanded the Fortinet Network Security Expert program into eight NSE levels. For candidates preparing now, that transition is the most important fact to understand. Older FCP or FCSS study pages can still map to useful product skills, but the current credentials awarded in late 2026 are NSE 1 through NSE 8, together with track-specific certifications and new industry certifications.

The new program keeps four major technical tracks: Secure Networking, Security Operations, SASE, and Cloud Security. It also introduces a clearer progression from foundational knowledge through product administration, architecture, and expert practical assessment. That structure makes Fortinet’s ecosystem easier to read, but it also creates a transition problem: many current professionals studied under FCP or FCSS naming, while new candidates see NSE levels. Good preparation requires understanding both the modern credential and the exam history behind it.

The July 2026 change restored NSE levels as the certification framework

Under the current structure, Fortinet awards NSE 1, NSE 2, NSE 3, NSE 4, track-specific NSE 5, NSE 6, and NSE 7 credentials, and the expert-level NSE 8. The four technical tracks—Secure Networking, Security Operations, SASE, and Cloud Security—become especially important from NSE 5 onward because they distinguish product skills and architecture responsibilities.

Fortinet automatically mapped many active legacy certifications into the new program. Active FCF holders received NSE 1 and NSE 2; active FCA holders received NSE 3; FCP exam histories could generate NSE 4, NSE 5, or NSE 6 credentials depending on the exams passed; FCSS histories could map to NSE 6 or NSE 7; and active FCX holders transitioned to NSE 8. The old badges remain part of certification history, but they are no longer the names a new candidate pursues.

This means an older article describing “the FCP path” is not necessarily useless, but it is incomplete for 2026. Candidates should identify the actual exam and product skill, then check where Fortinet maps that exam in the current NSE framework.

NSE 4 is the central FortiGate and FortiOS administration level

Fortinet’s current mapping awards NSE 4 for qualifying FortiGate Administrator or FortiOS Administrator exams. That makes NSE 4 the practical center of gravity for many networking and security professionals because FortiGate is the platform on which firewall policy, routing, VPN, security inspection, SD-WAN, authentication, high availability, and other core controls meet.

The former FCP-era FortiGate Administrator 7.6 exam remains relevant to the same technical skill set. In the 2026 framework, the important point is the FortiGate Administrator skill set rather than the retired FCP label. Candidates should verify the exact live exam version before scheduling, but the technical scope remains directly relevant to NSE 4 preparation.

FortiGate administration requires more than clicking through policy screens. Candidates need to understand packet flow, interfaces, zones, routing, NAT, firewall policy matching, security profiles, authentication, VPNs, logging, and troubleshooting. Studying firewall fundamentals is useful because advanced configuration still depends on the same core question: which traffic is allowed, denied, inspected, translated, or redirected, and why?

Administrator access and identity are part of secure FortiGate operations

A security appliance can be configured with strong traffic policies and still be exposed through weak management controls. FortiGate administrators should understand administrative accounts, trusted hosts, role-based permissions, multifactor authentication, management protocols, logging, and the difference between user authentication for protected traffic and administrator authentication for the appliance itself.

The concept is explored directly in The article on FortiGate administrator access. This topic matters at every level because privileged access is part of the attack surface. Restricting who can administer a device, from where, and with what permissions is as important as writing firewall rules for application traffic.

Candidates should practice tracing both successful and failed management sessions. A failure can originate in routing, local-in policy, certificate validation, trusted-host configuration, authentication servers, permissions, or the protocol itself. Troubleshooting is strongest when each layer is tested rather than when settings are changed randomly.

NSE 5 and NSE 6 develop track-specific product depth

From NSE 5 onward, Fortinet’s program separates certifications by track. Secure Networking, Security Operations, SASE, and Cloud Security each have NSE 5 and NSE 6 credentials based on eligible proctored exams. Fortinet’s new requirements generally expect an active NSE 4 before those certifications are awarded, although candidates may sometimes pass an exam before satisfying the prerequisite and receive the certification once the full requirement is met.

Secure Networking can include products that extend beyond the FortiGate itself. The FortiManager Administrator 7.6 exam represents centralized management skills that Fortinet maps into the modern secure-networking progression. Central management changes the operational problem: policy packages, device groups, revisions, workflow, templates, and controlled deployment become as important as configuration on one firewall.

Security Operations similarly introduces platforms built around detection, analytics, and response. The FortiAnalyzer Analyst 7.6 exam is relevant to the modern security-operations track because analysts must turn logs and events into actionable evidence. That requires knowing what “normal” traffic looks like, how events are correlated, and how to distinguish a configuration problem from malicious activity.

NSE 7 is an architecture level with explicit prerequisites

Fortinet redesigned NSE 7 around comprehensive architect exams in the four technical tracks. Current requirements call for an active NSE 4 plus either an active NSE 5 or NSE 6 in the same track before the relevant NSE 7 certification can be completed. Candidates then pass the track’s proctored architect exam.

For Secure Networking, that means administration knowledge must grow into design and architecture. The Enterprise Firewall Administrator 7.6 and Network Security Support Engineer 7.6 exams come from the FCSS-era catalog and should be treated as transitional technical references rather than current FCSS credentials. Their subject matter—enterprise firewall operations and advanced support—remains useful when building toward architect-level capability.

Architecture questions require trade-offs. A design may have to balance inspection depth, routing scale, segmentation, high availability, operational simplicity, logging volume, remote-site constraints, and recovery. The candidate has to know not only whether a feature exists but where it belongs and what happens when it fails.

SD-WAN is a major Secure Networking skill.

Fortinet’s Secure Networking track reflects how often modern networks combine routing and security. SD-WAN decisions can use link health, application awareness, policy, performance objectives, and path selection to steer traffic across multiple transports. That makes SD-WAN more than a replacement for static routing.

The discussion of WAN and SD-WAN helps frame the architectural difference, while the Fortinet-specific NSE 7 SD-WAN material reflects an earlier certification era. In 2026, candidates should use the current NSE track requirements but retain the underlying skills: performance SLA measurement, path selection, overlay design, application steering, failover behavior, and security policy interaction.

Operationally, SD-WAN troubleshooting should start with observed path quality and routing state, not assumptions. A policy can be correctly configured but ineffective if health checks fail, routes are missing, or the selected transport cannot reach the destination.

SASE joins networking and cloud-delivered security.

Fortinet maintains SASE as one of the four current certification tracks. SASE brings together networking and security controls for users and devices that may be outside the traditional corporate perimeter. Candidates need to understand secure access, identity, policy enforcement, remote connectivity, internet access, and the operational model of cloud-delivered security.

Older SASE-coded exams include FCSS SASE Administrator. Because the FCSS credential itself was retired in July 2026, that exam belongs to the historical Fortinet path. A new candidate should verify which current SASE exam maps to NSE 5, NSE 6, or NSE 7 before registering.

SASE study also benefits from understanding zero-trust security. The concepts are related but not identical: zero trust is an access and verification philosophy, while SASE describes an architecture that can deliver networking and security services from the cloud edge. Good designs use identity and context without assuming that “inside” automatically means trusted.

Cloud Security is a distinct Fortinet track.

Cloud security requires candidates to understand how Fortinet controls interact with provider networking, identity, workloads, APIs, and distributed architectures. A firewall deployed in a cloud environment does not operate in the same way as a single appliance at the edge of a campus. Route tables, security groups, cloud load balancers, autoscaling, high availability, and automation can all affect traffic paths.

That makes cloud security misconfiguration a strong supporting concept. Many cloud incidents arise from the interaction between multiple control planes rather than one broken security product. A Fortinet candidate should be able to reason about which layer owns a decision and where logs or packet evidence should be collected.

As with the other tracks, candidates should avoid assuming an older FCP or FCSS label is still current. The product knowledge may transfer, but the certification name and prerequisites must be checked against Fortinet’s post-July-2026 program.

Security Operations emphasizes evidence, detection, and response

Security Operations professionals need to connect telemetry to action. Logs from firewalls, endpoints, identity systems, cloud services, and applications can show pieces of the same incident, but an analyst needs enough context to decide whether an event is benign, suspicious, or part of a larger attack.

The principles behind threat management and incident response are therefore relevant to the Fortinet security-operations track. Product knowledge matters, but analysts also need triage, evidence preservation, escalation, containment, recovery, and post-incident learning.

A certification candidate should practice explaining why an alert matters. Severity alone is not enough. Asset criticality, user identity, exposure, observed behavior, threat intelligence, and corroborating events determine the real risk.

Web filtering and application control are operational policy problems

FortiGate security profiles can enforce web, application, antivirus, intrusion-prevention, DNS, and other controls. These features are most effective when administrators understand the application and business requirement behind the rule. Blocking too broadly can break legitimate workflows, while permissive exceptions can become long-term security gaps.

The FortiGate web filtering material is useful for this reason. Candidates should study not just where a filter is configured but how categories, inspection mode, certificates, user identity, policy order, logging, and exceptions affect the result.

When troubleshooting, the candidate should identify whether the problem is policy match, DNS, TLS inspection, category classification, application control, routing, or the remote service. Security features often interact, so disabling controls until the site works is not a sound diagnostic method.

NSE 8 is now a practical expert certification with prerequisites

Fortinet changed NSE 8 substantially in 2026. The current certification requires an active NSE 4, an active NSE 5 or NSE 6, and an active NSE 7 in the same track as the NSE 5 or NSE 6 credential. Candidates then pass two practical assessments: an NSE 8 Core exam and one NSE 8 Elective within the required time window.

The former NSE8_812 written exam is no longer the initial-certification prerequisite for the redesigned expert path. Fortinet also changed the certification period for newly achieved or renewed NSE 8 credentials to two years and introduced a recertification-point model for maintaining expert status.

This makes NSE 8 a true capstone rather than simply another theory exam. Candidates need broad troubleshooting, architecture, and implementation skill across Fortinet technologies, then must demonstrate it in practical conditions. Someone planning for NSE 8 should build depth across real systems long before booking the assessment.

Use old FCP and FCSS pages carefully during the transition

Many FCP and FCSS exam codes were part of Fortinet's active certification ecosystem before the July 15, 2026 program transition. They remain useful for understanding recent product domains and version history, and Fortinet used qualifying recent exam history when issuing credentials under the revised NSE framework. Historical codes should therefore be labeled by status rather than erased or presented as current by default.

But visible wording must make the timing clear. FCP, FCSS, and FCX are retired certification names. A candidate studying in late 2026 should identify the current NSE level and track first, then use an older exam page only when its product version or skill domain materially supports that current objective.

The best preparation sequence is therefore current-first: confirm the live NSE certification requirements, select the track that matches the role, identify the current eligible exam, and then use relevant historical exam material as supplementary technical depth. That preserves useful Fortinet knowledge without confusing a retired credential with the certification that will actually be awarded today.