Fortinet Certification Overview: NSE Levels, Tracks, Preparation, and Path Selection
Fortinet’s NSE Certification Program is designed for people building, administering, supporting, and securing environments based on Fortinet technologies, from newcomers learning cybersecurity fundamentals to experienced professionals handling complex network-security problems. The program combines foundational courses, product-focused administrator exams, specialist tracks, architect credentials, and the NSE 8 Cybersecurity Expert designation. This overview explains how those pieces fit together, what the published requirements mean, how to prepare responsibly, and which questions can help you choose a sensible Fortinet certification path.
Start with the program structure, not a single exam
The most useful way to understand Fortinet certification is as a connected ecosystem rather than a list of isolated tests. The NSE program progresses from introductory learning through FortiOS administration, specialist disciplines, architecture-level credentials, and the NSE 8 expert designation.
Fortinet describes FortiOS as the foundation of the Fortinet Security Fabric. That makes NSE 4 in FortiOS an important decision point for many technical candidates: it is the first published requirement for the specialist NSE 5 and NSE 6 credentials and appears again in the requirements for NSE 7 and NSE 8. The certification structure therefore rewards candidates who first establish a working understanding of FortiOS before moving into a narrower or more advanced area.
The program is also changing. Effective July 15, 2026, Fortinet says the number of available certification levels will increase from 5 to 8. The four training tracks will remain Secure Networking, Security Operations, Cloud Security, and SASE, while industry certifications, new comprehensive NSE 7 exams, a broader eligible-product range, updated recertification rules, and reorganized cybersecurity fundamentals training are introduced. Readers planning around a transition should verify the current requirements in the Training Institute before booking an exam.
Use NSE 1 through NSE 3 to test whether Fortinet is the right starting point
NSE 1 through NSE 3 are the most accessible entry route because the published requirements emphasize online learning and an operator-level foundation rather than advanced architecture experience. They can suit students, career changers, new IT staff, and professionals who need a structured introduction before committing to a technical administrator path.
For NSE 1, Fortinet lists completion of the online Cybersecurity and Cloud Fundamentals course. NSE 2 requires completion of the online Introduction to the Next Generation Firewall course. NSE 3 requires completion of the online FortiGate Operator course and passing the online NSE 3 FortiGate Operator exam.
These levels should be viewed as orientation and foundational development rather than substitutes for hands-on administration. A candidate considering an operational role should use the learning sequence to check whether core concepts such as network security, firewall operation, and FortiGate workflows are understandable and engaging. If the material feels unfamiliar, continuing through the introductory courses is more sensible than jumping directly to an advanced credential.
The Training Institute provides a library of self-paced and instructor-led courses, along with practical and experiential exercises. It also provides a public schedule for in-person and virtual classes, Authorized Training Centers, and an Academic Partner Program for qualifying educational and nonprofit institutions. Those options allow beginners to choose between independent study, structured instruction, and institution-supported learning.
Treat NSE 4 FortiOS as the main technical branching point
NSE 4 is the clearest next step for candidates who want to administer Fortinet environments. The published requirement is to pass the proctored NSE 4 in FortiOS Administrator exam. Beyond its own scope, an active NSE 4 is required for the published NSE 5 and NSE 6 credentials and for the higher NSE 7, NSE 8, OT Security, and MSSP Security paths in the 2026 program.
This makes NSE 4 appropriate for network administrators, security administrators, support engineers, and professionals whose work includes configuring or maintaining FortiGate and FortiOS. It can also be a practical bridge for someone who completed the introductory levels but now needs a more operational credential.
Readiness should be demonstrated through ability, not just course completion. Before selecting NSE 4, a candidate should be able to explain the purpose of common firewall controls, follow traffic through a troubleshooting process, interpret configuration behavior, and connect security policy decisions to network design. The official course material and labs should be the starting point for identifying gaps.
Fortinet’s published program structure does not require candidates to hold every earlier level before NSE 4. The stated requirement is the proctored NSE 4 in FortiOS Administrator exam. However, the introductory courses can still be useful preparation for candidates who lack a cybersecurity or firewall background.
Choose an NSE 5 or NSE 6 track by the work you want to perform
After NSE 4, choose a track based on the problems you expect to solve, not simply on the next available exam. Fortinet publishes four tracks: Secure Networking, Security Operations, Cloud Security, and SASE. For each NSE 5 and NSE 6 track, the published requirement is an active NSE 4 plus passing the relevant proctored exam.
Secure Networking is the natural fit for professionals focused on network-security infrastructure, administration, monitoring, and troubleshooting. Security Operations is more appropriate for candidates whose responsibilities center on operational detection, response, and related security workflows. Cloud Security suits professionals working with cloud-oriented protection and security architecture. SASE is relevant when the role connects networking and security services across distributed users, sites, and access models.
The level number alone should not decide between NSE 5 and NSE 6. The more useful questions are whether the target role needs the subject matter of a particular track, whether the candidate’s current Fortinet environment uses those capabilities, and whether the candidate can apply the concepts rather than recall terminology. Fortinet’s requirements allow either an NSE 5 or NSE 6 credential in the same track to support the corresponding NSE 7 route.
A candidate who is unsure between tracks can compare the course descriptions in the Training Institute library with current work responsibilities. Look for the track that matches recurring tasks, products, and troubleshooting decisions. A broader credential is not automatically a better choice if the subject does not align with the candidate’s environment.
Secure Networking
The Secure Networking path is aimed at people responsible for Fortinet network-security solutions. Its NSE 7 description refers specifically to designing, administering, monitoring, and troubleshooting those solutions, so candidates considering this route should build a strong understanding of network architecture and FortiOS behavior before progressing beyond NSE 4.
Security Operations
The Security Operations path is suited to professionals whose work is organized around security monitoring and operational response. The published requirements establish the path and its progression, but candidates should use the official course catalog to confirm the current exam subject and associated learning resources before planning study.
Cloud Security
Cloud Security is the relevant track for candidates whose responsibilities involve Fortinet cloud-security capabilities. Because product coverage and certification-eligible products are being expanded as part of the 2026 program changes, candidates should confirm the current course and exam scope rather than rely on an older outline.
SASE
SASE provides a track for professionals working across security and networking functions delivered to distributed environments. As with the other tracks, the published route begins with an active NSE 4 and then an NSE 5 or NSE 6 SASE credential before the corresponding NSE 7 architect exam.
Move to NSE 7 when you can design and troubleshoot, not merely operate
NSE 7 is intended for professionals who need advanced, track-specific architecture capability. In Secure Networking, Fortinet says the certification validates the ability to design, administer, monitor, and troubleshoot Fortinet network-security solutions and recommends it for cybersecurity professionals who design, manage, support, and analyze those solutions.
The published 2026 requirement for NSE 7 in Secure Networking is an active NSE 4 FortiOS certification, either an active NSE 5 Secure Networking or NSE 6 Secure Networking certification, and the proctored NSE 7 Secure Networking Architect exam. The corresponding Security Operations, SASE, and Cloud Security routes use the same general pattern: active NSE 4, an active NSE 5 or NSE 6 in the same track, and the relevant proctored NSE 7 architect exam.
For the Secure Networking path, all prerequisites and the NSE 7 exam must be completed within 2 years of the last prerequisite exam. Fortinet states that the awarded certification is active for 2 years from the date of the NSE 7 exam or the last prerequisite exam, whichever is later. The candidate should therefore track prerequisite status and exam timing rather than treating each exam as an unrelated milestone.
NSE 7 readiness is best demonstrated by the ability to reason through design trade-offs, isolate faults, interpret system behavior, and explain why a configuration solves a stated security or networking problem. Fortinet recommends taking the associated NSE courses. Those courses, labs, and practical exercises should form the preparation core; memorizing question patterns is not a substitute for the skills the credential is intended to validate.
Fortinet states that NSE 7 exams are available worldwide at Pearson VUE test centers and through OnVUE. The published Secure Networking page says the exam uses multiple-choice and drag-and-drop questions, with answers required to be 100% correct for credit and no partial credit. A failed exam requires a 15 day wait before retaking it. Candidates should confirm current delivery and retake policies on the official exam page before scheduling.
Reserve NSE 8 for complex, hands-on security work
NSE 8 is for experienced networking and security experts who use Fortinet solutions and can solve complex security problems across complex networks. Fortinet describes the designation as recognizing comprehensive knowledge of network-security design, configuration, and troubleshooting, and recommends industry experience in addition to formal training.
The published NSE 8 requirements are cumulative. A candidate must hold an active NSE 4 FortiOS certification, an active NSE 5 or NSE 6 certification in any track, and an active NSE 7 certification in the same track as that NSE 5 or NSE 6 certification. The candidate must then pass the NSE 8 Core Practical Exam and one Elective Practical Exam within 1 year.
The available elective examples listed by Fortinet are Secure Networking, Application Security, and Security Operations. This lets an eligible candidate connect the expert assessment to a relevant technical area, while the core practical exam tests the broader expert requirement. The choice should reflect real professional experience and the kinds of complex systems the candidate can confidently configure and troubleshoot.
The delivery model differs from the ordinary proctored exam pattern. Fortinet lists the core exam as on-site at selected Fortinet offices and events, while elective exams are on-site or online proctored by ProctorU. Candidates may be asked to provide additional information before scheduling the core practical exam, including information used to confirm account details, training and testing history, and prior engagement with the program. Fortinet warns that scheduling may not proceed if the requested information is not satisfactorily provided.
Fortinet states that the NSE 8 certification is active for 2 years from the date of the second exam. It also provides digital exam badges for each passed exam and a certification badge after the certification requirements are achieved. The score report states a pass or fail result and is delivered within 30 days of exam completion.
Plan renewal before you commit to a long progression
Renewal should be part of path selection because Fortinet ties higher-level credentials to active prerequisites. The exact action depends on the level, track, exam version, and current program rules, so candidates should review the live certification page rather than assume that passing one exam renews every credential.
For NSE 7 Secure Networking, Fortinet states that the certification can be renewed while the NSE 7, NSE 4 FortiOS, and either NSE 5 or NSE 6 Secure Networking certifications remain active by passing the next version of the NSE 7 exam, completing the online NSE 7 recertification assessment when the stated eligibility conditions apply, or passing any NSE 8 practical exam. If the NSE 7 certification has expired, the published route requires passing the NSE 4 exam and one proctored NSE 5 or NSE 6 Secure Networking exam within 2 years.
Earning or renewing NSE 7 Secure Networking also renews active NSE 1, NSE 2, NSE 3, NSE 4, NSE 5 Secure Networking, and NSE 6 Secure Networking certifications. This is useful for candidates planning a continuing Secure Networking path, but it does not remove the requirement to maintain the prerequisites needed for the higher credential itself.
NSE 8 renewal uses a different model. Fortinet lists the prerequisite certifications, including NSE 4, NSE 5 or NSE 6 in any track, and NSE 7 in the same track as the NSE 5 or NSE 6 certification, followed by accumulation of 200 activity points. Completing NSE 4 through NSE 7 exams contributes to those points. Fortinet also says that achieving or recertifying NSE 8 through 200 points by taking any NSE 8 practical exam renews active NSE 1 through NSE 7 certifications, subject to active prerequisites at renewal.
The 2026 program update introduces recertification points for NSE 8 and changes the NSE 8 expiration period to 2 years. Fortinet separately states that candidates holding an NSE 8 certificate with an expiry date before July 31, 2027 may be eligible for the NSE 8 Recertification Exam, which is available until January 31, 2027. Because these are date-sensitive policies, candidates should verify eligibility and registration instructions directly with Fortinet.
Build preparation around official learning and observable skills
The strongest preparation approach combines the official course path with hands-on practice and troubleshooting. Fortinet’s Training Institute offers self-paced and instructor-led courses, practical exercises, and hands-on learning resources. Candidates can use the library to identify associated courses for a target certification and the schedule to compare virtual, in-person, and Authorized Training Center options.
Begin by mapping the target credential to its requirements. Write down the prerequisite certifications, the required exam or exams, the track relationship, and any timing condition. This prevents a common planning error: preparing for an advanced exam without checking whether the prerequisite credential will still be active when the higher certification is issued.
Next, separate knowledge review from configuration practice. Knowledge review should cover the concepts named in the official course material. Practice should involve setting up relevant configurations, observing expected behavior, introducing controlled faults, and explaining the troubleshooting process. For architect-level paths, practice should also include design reasoning: defining requirements, identifying constraints, selecting an approach, and validating the result.
Use official course recommendations as the anchor for exam preparation. Fortinet specifically recommends associated NSE courses for NSE 7 Secure Networking. For NSE 8, formal training is only one part of the readiness picture because Fortinet recommends industry experience and complex-network problem-solving ability. A candidate who can passively follow lessons but cannot explain or troubleshoot a working design should continue developing practical skill.
Do not treat unauthorized question collections or memorization as a reliable preparation method. They can omit current objectives, provide misleading answers, and do not create the configuration and troubleshooting ability represented by advanced Fortinet credentials. A defensible preparation record is based on official objectives, completed learning, lab practice, and the ability to explain decisions under changed conditions.
Choose a path by role, environment, and available commitment
The right Fortinet path is the one that matches the candidate’s work and can be maintained after certification. A simple decision process is to identify the current role, the Fortinet technologies used or expected, the desired level of responsibility, and the time available for structured learning and practical work.
A beginner with limited security experience can start with NSE 1 through NSE 3. These levels provide an organized introduction to cybersecurity, next-generation firewall concepts, and FortiGate operation. The candidate can then decide whether NSE 4 administration is a realistic next objective.
A network or security administrator who works with FortiGate should generally evaluate NSE 4 first. It is the core technical credential in the published progression and the prerequisite for the specialist tracks. The candidate should choose NSE 5 or NSE 6 only after identifying the specialist discipline that matches actual responsibilities.
A security monitoring or response professional should compare Security Operations courses and exams with the work performed daily. A cloud-focused professional should examine Cloud Security. Someone responsible for distributed connectivity and security services should consider SASE. A network-security engineer or architect can assess Secure Networking, particularly when design, administration, monitoring, and troubleshooting are central duties.
An experienced specialist who already holds the necessary track credentials can evaluate NSE 7. The decision should be based on whether the candidate regularly makes architecture-level decisions and solves difficult operational problems, not on the appeal of a higher number. NSE 8 should be considered only when the candidate satisfies the prerequisite chain and has meaningful experience with complex networks and hands-on troubleshooting.
Employers and training managers can use the same framework when choosing development plans. Start with the responsibilities a person must perform, select the matching track, confirm the prerequisite chain, and provide access to official training and practical exercises. This produces a more defensible plan than assigning every employee the same level.
Check these questions before booking a Fortinet exam
Before paying for or scheduling an assessment, confirm the current program version and the exact certification name. Fortinet’s 2026 changes affect levels, tracks, eligible products, exam structure, and recertification rules. An older article, course reference, or study plan may not describe the current route.
Then verify the prerequisite status in the Fortinet Training Institute account. For NSE 7 and NSE 8, active prerequisite certifications are not a formality: they determine whether the higher certification can be issued and, in some cases, whether renewal is possible. Check the track relationship between NSE 5 or NSE 6 and NSE 7 before selecting an exam.
Confirm delivery, identification, scheduling, and retake rules on the official exam page. NSE 7 Secure Networking is listed through Pearson VUE test centers and OnVUE, while NSE 8 uses a separate practical-exam model. The published retake waiting period also differs between the NSE 7 and NSE 8 pages, so candidates should not generalize one policy to another.
Ask whether the available preparation matches the assessment style. Candidates moving toward NSE 7 should look for associated courses and practice that develop design and troubleshooting judgment. Candidates considering NSE 8 should confirm that they have the practical experience and complex-network exposure Fortinet recommends, not merely familiarity with course terminology.
Finally, confirm renewal consequences and dates. Determine what remains active, which prerequisite credentials must be renewed, whether the chosen exam version can count toward recertification, and whether any transition policy applies. Fortinet states that once an exam version has been counted toward certification, it cannot be used again to renew the same certification. A short check of the current official policy can prevent an expensive planning mistake.
Use Fortinet’s training ecosystem as the next practical step
The most sensible next step is to open the Fortinet Training Institute library, identify the current target credential, and compare its requirements with your present skills and certification status. The library supports self-paced and instructor-led learning, while the public schedule lists in-person and virtual options. Authorized Training Centers provide another route to instructor-led training, including local-language delivery in many countries.
Candidates in education or career-readiness programs can also investigate the Academic Partner Program. Fortinet says the program provides institutions such as K-12 schools, higher-education organizations, and qualifying nonprofits with resources to facilitate its certification curriculum. That option may be more suitable than independent preparation for learners who need structured institutional support.
Keep a written progression plan. Record the target track, prerequisite certifications, associated courses, lab activities, intended exam, and renewal checkpoint. Revisit the plan if an exam version, prerequisite, or program policy changes. This is especially important around the July 15, 2026 NSE program update.
A Fortinet credential is most useful when it reflects work the holder can actually perform. Use the certification framework to organize learning, but use hands-on configuration, diagnosis, and design practice to judge readiness. The result is a path that supports both the immediate exam decision and longer-term development within Fortinet’s ecosystem.
Conclusion
Fortinet’s NSE program offers several reasonable entry points, but the best choice depends on role and technical direction. Start with NSE 1 through NSE 3 if you need fundamentals, move to NSE 4 for FortiOS administration, select an NSE 5 or NSE 6 track according to your work, and consider NSE 7 or NSE 8 only when your design and troubleshooting experience supports the requirements. Use the official Training Institute for current prerequisites, learning resources, delivery details, transition notices, and renewal rules, then build preparation around genuine practical capability rather than memorization.
Related exams
- FCSS_EFW_AD-7.6 exam — Fortinet NSE 7Enterprise Firewall 7.6 Administrator
- NSE7_EFW-6.0 exam — Fortinet NSE 7 - Enterprise Firewall 6.0
- NSE4_FGT-7.2 exam — Fortinet NSE 4 - FortiOS 7.2
- EMEA-Advanced-Support exam — Fortinet EMEA Advanced Support Exam
- FCP_FMG_AD-7.6 exam — Fortinet NSE 5 - FortiManager 7.6 Administrator
- FCP_FAZ_AN-7.6 exam — Fortinet NSE 5FortiAnalyzer 7.6 Analyst
- NSE5_EDR-5.0 exam — Fortinet NSE 5 - FortiEDR 5.0 Exam
- FCP_FML_AD-7.4 exam — FCPFortiMail 7.4 Administrator
- NSE7_EFW-6.2 exam — Fortinet NSE 7 - Enterprise Firewall 6.2
- FCSS_ADA_AR-6.7 exam — FCSSAdvanced Analytics 6.7 Architect
- NSE6_EDR_AD-7.0 exam — Fortinet NSE 6FortiEDR 7.0 Administrator
- NSE6_FAC-6.1 exam — Fortinet NSE 6 - FortiAuthenticator 6.1
Official sources
- What is changing in the NSE Certification program in 2026?
- What are the new certification requirements? : Training Institute Help Desk
- Learn more about Fortinet and the Security Fabric
- Network Security Expert (NSE) Training Institute | Fortinet
- training.fortinet.com
- NSE 7 in Secure Networking | Training Institute
- NSE 8 Cybersecurity Expert | Training Institute - Fortinet
