Who Is Buying CrowdStrike? Hedge Fund Activity in 2026

CrowdStrike (CRWD) continues to attract institutional capital as the cybersecurity sector remains one of the most durable growth themes in technology. The latest 13F filings reveal a solidly bullish 5-to-3 buying-to-selling ratio, with several prominent hedge funds increasing their already substantial positions. The cybersecurity platform leader is well-owned and getting more so.

With CRWD trading around $399.11 and 13 active funds tracked, the institutional community is sending a clear signal: cybersecurity spending isn't slowing down, and CrowdStrike is the preferred way to play it.

Key Stats at a Glance

• 5 funds buying | 3 funds selling | 5 holding steady
• 13 active institutional funds tracked
• Current price: ~$399.11
• Top institutional holders: Vanguard ($9.7B), State Street ($4.5B)

The 5-to-3 buying advantage, combined with 5 funds holding steady, suggests broad institutional satisfaction with CrowdStrike's positioning. The majority of institutional holders are either adding or maintaining their exposure.

Who's Buying CrowdStrike?

The buying side features several funds making large, concentrated bets on cybersecurity leadership.

Baker Bros leads active hedge fund buying with a $335.6 million increased position. The fund's significant commitment reflects deep conviction in CrowdStrike's competitive positioning within endpoint security and its expansion into adjacent cybersecurity markets.

Appaloosa Management built its stake to $154.4 million. David Tepper's fund adding to CrowdStrike signals confidence in the company's earnings growth trajectory — Tepper is known for disciplined valuation analysis, so his buying suggests CRWD offers attractive risk-reward even at elevated prices.

Two Sigma opened a brand new $5.1 million position, adding a fresh quant perspective to the bull case. While modest in size, Two Sigma's entry signals that quantitative models are identifying favorable patterns in CrowdStrike's data.

On the passive side, Vanguard increased its $9.7 billion holding and State Street grew its $4.5 billion position — reinforcing the strong passive foundation supporting the stock.

Who's Selling CrowdStrike?

The selling side is limited to three funds making modest reductions.

Citadel leads the sellers with a decrease to $134.4 million. Ken Griffin's fund reducing exposure is noteworthy, but the $134 million remaining position shows Citadel hasn't lost conviction entirely — it's a trim, not an exit.

D.E. Shaw reduced to $17.1 million, and Millennium Management cut to $2.9 million. Neither exit represents a large dollar shift, and no fund completely exited the stock this quarter.

The absence of any full exits is significant — even the sellers are maintaining positions, suggesting their reductions are tactical rather than thesis-driven.

Notable Moves

Two Sigma's new $5.1 million position adds to the buying narrative. While the initial size is small, Two Sigma typically scales into positions over multiple quarters. A new entry during a period of broad institutional buying suggests the fund's quantitative models see the beginning of a favorable setup.

Baker Bros' $335.6 million position is the largest active hedge fund bet on CrowdStrike and reflects a deep, research-driven conviction in the company's technology leadership. Baker Bros has historically excelled at identifying dominant platform companies in their growth phases.

The 5 funds holding steady is an underappreciated bullish signal. In a volatile cybersecurity market, five institutional funds choosing to maintain their positions without trimming indicates satisfaction with CrowdStrike's execution and valuation. When combined with the 5 buyers, it means 10 out of 13 tracked funds are either buying or holding — a 77% positive-or-neutral rate.

Citadel's reduction from a larger position to $134.4 million may reflect profit-taking rather than fundamental concerns. CrowdStrike has performed well, and multi-strategy funds like Citadel often trim winners to manage portfolio concentration.

What This Signals

The institutional picture for CrowdStrike is clearly bullish, driven by the convergence of fundamental and structural factors.

Why institutions continue to accumulate:

1. Cybersecurity spending is non-discretionary — In an era of escalating cyber threats, from ransomware to state-sponsored attacks, enterprises cannot cut security budgets. CrowdStrike benefits from a spending category that grows regardless of the economic cycle.

2. Platform consolidation — CrowdStrike's Falcon platform has expanded from endpoint security into cloud security, identity protection, and IT operations. Customers are consolidating their security tools onto fewer platforms, and CrowdStrike's integrated approach is winning wallet share.

3. AI-native architecture — CrowdStrike's cloud-native, AI-first architecture gives it structural advantages in detecting and responding to threats. As AI-powered attacks become more sophisticated, AI-powered defense becomes more valuable.

4. Net retention rates — Existing customers continue to expand their CrowdStrike deployments, driving strong net dollar retention rates. This organic expansion within the installed base provides predictable revenue growth with minimal customer acquisition costs.

5. Market leadership — CrowdStrike's position as the leading independent endpoint security platform gives it scale advantages in data collection, which feeds into better threat detection, creating a virtuous cycle that's difficult for competitors to replicate.

The modest selling from Citadel, D.E. Shaw, and Millennium doesn't challenge the broader bull thesis. No fund exited entirely, and the reductions appear tactical. The institutional consensus is clear: CrowdStrike remains a core cybersecurity holding with room to grow.

It's also worth considering CrowdStrike's competitive moat in the context of the broader cybersecurity landscape. While Palo Alto Networks dominates network security, CrowdStrike owns the endpoint. The two companies address different — and increasingly complementary — segments of the security stack. Institutional investors who are bullish on cybersecurity spending often hold both names, which explains why both CRWD and PANW show positive institutional flow this quarter.

The absence of complete exits is particularly telling for CrowdStrike. Even funds reducing their positions maintained meaningful stakes, suggesting they view CRWD as a core holding worth keeping rather than a trade to close. For smart money watchers, the combination of concentrated buying, no exits, and broad holding stability makes CrowdStrike one of the most defensively bullish institutional setups this quarter.

The Bigger Picture for CRWD

CrowdStrike's institutional support reflects a sector-wide conviction that cybersecurity spending will continue to grow regardless of economic conditions. In a world where data breaches can cost companies hundreds of millions in damages, reputational harm, and regulatory penalties, cybersecurity budgets are among the last to be cut during downturns.

The 13-fund coverage count is smaller than some other stocks analyzed this quarter, but the quality of the holders is high. Baker Bros, Appaloosa, Vanguard, State Street, and Citadel represent a cross-section of the most sophisticated institutional capital in the world. Their collective positioning — overwhelmingly bullish — suggests CrowdStrike has earned a durable place in institutional portfolios.

Looking ahead, investors should monitor whether Two Sigma scales its new $5.1 million position in subsequent quarters. New positions from quant funds often start small as testing allocations before scaling if the initial signals prove profitable. An increase from Two Sigma next quarter would add another layer of conviction to CrowdStrike's already strong institutional endorsement.

Track CrowdStrike Institutional Activity

Track CRWD institutional moves in real-time with Freenance Smart Money — we track 35 funds with $21.4T total AUM across 77,111 positions. See who's buying and selling at app.freenance.io/smart-money/ticker/CRWD.

Related Articles

• Who Is Buying NVIDIA? Hedge Fund Activity in 2026
• Who Is Buying Apple? Hedge Fund Activity in 2026
• Who Is Buying Tesla? Hedge Fund Activity in 2026

FAQ

Which hedge funds are increasing CrowdStrike (CRWD) positions according to recent 13F filings?

Recent 13F filings show Baker Bros leading active hedge fund buying with a $335.6 million increased position, while Appaloosa Management built its stake to $154.4 million. Two Sigma opened a new $5.1 million position, and passive giants Vanguard ($9.7B) and State Street ($4.5B) both added to their already substantial holdings.

How does the Falcon platform support CrowdStrike's institutional appeal?

CrowdStrike's cloud-native, AI-first Falcon platform has expanded from endpoint security into cloud security, identity protection, and IT operations, capturing wallet share as enterprises consolidate vendors. The platform's data-driven threat detection benefits from scale, creating a self-reinforcing advantage that institutional investors view as a structural moat.

Why is the 5-buy-to-3-sell ratio considered bullish for CRWD?

The 5-to-3 buy-sell ratio, combined with 5 funds holding steady, means 10 out of 13 tracked funds are either accumulating or maintaining exposure — a 77% positive-or-neutral rate. The absence of any complete exits also signals that even sellers view CrowdStrike as a core position worth keeping rather than a trade to close.

What does Citadel's reduction in CrowdStrike signal?

Citadel reduced its exposure to $134.4 million, but the remaining position size suggests profit-taking after a strong run rather than a thesis change. Multi-strategy funds like Citadel often trim winners to manage portfolio concentration, and no other large funds followed with full exits.

Which top institutional holders are most exposed to CRWD?

According to 13F filings, Vanguard leads with $9.7 billion and State Street follows with $4.5 billion on the passive side. On the active side, Baker Bros ($335.6M) and Appaloosa Management ($154.4M) represent the largest concentrated hedge fund positions in the tracked universe.