Who Is Buying Palo Alto Networks? Hedge Fund Activity in 2026
See which hedge funds are buying, selling, or holding Palo Alto Networks (PANW) based on latest 13F filings. 8 funds buying, institutional value $19.3B.
8 min czytaniaFact-checked against primary sources on · figures re-verified on regulator, issuer or SEC filings — not copied from other sites
Who Is Buying Palo Alto Networks? Hedge Fund Activity in 2026
Palo Alto Networks (PANW) is commanding strong institutional conviction this quarter, with the cybersecurity giant attracting an 8-to-5 buying-to-selling ratio that reflects broad confidence in the network security leader. The latest 13F filings reveal a diverse coalition of buyers — from passive index giants to elite hedge fund managers — all increasing their exposure to the company simultaneously.
With PANW trading around $163.21 and 15 active funds tracked, the institutional landscape is decidedly bullish. But the selling side includes its own notable moves, including a complete exit by one of the world's largest hedge funds. Here's the full breakdown.
Quick Answer
Across the funds we read directly from SEC filings, the largest Palo Alto Networks position in the Q2 2026 13Fs (period ending 30 June 2026) is Citadel Advisors at $511M (1,499,125 shares). Measured against the size of each filer's book rather than in dollars, the most concentrated holder is Citadel Advisors, where Palo Alto Networks is 0.3% of everything they report. Every figure here is aggregated by CUSIP from the filer's own information table with put/call rows excluded — a 13F lists options beside shares, and adding them together is what produces the inflated stakes quoted elsewhere. Filings lag roughly 45 days: this is positioning as of 30 June 2026, not today, and not investment advice.
Key Stats at a Glance
- 8 funds buying | 5 funds selling | 2 holding steady
- 15 active institutional funds tracked
- Current price: ~$163.21 Index managers such as Vanguard, BlackRock and State Street hold the largest raw positions in almost every large-cap name, because they track the index rather than pick the stock. Among the active filers we read directly from EDGAR, the largest position in the Q2 2026 filings is Citadel Advisors at $511M (1,499,125 shares).
The 8-to-5 buying advantage with only 2 holding steady means nearly every tracked fund is actively adjusting its PANW position — and the majority are adding.
Who holds Palo Alto Networks, and how much it matters to them
Read from each filer's Q2 2026 information table (period ending 30 June 2026).
| Fund | Position | Shares | Share of the fund's 13F book |
|---|---|---|---|
| Citadel Advisors | $511M | 1,499,125 | 0.3% of $171.84B |
| Millennium Management | $137M | 403,172 | 0.1% of $142.92B |
Only 2 of the 9 active filers we read report Palo Alto Networks at all. That absence is the finding: this is not a name the large multi-strategy and long-only funds in this set are positioned in, whatever retail interest it attracts.
Savings in one bank, investments in another? See it all in one place — and how many months it could carry you.
See your Freedom Runway — freeWho added and who cut
Comparing each filer's Q1 2026 table with its Q2 2026 one, by share count — the change is what shows conviction, not the size of the position.
| Fund | Q1 2026 shares | Q2 2026 shares | Change |
|---|---|---|---|
| Millennium Management | 210,927 | 403,172 | +91% |
| Citadel Advisors | 1,823,683 | 1,499,125 | -18% |
A fund absent from this table reported no Palo Alto Networks position in either quarter.
PANW vs. CRWD: The Institutional Cybersecurity Debate
Palo Alto Networks and CrowdStrike represent the two dominant cybersecurity plays in institutional portfolios, and this quarter's 13F data shows both names attracting strong buying interest. PANW's 8-to-5 ratio and CRWD's 5-to-3 ratio both lean bullish, suggesting institutions see cybersecurity as a sector where multiple winners can thrive.
The interesting nuance is in which funds prefer which name. Some funds — like Baker Bros and Appaloosa — are buying both, indicating a sector-wide bullish thesis. Others are more selective in their cybersecurity exposure. This dual accumulation pattern reinforces the structural growth narrative for cybersecurity spending overall.
For investors choosing between the two, the institutional data suggests PANW has broader buying support (8 funds) but also more selling pressure (5 funds vs. CRWD's 3). CRWD has a cleaner institutional profile with no exits, while PANW has one complete exit from Bridgewater. Both names, however, enjoy strong net institutional demand — making cybersecurity one of the most favored sectors in this quarter's 13F filing cycle.
Track Palo Alto Networks Institutional Activity
Track PANW institutional moves in real-time with Freenance Smart Money — we track 35 funds with $21.4T total AUM across 77,111 positions. See who's buying and selling at app.freenance.io/smart-money/ticker/PANW.
Related Articles
- Who Is Buying NVIDIA? Hedge Fund Activity in 2026
- Who Is Buying Apple? Hedge Fund Activity in 2026
- Who Is Buying Tesla? Hedge Fund Activity in 2026
FAQ
Why is institutional money flowing into Palo Alto Networks?
The core thesis is platform consolidation — enterprises are collapsing point-solution security vendors into integrated platforms covering network, cloud and SOC. PANW's three-platform strategy (Strata, Prisma, Cortex) plus a SASE-led shift to subscription revenue is exactly what fundamental funds like Appaloosa and Baker Bros are underwriting with $400M+ positions each.
What is "platformization" and why does it matter for PANW?
Platformization is Palo Alto's strategy of bundling its security products so customers commit to the full stack rather than buying piecemeal. It lifts average deal size, lengthens contracts and improves net retention, which is why ARR growth has become the metric institutional analysts track most closely.
Why did Bridgewater exit Palo Alto Networks entirely?
Bridgewater is a macro and risk-parity fund, so a full exit usually reflects portfolio-level allocation calls — interest rate sensitivity, growth-versus-value tilt, or factor exposure — rather than a specific bearish view on cybersecurity. The remaining 8-to-5 buy/sell tilt with active managers still adding suggests the company-specific thesis remains intact.
How does PANW compare to CrowdStrike in 13F filings?
Both names show net buying this quarter (PANW 8:5, CRWD 5:3), and several funds like Baker Bros and Appaloosa own both — a sign that institutions see cybersecurity as a multi-winner sector rather than a zero-sum race. PANW gets more total flow because of its larger market cap and broader product surface, while CRWD draws growth-focused funds for its endpoint and XDR leadership.
Where can I see real-time PANW hedge fund moves?
Freenance Smart Money tracks 13F filings from major funds and lets you filter by ticker, fund and quarter-over-quarter change. For PANW specifically you can see Appaloosa, Baker Bros, Vanguard and the rest side-by-side, which is more actionable than reading individual 13F PDFs from EDGAR.