Who Is Buying Palo Alto Networks? Hedge Fund Activity in 2026

Palo Alto Networks (PANW) is commanding strong institutional conviction this quarter, with the cybersecurity giant attracting an 8-to-5 buying-to-selling ratio that reflects broad confidence in the network security leader. The latest 13F filings reveal a diverse coalition of buyers — from passive index giants to elite hedge fund managers — all increasing their exposure to the company simultaneously.

With PANW trading around $163.21 and 15 active funds tracked, the institutional landscape is decidedly bullish. But the selling side includes its own notable moves, including a complete exit by one of the world's largest hedge funds. Here's the full breakdown.

Key Stats at a Glance

• 8 funds buying | 5 funds selling | 2 holding steady
• 15 active institutional funds tracked
• Current price: ~$163.21
• Top institutional holders: Vanguard ($11.1B), State Street ($5B), T. Rowe Price ($3.2B)

The 8-to-5 buying advantage with only 2 holding steady means nearly every tracked fund is actively adjusting its PANW position — and the majority are adding.

Who's Buying Palo Alto Networks?

The buying side is broad, deep, and well-funded, spanning multiple investment styles and approaches.

Appaloosa Management holds a $420.2 million increased position — David Tepper's largest cybersecurity bet and a strong statement of confidence in PANW's competitive positioning. Baker Bros built an even larger $409 million stake, making PANW a top holding for the fund known for identifying dominant technology platforms.

Fidelity increased its substantial $1.3 billion holding, while T. Rowe Price grew its $3.2 billion position. These active fundamental managers adding alongside passive giants signals multi-dimensional institutional support.

Renaissance Technologies increased to $148.3 million, adding the world's premier quant fund to the bull column. D.E. Shaw built its position to $28.2 million, providing additional quantitative validation.

Vanguard grew its massive $11.1 billion holding, and State Street increased its $5 billion position. When both top passive managers and elite active funds buy simultaneously, the institutional demand is comprehensive.

Who's Selling Palo Alto Networks?

The selling side includes some heavyweight names making meaningful reductions.

JPMorgan decreased its $1.9 billion position — the largest sell by dollar amount. As one of the top three holders, JPMorgan's reduction is notable, though the remaining $1.9 billion stake shows continued commitment to the name.

Citadel trimmed its $533.2 million position, making it the largest active hedge fund selling. Ken Griffin's fund reducing a half-billion-dollar position warrants attention, though the remaining stake is still substantial.

Millennium Management cut to $12.2 million, and Two Sigma reduced its small $1.1 million position. These are relatively minor adjustments.

Most significantly, Bridgewater Associates sold its entire position — a complete exit from Palo Alto Networks. Ray Dalio's macro-focused fund abandoning PANW entirely suggests their economic models no longer favor the stock's risk-reward profile.

Notable Moves

Bridgewater's complete exit is the most bearish signal in the data. The macro fund's departure suggests their analysis of cybersecurity spending trends, interest rate impacts on growth valuations, or competitive dynamics led them to conclude PANW no longer fits their portfolio. However, it's worth noting that Bridgewater approaches investments from a macroeconomic perspective — their exit may reflect portfolio-level macro adjustments rather than company-specific concerns.

The Appaloosa-Baker Bros alignment is striking. Two of the most respected fundamental hedge funds independently built positions exceeding $400 million each. This kind of parallel conviction — $420.2 million from Appaloosa and $409 million from Baker Bros — suggests both funds' deep research processes identified similar value in PANW.

Renaissance's $148.3 million increase adds quantitative weight to the fundamental bull case. When both fundamental (Appaloosa, Baker Bros) and quantitative (Renaissance, D.E. Shaw) approaches converge, the signal is particularly strong.

JPMorgan and Citadel reducing while maintaining large positions suggests tactical rebalancing rather than fundamental bearishness. Both funds still hold hundreds of millions or billions in PANW — these are trims, not exits.

What This Signals

The institutional landscape for Palo Alto Networks is firmly bullish, with the 8-to-5 buying advantage supported by significant dollar amounts and diverse investment approaches.

Key factors driving institutional accumulation:

1. Platformization strategy — Palo Alto Networks' shift toward integrated platform-based security solutions is resonating with enterprises looking to consolidate their security vendors. The company's platformization approach drives higher average contract values and stronger customer retention.

2. Network security leadership — As enterprise networks become increasingly complex — spanning cloud, hybrid, and edge environments — Palo Alto's comprehensive network security capabilities become more valuable. The company's next-generation firewall remains the industry benchmark.

3. AI-driven security operations — PANW's integration of AI into its security operations center (SOC) capabilities positions the company to capture growing demand for automated threat detection and response. Cortex XSIAM represents a significant expansion opportunity.

4. Recurring revenue growth — The company's transition to a subscription-based model has improved revenue predictability and customer lifetime value. Annual recurring revenue (ARR) continues to grow at impressive rates.

5. Strategic M&A — Palo Alto's disciplined acquisition strategy has added key capabilities in cloud security, identity, and AI, strengthening the platform without diluting financial performance.

The bear case — reflected in Bridgewater's exit and JPMorgan's trim — centers on valuation, competition from CrowdStrike and others, and potential for cybersecurity spending moderation. Citadel's reduction may also reflect concerns about market saturation in some security segments.

On balance, the weight of institutional opinion strongly favors PANW. Eight funds buying — including two with $400+ million positions — against five sellers with only one complete exit makes Palo Alto Networks one of the most institutionally supported cybersecurity names in the market.

PANW vs. CRWD: The Institutional Cybersecurity Debate

Palo Alto Networks and CrowdStrike represent the two dominant cybersecurity plays in institutional portfolios, and this quarter's 13F data shows both names attracting strong buying interest. PANW's 8-to-5 ratio and CRWD's 5-to-3 ratio both lean bullish, suggesting institutions see cybersecurity as a sector where multiple winners can thrive.

The interesting nuance is in which funds prefer which name. Some funds — like Baker Bros and Appaloosa — are buying both, indicating a sector-wide bullish thesis. Others are more selective in their cybersecurity exposure. This dual accumulation pattern reinforces the structural growth narrative for cybersecurity spending overall.

For investors choosing between the two, the institutional data suggests PANW has broader buying support (8 funds) but also more selling pressure (5 funds vs. CRWD's 3). CRWD has a cleaner institutional profile with no exits, while PANW has one complete exit from Bridgewater. Both names, however, enjoy strong net institutional demand — making cybersecurity one of the most favored sectors in this quarter's 13F filing cycle.

Track Palo Alto Networks Institutional Activity

Track PANW institutional moves in real-time with Freenance Smart Money — we track 35 funds with $21.4T total AUM across 77,111 positions. See who's buying and selling at app.freenance.io/smart-money/ticker/PANW.

Related Articles

• Who Is Buying NVIDIA? Hedge Fund Activity in 2026
• Who Is Buying Apple? Hedge Fund Activity in 2026
• Who Is Buying Tesla? Hedge Fund Activity in 2026

FAQ

Why is institutional money flowing into Palo Alto Networks?

The core thesis is platform consolidation — enterprises are collapsing point-solution security vendors into integrated platforms covering network, cloud and SOC. PANW's three-platform strategy (Strata, Prisma, Cortex) plus a SASE-led shift to subscription revenue is exactly what fundamental funds like Appaloosa and Baker Bros are underwriting with $400M+ positions each.

What is "platformization" and why does it matter for PANW?

Platformization is Palo Alto's strategy of bundling its security products so customers commit to the full stack rather than buying piecemeal. It lifts average deal size, lengthens contracts and improves net retention, which is why ARR growth has become the metric institutional analysts track most closely.

Why did Bridgewater exit Palo Alto Networks entirely?

Bridgewater is a macro and risk-parity fund, so a full exit usually reflects portfolio-level allocation calls — interest rate sensitivity, growth-versus-value tilt, or factor exposure — rather than a specific bearish view on cybersecurity. The remaining 8-to-5 buy/sell tilt with active managers still adding suggests the company-specific thesis remains intact.

How does PANW compare to CrowdStrike in 13F filings?

Both names show net buying this quarter (PANW 8:5, CRWD 5:3), and several funds like Baker Bros and Appaloosa own both — a sign that institutions see cybersecurity as a multi-winner sector rather than a zero-sum race. PANW gets more total flow because of its larger market cap and broader product surface, while CRWD draws growth-focused funds for its endpoint and XDR leadership.

Where can I see real-time PANW hedge fund moves?

Freenance Smart Money tracks 13F filings from major funds and lets you filter by ticker, fund and quarter-over-quarter change. For PANW specifically you can see Appaloosa, Baker Bros, Vanguard and the rest side-by-side, which is more actionable than reading individual 13F PDFs from EDGAR.