GetCoattail Research — The Filing Tape #177. Fortinet through six filing lenses, as of the latest filings. Past patterns are not a promise of future results. For education only — not investment advice.
The Hype
Fortinet had a Friday. The network-security stock closed October 23, 2026 at $179.99, up $7.01 — +4.05% — on what Zacks' quote page shows as heavy visitor interest; the same page carries a Zacks Rank #2 (Buy) and notes Fortinet reports third-quarter 2026 results on October 28 (Zacks FTNT quote page, delayed Nasdaq data, updated October 23, 2026 04:00 PM ET). A Nasdaq-republished Zacks note puts it plainly: "Fortinet (FTNT) is one of the stocks most watched by Zacks.com visitors lately" (source).
The Friday move rode a sector-wide bid. Cybersecurity names were among the week's standout winners: CrowdStrike gained 13.27% on the week (8.25% on Friday alone), Palo Alto Networks 11.27%, and on Friday Datadog rose 4.62% and Fortinet 4.05% — "sizable advances on a day when the broader indices struggled" (investinglive.com, October 23, 2026).
The longer tape is a rocket: Fortinet closed 2026's first trading day at $77.88 and sits at $179.99 — +131.1% year to date — about 8.7% below its 52-week high of $197.13. The Sunnyvale, California company sells network-security appliances and Unified Threat Management solutions — the FortiGate product line and FortiGuard subscription services — to enterprises, service providers, and governments (Zacks Analyst Blog). The question the filings let us ask: while the security trade was doubling the stock, who in the smart-money record was actually holding it — and who was selling?
The Tape
| Lens | As of | What the filings show | Direction vs prior period |
|---|---|---|---|
| Superinvestors (13F) | Jun 30, 2026 | 2 of 147 tracked managers hold; 3,643,927 shares ($559.8M reported). Fundsmith is 99.6% of the cohort and cut 41.0% in Q2. | Cohort −40.9% (verified, 2 continuing) |
| All institutions (13F) | Jun 30, 2026 | 1,575 filers hold 498,438,269 shares ($76.5B reported). | Shares +4.55%; filers +264 |
| Insiders (Form 4) | Oct 2, 2026 | 0 open-market buys in a year; 58 sells, $136.2M, all officers. Only 2 buys in the 21-month record. | Selling continued; buying absent |
| Congress | Oct 3, 2026 | Two House members reported 1 sell each (Apr 14 and Jul 10, 2026). No buys. | Selling only |
| 13D/G | Apr 29, 2026 | Passive only. Vanguard Group's 10.23% 13G was amended to 0.0% in March 2026. | Largest passive reporter exited |
| Short interest | Sep 15, 2026 | 13,718,909 shares short, 1.87% of shares outstanding; −41.8% from the Dec 2025 peak. | Shrinking fast |
Chart: FTNT through six filing lenses — who is actually there?
Superinvestors. The June-quarter register shows just 2 of the 147 tracked managers holding Fortinet common stock — 3,643,927 shares, $559.8M at reported values, about 0.73% of all institutionally reported FTNT shares. And the register is effectively one name: Terry Smith's Fundsmith holds 3,629,938 shares — 99.6% of the tracked stake, a 4.09% portfolio weight. The other holder, Flossbach von Storch, holds 13,989 shares, unchanged.
The move that matters is Fundsmith's: it cut its Fortinet position 41.0% in Q2 (from 6,156,675 to 3,629,938 shares), in the quarter the stock rose 88.0% ($81.72 → $153.62). The verified continuing cohort — both managers, paired by accession identity and CUSIP overlap with every change label recomputed exactly — fell from 6,170,664 to 3,643,927 shares, −40.9%. There were no new tracked positions in Q2 and one exit: Saturna Capital's 13,423 shares. The implied cohort price of $153.62 matches the June 30 close exactly, so the share arithmetic is clean. One September early filer sits outside the June cohort: Sarasin & Partners cut its FTNT stake 41.7% (from 50,901 to 29,650 shares) in the September quarter.
Chart: FTNT short interest — 137 FINRA settlements, January 2021 to September 2026.
All institutions. The full 13F market moved the other way: filers grew by 264 to 1,575, and reported shares rose 4.55% (+21,677,679 shares to 498,438,269) even as the tracked superinvestor cohort cut 40.9%. Reported value roughly doubled to $76.5B — a mix of the higher share count and the quarter's 88% price move. The superinvestor cut happened against a broadening institutional bid, not with it.
Insiders. The Form 4 record is one-sided. Across 143 parsed filings for Fortinet's CIK (record span January 2, 2025 through October 1, 2026; aggregated as of October 2, 2026), there are zero open-market purchases in the last year — 0 buy transactions in both the 90-day and 1-year windows. The entire 21-month record contains exactly two open-market buys, both by the same person: director William H. Neukom bought 663 shares for $69,789.90 in two 2025 transactions (March and June), before the 1-year window. No officer has bought a share in the full record. Against that: 58 sell transactions in the last year covering 1,224,200 shares and $136.2M, from 4 distinct sellers, all officers — led by Ken Xie (1,276,143 shares / $139.7M across the full record) and Michael Xie (1,163,084 shares / $108.9M). In the last 90 days: 15 sells, 221,738 shares, $36.2M, at an average $163.42 — inside the window's $149.98–$180.95 price range. The parsed-file scan matches the aggregate buckets on every transaction count and value, and the site's insider aggregate matches the 90-day window — this is not a coverage artifact.
Congress. Two House members reported Fortinet sales in 2026 (transactions on or after April 1): Gilbert Cisneros (D), one sale on April 14, 2026 ($1,001–$15,000), and Dan Newhouse (R), one sale on July 10, 2026 ($1,001–$15,000). No member of either chamber reported a Fortinet purchase in the window.
13D/G. The control register is passive-only: four filings, all Schedule 13G, no activist 13D. The notable event is an exit — The Vanguard Group's 10.23% position (76,144,454 shares, event November 28, 2025) was amended on March 26, 2026 to 0 shares and 0.0%, i.e., below the reporting threshold. Separately, Vanguard Capital Management reported 6.21% (45,987,681 shares) in an initial 13G on April 29, 2026.
Short interest. The bear case has been unwinding for nine months. FINRA short interest peaked at 23,558,764 shares on December 15, 2025 and has fallen in nearly every settlement since, reaching 13,718,909 at the September 15, 2026 settlement — −41.8% from the peak, −29.4% from a year ago, and just 1.87% of the 733,713,653 shares outstanding, with 3.53 days to cover. The stock more than doubled while the short book halved. One plausible reading is that short covering did not drive this rally; what the data do show is that, at 1.87% of shares outstanding, there is little short interest left to squeeze.
Fundamentals context. FY2025 revenue was $6,799.6M with $1,853.4M net income and $10,389.2M in assets. The Q2 price move (+88.0%) dwarfed the full market's 4.55% share add — most of the quarter's institutional "buying" in value terms was the price move itself, not new shares.
The Gap
The security-trade story and the filing tape point in opposite directions on exactly one question: who is confirming the rally. The full institutional market did add shares in Q2 (+4.55%, +264 filers) and the short book kept shrinking — the tape agrees the institutional bid is real. But the concentrated smart-money record went the other way: Fundsmith, 99.6% of the tracked stake, sold more than two-fifths of its position into the quarter's 88% rise, and the only other tracked holder sat still. No tracked manager opened a new Fortinet position in Q2, and Saturna exited entirely.
The insider tape is starker still. Officers and directors sold $136.2M of stock in the last year — the two Xie sellers alone account for about $248.6M across the full record — while recording zero open-market purchases in a year and only a director's 663-share, $69,790 pair of 2025 buys in the entire 21-month parsed history. Two members of Congress sold; none bought. The largest passive reporter on the 13D/G register, Vanguard Group, took its 10.23% stake to zero in March.
One plausible reading is that the single concentrated holder was taking profits into an 88% quarterly rally while the broader institutional market kept adding — the tracked cohort's judgment and the full market's judgment pointed in opposite directions in Q2. The 45-day 13F lag cuts both ways: the June picture is the latest complete one, and the September early filer (Sarasin cutting 41.7%) suggests the cohort's retreat continued into Q3. What the filings do not show is any insider, congressmember, or tracked manager stepping in to buy the security trade at these prices.
What Would Change the Picture
Nothing above is a recommendation. It is a record. What would change it:
- 1. An insider open-market purchase. Any Form 4 buy code "P" — especially an officer buy — would end a year-long drought and show up on FTNT's insider page within days of filing.
- 2. Q3 13F season (filings due by November 16, 2026). Watch whether Fundsmith's 41.0% Q2 cut was profit-taking or the start of an exit, whether Sarasin's 41.7% September cut continued, and whether any tracked manager opens a new Fortinet position.
- 3. A new 13D or 13G. Any activist 13D, or a fresh 13G above 5% replacing Vanguard Group's exited 10.23%, would reset the control-register picture.
- 4. Short-interest re-acceleration. Two consecutive settlements of rising short interest after the −41.8% unwind would signal the bear trade is re-engaging — or a crowded long is forming.
- 5. October 28 earnings. The Q3 report is the next scheduled fundamental catalyst; the filings above describe positioning into it, not a prediction of it.
This article describes filings and market data for education. It is not investment advice. Data: SEC EDGAR 13F (as of June 30, 2026, filed within 45 days), Form 4 parsed filings span January 2, 2025 – October 1, 2026 (aggregated as of October 2, 2026), House/Senate disclosures through October 3, 2026, FINRA short interest at September 15, 2026 settlement. 13F covers long positions of $100M+ managers only and is always a lagging picture. Trading costs and taxes are not reflected.
Related research: Two of 83: One Holder Is 99.4% of the Superinvestors' Palo Alto Networks Stake. Its Insiders Have Bought Twice. · One of 83: The Superinvestors Cut Zscaler 90.6% in One Quarter. Its Insiders Have Never Bought a Share. · Track the tape on FTNT's stock page and the 13F filing season hub.
Revision history: v1.0 — October 24, 2026. Initial publication. Signals and lens aggregates: ftnt_lens_data.csv. Short-interest series: ftnt_short_interest_series.csv.
Past patterns are not a promise of future results. For education only — not investment advice.