When an executive buys their own shares

By Kike Gandia · Research · 17 min read

Every time a director, an officer or a major shareholder of a US-listed company buys shares in their own company, they have two business days to disclose it publicly. It's mandatory, it's legal and it goes on file. It's called a Form 4 filing, and it's submitted to the Securities and Exchange Commission.

We measured 17,746 of those purchases between January 2024 and March 2026, and tracked what the stock did over the following 60 trading sessions relative to the market.

What comes out has two phases, and the first is the one that almost never gets told.

Before the purchase, the stock falls. In the 20 sessions before the trade, the stock loses an average of 4.41% relative to the market. These purchases don't chase a rally: they come after a decline.

After the purchase, it rebounds. Over the next 20 sessions it gains 3.17% over the market, and 6.01% at 60 sessions.

Now for the part that decides whether that means anything. We repeated the exact same exercise on the same stocks on randomly chosen dates. That control group rises too: +0.89% at 20 sessions. In other words, part of the effect doesn't come from the purchase; it comes from what kind of companies these are.

Net of the control, what remains is an effect of +2.28 percentage points at 20 sessions (t = 13.7), and a probability of beating the market of 57.2% versus 50.2% for chance.

It's a real effect, measured on the regulator's public data, and it's roughly half of what you'd conclude if you skipped the control.

The control group isn't methodological decoration. It's what separates a finding from a well-written impression.

Where the data comes from

Section 16(a) of the Securities Exchange Act requires directors, officers and shareholders holding more than 10% of a US-listed company to report their transactions in their own company's stock. Since the Sarbanes-Oxley Act of 2002, the deadline has been two business days. The filings are published in full on EDGAR, the SEC's public archive.

Each filing identifies the company, the person, their relationship to the company, the transaction date, the number of shares, the price and a transaction code. Only code P is used here, which designates an open-market purchase with the person's own money.

The source of the data, in two parts. First, the chain from the private event to the public record: day 0, the transaction (a director, an officer or a shareholder holding more than 10% of the company buys shares in their own company with their own money); within two business days or less, the reporting obligation imposed by Section 16(a) of the Securities Exchange Act, with that deadline set by the Sarbanes-Oxley Act of 2002; the Form 4 filed with the SEC, with company, person, relationship, date, number of shares, price and transaction code; and its publication in full on EDGAR, the SEC's public archive. Second, the breakdown of transaction codes: code P, an open-market purchase with one's own money, is the only one included in the analysis; excluded are code A, a grant of shares as compensation, code M, an option exercise, code F, shares withheld to pay taxes, and code C, conversion of a derivative instrument. The list is not exhaustive. Of the 3.98 million filings in the archive, a single code designates a voluntary purchase.

Excluded are share grants as compensation, option exercises, tax withholdings and conversions: these are transactions where the person chooses neither the timing nor the price.

That detail matters. Of the 3.98 million filings in the archive, most are not investment decisions. Only the voluntary purchase is.

The integrity check and what was measured

Before analyzing anything, we checked that the dates are real. Across the set of purchases, the median lag between the transaction date and the filing date is exactly 2 days, the deadline set by law. That isn't something you'd get by chance: it's the signature of an archive that reflects the real timeline of events, not a system load date.

Report corpus and integrity checks. Funnel: 67,747 open-market purchase lines reported under code P between January 2024 and March 2026; 27,489 events after grouping by company and date, because a joint filing is a single decision; 17,746 events with a complete price window, measurable from minus 20 to plus 60 sessions. Price universe: 4,755 stocks and 699 sessions, with daily closes from December 2023 to September 2026, over a 27-month trading window. Timing integrity check: the median lag between the transaction date and the filing date is 2 days, exactly the deadline set by the Sarbanes-Oxley Act since 2002. Other checks: the company, date and number-of-shares fields are 100% populated; the price field, 99.3%; there is a unique identifier per record, with no ingestion duplicates; and the only transaction code present is P, voluntary purchase.

Of the 27,489 events, 17,746 have enough price history to measure from −20 to +60 sessions. The rest correspond to stocks outside the covered price universe.

The same transaction can appear on several lines when the filing is joint (for example, a fund and its managing partners filing at the same time). That's normal SEC structure, not duplication, but it would count the same decision several times, so all lines for the same company on the same date are grouped into a single event.

What it's compared against

The benchmark is the median of the daily returns of the 4,755 stocks in the universe: an equal-weighted market built from the same data. The median is used rather than the mean so that a handful of extreme stocks don't move the yardstick.

The control group is what turns this into a measurement rather than an impression. For each company with a reported purchase, we take that same company on a randomly chosen date within the period and measure exactly the same thing. That gives 17,001 control observations.

If the stocks insiders buy simply tend to rise (because of size, sector or market timing), the control will pick that up. What survives once the control is subtracted is attributable to the timing of the purchase, not to the kind of company.

Spoiler: the control rises. Quite a bit.

The two phases

This is the full measurement: where the stock was 20 sessions before the purchase, where it was on the day of the purchase and where it was 60 sessions later, always net of what the market did.

Cumulative return relative to the market, in percentage points, from session minus 20 taken as zero. Series with a reported purchase, 17,746 events: minus 4.52% at session minus 1, its low; minus 4.41% on the day of the purchase; minus 3.74% at session plus 1; minus 3.01% at plus 2; minus 2.42% at plus 3; minus 2.13% at plus 5; minus 1.66% at plus 10; minus 1.24% at plus 20; plus 0.08% at plus 40; and plus 1.60% at plus 60. Control group, 17,001 observations on the same stocks on random dates: minus 1.07% at session minus 1; minus 1.16% on the day of the purchase; minus 1.15% at plus 1; minus 1.08% at plus 2; minus 1.06% at plus 3; minus 0.88% at plus 5; minus 0.69% at plus 10; minus 0.27% at plus 20; plus 0.78% at plus 40; and plus 1.91% at plus 60. The stock falls 4.41% over the previous 20 sessions versus 1.16% for the control, a gap of 3.4 points on the eve of the purchase; it recovers 2.1 points in the first three sessions while the control moves a tenth of a point; and it gains 6.01% at 60 sessions from the day of the purchase versus 3.07% for the control.

It's the shape that matters.

The prior decline. The line falls throughout the period before and bottoms out right on the eve of the trade: −4.52% relative to the market at session −1. The control also falls, but much less: −1.07%. The gap, 3.4 points, tells us these purchases aren't spread randomly over time: they cluster after the stock has underperformed the market.

The turn. The low is at session −1, and from there the line rises. In the first three sessions it recovers 2.1 points. Over the same stretch, the control moves a tenth of a point.

The gap holds. At 60 sessions, the purchase series has accumulated +1.60% since the start of the window and the control +1.91%; but measured from the day of the trade (which is what matters to someone reading the filing when it's published), the former gains 6.01% and the control 3.07%.

Put another way: the turn happens at exactly the point of purchase, not before it and not vaguely afterward. A series rising because of the company's characteristics would have no reason to change slope right there.

How long the edge lasts

The practical question isn't whether the effect exists, but when it appears, how much it's worth and how long it holds.

Average return relative to the market from the day of the purchase, by horizon, with the control group's return, the net edge, the t-statistic and the share of cases that beat the market. At 1 session: with purchase plus 0.67%, control plus 0.01%, net edge plus 0.67 points, t equals 16.0, beats the market 56.1% of the time. At 2 sessions: plus 1.40%, plus 0.08%, plus 1.32 points, t 21.8, 60.2%. At 3 sessions: plus 1.99%, plus 0.10%, plus 1.89 points, t 26.8, 62.1%. At 5 sessions: plus 2.28%, plus 0.28%, plus 2.00 points, t 22.0, 61.0%. At 10 sessions: plus 2.75%, plus 0.47%, plus 2.27 points, t 19.1, 60.1%. At 20 sessions: plus 3.17%, plus 0.89%, plus 2.28 points, t 13.7, 57.2%. At 40 sessions: plus 4.49%, plus 1.94%, plus 2.55 points, t 10.7, 56.7%. At 60 sessions: plus 6.01%, plus 3.07%, plus 2.94 points, t 9.8, 57.1%. The control's hit rate is 48.3% at one session and 50.2% at twenty, indistinguishable from a coin toss.

Three things can be read straight off it.

The adjustment is fast. The net edge reaches +1.89 points in just three sessions, and that's where it is statistically strongest (t = 26.8) and has its highest hit rate (62.1%). Two-thirds of the total 60-session effect is already in within the first week.

Then it stalls. Between sessions 5 and 20 the edge moves between 2.00 and 2.28 points: practically flat. The subsequent drift up to 2.94 points at 60 sessions is slow, with a t falling from 26.8 to 9.8.

The control behaves as it should. Its hit rate is 48.3% at one session and 50.2% at twenty: indistinguishable from a coin toss, which is exactly what you'd expect from randomly chosen dates. That validates how the comparison was built.

It's not the tail, it's the floor

An average can be dominated by a few extraordinary cases. If the effect came from twenty spectacular wins among seventeen thousand trades, it wouldn't amount to much. So we looked at the entire distribution.

The result is the opposite of what you'd expect. The biggest difference between the two distributions isn't in the gains; it's in the losses.

Percentage of cases falling into each bracket of return relative to the market at 20 sessions, comparing events with a reported purchase against the control group. Worse than minus 30%: 0.96% with a purchase versus 1.94% in the control, half. From minus 30% to minus 20%: 2.11% versus 3.22%, a difference of 1.11 points. From minus 20% to minus 15%: 2.54% versus 3.92%, minus 1.38 points. From minus 15% to minus 10%: 4.79% versus 7.01%, minus 2.22 points, the largest difference in the table. From plus 5% to plus 10%: 14.03% versus 12.26%, plus 1.77 points. From plus 20% to plus 30%: 4.41% versus 3.41%, plus 1.00 point. Better than plus 30%: 3.85% versus 3.16%, plus 0.69 points. The whole severe-loss range empties out consistently, while on the gains side the improvement is between one and two points per bracket.

The probability that the stock plunges more than 30% relative to the market over the next 20 sessions is half as high when there's a reported purchase. And the whole severe-loss range (from −10% down) empties out consistently.

On the gains side the improvement is there, but it's more modest: between one and two points per bracket.

This is a different finding from the one the easy headline suggests. What changes when an insider buys isn't so much the probability of a big win as the probability of a big disaster.

Not every buyer knows the same things

The filing requires the person to specify their relationship to the company: director, officer with executive duties, shareholder holding more than 10%, or several at once. It's a reported field, not an inferred one.

Net edge at 20 sessions over the control group by type of filer, with events, hit rate and t-statistic. Officer and director: 2,675 events, plus 3.33 points, beats the market 59.9% of the time, t equals 13.4. Officer only: 1,838 events, plus 3.19 points, 60.1%, t 11.1. Director only: 5,575 events, plus 2.31 points, 57.7%, t 16.6. Shareholder holding more than 10% who also holds a position: 2,769 events, plus 1.75 points, 53.7%, t 8.1. Shareholder holding more than 10% only: 4,592 events, plus 1.69 points, 56.4%, t 11.3. All five groups beat the control with statistical room to spare; what varies is by how much, and there's a factor of roughly two between the first and the last.

The ranking is consistent with each person's position inside the company.

Those who run the company day to day (officers, with or without a board seat) get the largest edge: around 3.2 to 3.3 points, and they're right 60% of the time. Those who only sit on the board drop to 2.31 points.

The group with the smallest edge is the shareholder holding more than 10% with no executive role: 1.69 points and a 56.4% hit rate. These are typically funds and institutional investors, who trade on portfolio criteria and not necessarily with operational knowledge of the business.

All five groups beat the control with statistical room to spare. What varies is by how much.

Large purchases say less

The intuition is that the more money someone puts in, the more convinced they are and the more informative the trade. The data doesn't back that up.

Return at 20 sessions relative to the market by purchase size bracket, with events, mean, median, hit rate and net edge. Under $10,000: 3,927 events, mean plus 1.99%, median plus 0.76%, beats the market 54.0% of the time, net edge plus 1.10 points. $10,000 to $50,000: 3,877 events, mean plus 3.78%, median plus 1.30%, 57.0%, plus 2.88 points. $50,000 to $250,000: 4,511 events, mean plus 3.66%, median plus 1.90%, 60.3%, plus 2.77 points. $250,000 to $1 million: 2,721 events, mean plus 3.19%, median plus 1.70%, 58.3%, plus 2.30 points. $1 million to $10 million: 2,066 events, mean plus 2.96%, median plus 1.51%, 57.2%, plus 2.06 points. Over $10 million: 644 events, mean plus 3.91%, median plus 0.50%, 51.9%, plus 3.02 points. The most informative bracket is $50,000 to $250,000, where the median and the hit rate peak. The over-$10-million bracket has the highest mean and the lowest median in the table, a gap of 3.41 points. By number of filers: purchases by a single filer, 12,050 events, return plus 2.26 net points; those by two or three, 3,892 events, plus 2.58 points; and those by four or more, 1,804 events, plus 1.75 points.

The most informative bracket is the middle one: between $50,000 and $250,000. That's where the median peaks (+1.90%) and so does the hit rate (60.3%).

The over-$10-million bracket is the interesting case. Its mean is the highest in the table, +3.91%, but its median sinks to +0.50% and it only beats the market in 51.9% of cases, barely two points above chance. That gap between mean and median means the result is propped up by a few very favorable cases, not by typical behavior.

There's a reasonable reading: a purchase worth tens of millions is rarely the personal bet of someone who knows what next quarter holds. It's usually a portfolio transaction, a stake increase or a structural move.

By number of filers the pattern is similar: purchases by a single filer (12,050 events) return +2.26 net points and those by two or three (3,892) +2.58, while those by four or more (1,804) drop to +1.75. Lots of people signing at once usually points to a coordinated corporate transaction, not five independent convictions.

The finding doesn't depend on the year

An effect that only shows up in one particular period is usually a property of that period, not of the phenomenon. We split the sample by year of the transaction and the result repeats.

Results split by year of the transaction, with events, mean, median, hit rate, net edge over the control and t-statistic. 2024: 8,000 events, mean plus 3.16%, median plus 1.45%, beats the market 58.3% of the time, net edge plus 2.27 points, t equals 19.6. 2025: 7,753 events, mean plus 3.03%, median plus 1.09%, 55.4%, plus 2.14 points, t 16.1. 2026 through March: 1,993 events, mean plus 3.76%, median plus 2.51%, 59.9%, plus 2.87 points, t 10.7. The net edge ranges between 2.14 and 2.87 points across three periods with different market conditions, a spread of 0.73 points. Robustness checks: mean trimmed at 1% and 99%, plus 2.71% versus plus 3.03% untrimmed; sign test on the hit rate, p equals 1.1 times 10 to the minus 41; Wilcoxon test on the median, p equals 2.1 times 10 to the minus 82; Welch test against the control, t equals 8.9 with p equals 5.5 times 10 to the minus 19; and Mann-Whitney against the control, p equals 1.1 times 10 to the minus 26. Only 12 of the 21,153 events measured were excluded for moves greater than 300%.

The net edge ranges between 2.14 and 2.87 points across three periods with different market conditions, and the hit rate between 55.4% and 59.9%. No single year carries the result on its own.

The effect also survives the usual robustness checks: the mean trimmed at 1% and 99% comes in at +2.71% versus +3.03% untrimmed, the sign test gives p = 1.1 × 10⁻⁴¹, the Wilcoxon test p = 2.1 × 10⁻⁸², the Welch test against the control t = 8.9 with p = 5.5 × 10⁻¹⁹ and the Mann-Whitney test p = 1.1 × 10⁻²⁶.

Only 12 of the 21,153 events measured were excluded for moves greater than 300%, so the result doesn't depend on that exclusion.

What exactly this analysis says

It's worth being precise, because this is territory where it's easy to read more into the data than is there.

What the analysis establishes and what it doesn't. Breakdown of the 17,746 events measured at 20 sessions: 57.2% beat the market and 42.8% end up below it; of that 42.8%, 5.6% of the total lose more than 15% relative to the market. The control group's hit rate is 50.2% and the average net edge over the control is plus 2.28 points. What the data establishes: that the reported decision carries information, because a group of people with better knowledge of a company do better than chance when buying its shares; that the effect survives the control group, with plus 2.28 points and t equals 13.7 once the control is netted out; and that the structure repeats across three periods with different market conditions. What it doesn't establish: any wrongdoing, because all the transactions analyzed are legal and already reported to the regulator; knowledge of specific facts, because the data can't tell us why each person bought; anything about a specific person or company, because all the figures are category aggregates and within each one between 40% and 46% of trades lose relative to the market; or an investment recommendation, because the calculations don't include transaction costs, spreads or the lag of up to two days between the purchase and its publication. The scope is the United States, between January 2024 and March 2026, across 4,755 stocks.

All the transactions analyzed are legal and public. A director or an officer can buy shares in their company; the law requires them to report it within two business days and to observe blackout periods and their company's internal rules. This analysis works solely with transactions already reported to the regulator. It doesn't identify any wrongdoing or suggest there was any.

What's measured is the information content of a reported decision. That a group of people with better knowledge of a company do better than chance when buying its shares isn't a flaw in the system: it's largely what the transparency regime is designed to make visible. Section 16(a) exists precisely because lawmakers assume these transactions are informative.

No knowledge of specific facts is attributed. The data can't tell us why each person bought. The prior 4.41% decline is consistent with a simple, entirely ordinary reading: someone who knows the business from the inside thinks the market has punished their company too harshly and acts accordingly. That's a valuation call, not a leak.

There are no names. The analysis is aggregate. Every figure refers to categories (type of filer, size bracket, year) with thousands of observations each. No conclusion rests on a specific person or company, and none should be carried over to an individual case: within each category, between 40% and 46% of trades lose relative to the market.

It's not an investment recommendation. An average edge of 2.28 points at 20 sessions coexists with 42.8% of cases ending up below the market and 5.6% losing more than 15%. The calculations don't include transaction costs, spreads or the lag of up to two days between the purchase and its publication.

The time frame and geography are limited. Companies listed in the United States, transactions between January 2024 and March 2026, 4,755 stocks with daily prices available. Nothing is extrapolated to other markets or other periods.

How a report like this gets made

This article is a small sample of what 0data, our intelligence platform, does. The full report isn't written by hand: it's generated, and the human work lies in deciding which questions deserve an answer and checking that the answers hold up.

The five layers underneath

1. Continuous ingestion. Filings are downloaded from the regulator's public archive, with retries and gap tracking: if a window of the archive doesn't respond, that gets logged and isn't confused with "nothing was filed that day".
2. Normalization. Everything goes into a single schema: company, person identifier, reported relationship, transaction date, filing date, shares, price and code. Without this step nothing can be compared.
3. Filtering by meaning. The step that reduces 3.98 million filings to the ones that are investment decisions, and the 67,747 lines to 27,489 events. It's the layer that most determines the result and the one most reviewed by hand.
4. Cross-referencing and correlation. This is where each event is joined to its price series, the equal-weighted index is built and abnormal returns are calculated at each horizon. None of this is in the raw data: it emerges when you cross it with another source.
5. Benchmark model. The control group isn't decoration: it's what lets you say that of an apparent 3.17-point effect only 2.28 is attributable to the purchase, and turn "this looks like a lot" into "this is twice what the market does on its own".

Those five layers aren't a script written for this report: they're the platform's modules each doing their part, which is why the same work can be repeated on any other raw material without rebuilding anything.

Which module does what

• Radar detects. It monitors hundreds of sources in real time (open sources, the deep web, markets, its own sensors and your own systems) and alerts you the instant something changes. Here it was the regulator's archive; in your case it'll be whatever keeps you up at night.
• Fusion connects. It combines everything that comes in into a single live picture and surfaces what matters even when no single source would have raised the alarm. In this report it's the step that joins each filing to its price series: on their own, neither says anything.
• Copilot investigates. It spots on its own where information is missing and launches the investigation that's needed, within the budget and rules you set. It's what turns a one-off question into a repeatable measurement.
• Command decides. It turns the signal into an actionable decision, with a person always in charge and every step traced: fast enough to decide today and defensible enough to explain tomorrow to an auditor, a regulator or a judge.

Underneath, the engines do the work: Core distributes each task across the network of models, Views turns data into maps, graphs and projections (the nine charts in this article come from there), Studio builds whatever application is missing in days, and VaultChat puts all of it in the team's hands without a single piece of personal data leaving the building. They're all described, one by one, on the products page.

One of those engines has its own name on this blog: KOMPLIANCE, which assigns an owner, a deadline and verification to everything that's found, and whose agents read that context before deciding what to test in an audit. The same engine powers CyberPanorama, 0data's cybersecurity module, with more than six hundred sources cross-referenced in real time to keep a live threat model.

If you're interested in how this applies to a different corpus, in How a news story travels the same pipeline measures 124,802 press headlines with the same framework: a public source, a null model and stated limits. The raw material changes; the machinery is the same.

What repeats from one report to the next isn't the data. It's the method: ingestion, normalization, filtering, cross-referencing and a benchmark model to measure against.

What this is good for beyond an article

A report on SEC filings makes a good showcase because the data is public and verifiable, but the machinery's real value lies elsewhere.

• The control group as a method. The difference between 3.17 and 2.28 points is everything that separates a data point from a headline. Any measure on historical data (a campaign, an alert, a risk indicator) needs to know what would have happened without it, and almost none of them calculate it.
• Signals in regulatory archives. The same treatment applies to company registries, public tenders, official gazettes or sanctions: open, dated sources that almost nobody cross-references. It's work for Radar and Fusion, and you don't need the whole platform to get started.
• Counterparty monitoring and due diligence. Before signing with a supplier or closing a deal, what the public record says about who's behind it and what they've declared is information that's available and rarely exploited. It's part of our threat intelligence services.
• Anomalous pattern detection. A well-built reference distribution turns "this looks odd" into "this happens once in a hundred". That's the same mechanism we use to separate normal activity from activity that deserves a closer look.
• Reports a person writes today. If someone in your organization spends two days a month gathering, cross-referencing and writing up the same thing, that's exactly the work this pipeline does on its own, and the first thing we show in the demo.

Each piece works on its own from day one. You don't need to adopt the whole platform to answer a single question, and the fastest way to find out where to start is to see it applied to your sector.

And if what you want is to drill down from the aggregate to the specific case (which officer or which fund really got it right after buying), that's Cleverium: the public tool we've built on the same SEC filings, with the method explained before the ranking, for the same reason this article insists on the control group.

A report on your data

What you've just read covers twenty-seven months of filings with a regulator because it was the public corpus that was easiest to verify. The same machinery can be pointed at whatever you need: your sector, your competitors, your supply chain or the ecosystem where you want to spot a pattern before it becomes obvious.

The quick way to check is to book a 30-minute demo: you pick a day and time on the calendar, with no forms that nobody ever answers, and the session is about your sector and your case with real data, not a generic presentation. If it's not a fit, we'll be the ones to tell you.

And if you'd rather look around before talking to anyone, the products page walks through the four modules and the five engines one by one, with what each one solves.

Half an hour is enough to know whether the question on your mind is measurable, which is the part that saves the most time.

Related service

threat intelligence and OSINT services

Topics

#0data #OSINT #Threat-intelligence #Data-analysis #SEC #Open-sources

Keep reading

• Cleverium: Which Executives Really Get It Right When They Buy Their Own Shares
• How a news story travels: anatomy of fourteen days of press
• Anatomy of 0data: dissecting a data and AI platform that never leaves your house
• Report: Privacy for rent: what VPNs don’t want you to know - 0data
• Palantir Technologies: anatomy of a data empire

Request a report on your data