# Jonathan Baker

Jonathan Baker works on cybersecurity, focusing on threat-informed defense and continuous threat exposure management (CTEM). Baker's LinkedIn posts describe speaking and workshops on applying these approaches to prioritize exposures and improve security operations.

- Profile: https://b2binfluencer.marketing/creators/jonathan-baker/
- LinkedIn: https://www.linkedin.com/in/jonathanobaker
- Topics: artificial-intelligence, cybersecurity, ai-security
- Based on 11 dated posts, latest 2026-09-22

## Summary

Jonathan Baker is most useful for educational sessions on prioritizing exposures and threat-informed defense with CTEM and MITRE frameworks.

- Best for: Cybersecurity vendors planning educational sessions for security leaders on exposure prioritization and threat-informed defense.
- Not for: Consumer security brands seeking paid social reach, lifestyle content, or product testimonials.
- Check first: Confirm scope, availability, terms, rates, deliverables, and inquiry route before assuming endorsement.

### Takeaways

- Separate weaknesses can combine into an attacker's route to a critical asset.
- A backlog of findings is not the same as a map of risk.
- Baker calls the accumulated opportunity from combined weaknesses threat debt.

## Main ideas

- **Prioritize the attack paths that matter**: Baker argues that findings become dangerous when they combine into a route to a critical asset. Rather than treating every backlog item as equally urgent, they recommend starting with adversaries relevant to an organization’s industry, geography and technology, then using that context to decide which assets and weaknesses deserve attention first.
- **Validate defences against relevant threats**: For Baker, threat-informed security means testing controls against techniques used by relevant adversaries rather than relying on generic scenarios. In a four-part preparation list, they also call for inventorying AI-related assets—such as agents, automation frameworks, MCP servers and third-party integrations—and applying the same control-validation discipline used for other critical assets.
- **Keep detection and response current**: Baker says alert triage, SIEM correlation and containment processes were built for threats moving at human speed. They propose continuously validating detection logic and tuning it as attacker techniques change, so security operations can keep pace.
- **Teach the operating model, not just the concepts**: Baker’s posts offer practical guidance for security leaders and practitioners on organizing a threat-informed CTEM program, assessing maturity, assigning roles and addressing adoption barriers. They present the workshop as facilitated learning rather than a product pitch.

## Work to read

- [“Patch faster” is not the answer to Claude Mythos](https://www.linkedin.com/posts/jonathanobaker_the-vulnerability-management-race-is-over-activity-7451608046847299584-oL2z)
- [The findings in your backlog aren’t dangerous on their own](https://www.linkedin.com/posts/jonathanobaker_the-findings-in-your-backlog-arent-dangerous-activity-7456673921271066624-VOrp)
- [Speaking at the 38th Annual FIRST Conference](https://www.linkedin.com/posts/jonathanobaker_firstcon-threatinformeddefense-ctem-activity-7460309738258411520-O_xb)
- [CTEM + MITRE INFORM workshop in Dallas](https://www.linkedin.com/posts/jonathanobaker_join-us-peter-luban-and-i-are-headed-activity-7492621561468747778-GQP8)
- [Welcoming David Mihelcic to the AttackIQ team](https://www.linkedin.com/posts/jonathanobaker_the-people-you-build-with-matter-more-than-activity-7508244158512300032-N5bB)

## Brand relationships

- **AttackIQ** (employment)
- **MITRE** (mention)
- **FIRST** (mention)

## Partnerships

Jonathan Baker's posts do not say whether they offer partnership, sponsorship, or paid collaboration formats. Across five posts published between April and September 2026, they cover speaking and workshop delivery, blog promotion, and team announcements rather than brand partnerships. They posted about presenting a session titled "Threat-INFORM to Optimize Security Operations" at the 38th Annual FIRST Conference; hosting a CTEM + MITRE INFORM workshop in Dallas with Peter Luban, described as a facilitated leadership workshop rather than a product pitch; a webinar planned with Peter Luban on threat debt; and a blog series on threat debt and threat-informed defense. They also announced David Mihelcic joining the AttackIQ team, referencing "our customers' missions" and "our AI footprint." Those references show a company affiliation in their own words, but no post sets out sponsorship terms, pricing, formats, deliverables, or a route for brands to inquire. Buyers should confirm directly whether they accept sponsorships and, if so, what they charge, produce, and how to get in touch.

## Alternatives

- Makarand Karanjalkar: Choose Karanjalkar when the session or advisory engagement focuses specifically on behavioral threat intelligence: representing adversary behavior, distinguishing it from anomaly detection, and connecting CTI standards to detection and threat hunting. The two posts argue that behavior analytics often stops at “something unusual happened,” while behavioral threat intelligence explains the adversarial objective, attack stage, and likely next move. One post also explains how the OCA Indicators of Behaviour project uses STIX 2.1 to make behavioral observations shareable across tools. This is a better fit than Baker if the audience’s main gap is behavioral CTI vocabulary and detection context rather than CTEM program design.
- Peter LaMantia: Choose LaMantia when the session focuses on external DNS exposure and attack surface governance. The posts describe recurring DNS assessment findings—legacy records, third-party dependencies with unclear ownership, incomplete SPF/DMARC coverage, and externally visible assets outside governance—and frame the core risk as an ownership gap rather than a single misconfiguration. LaMantia is a better fit than Baker for security leaders who need to govern domains, subdomains, DNS records, and externally exposed assets end to end.

---
AI-assisted summary of public posts. Audience demographics are not available. Engagement appears only where we checked recent posts. Method: https://b2binfluencer.marketing/methodology/