Jonathan Baker works on cybersecurity, focusing on threat-informed defense and continuous threat exposure management (CTEM). Baker's LinkedIn posts describe speaking and workshops on applying these approaches to prioritize exposures and improve security operations.
Jonathan Baker writes and speaks about threat-informed defense and continuous threat exposure management (CTEM): how security teams can prioritize exposures by whether attackers can use them to reach important assets.
In their posts, Baker connects that approach with MITRE ATT&CK, security operations, and testing defenses against relevant adversary techniques.
Follow their work for practical explanations of why a backlog of findings is not the same as a map of risk—and why breaking attack paths matters more than simply closing findings faster.
Baker makes exposure management concrete by tracing how separate weaknesses can combine into an attacker’s route to a critical asset.
Baker calls the accumulated opportunity created by those combinations “threat debt,” then points to ways teams can reduce it: prioritize assets in light of relevant adversaries, validate defenses against their techniques, account for AI-related systems, and improve detection and response.
Baker's posts also show them presenting these ideas in a conference session and a facilitated CTEM and MITRE INFORM workshop described as educational rather than a product pitch.
Baker's posts do not say whether they have signature books, shows, or earlier work; targeted identity research is needed before treating this as a complete account of what people may search for under Baker's name.
Baker argues that exposure management should focus on the paths attackers can use to reach important assets—not simply the number of vulnerabilities in a backlog.
Read more
They connect this threat-informed approach to practical security work: testing defences against relevant adversary techniques, including across an organization’s AI tools, and continually tuning detection as threats evolve. Their posts also describe workshops and conference sessions that teach leaders how to put these ideas into practice.
Prioritize the attack paths that matter
Baker argues that findings become dangerous when they combine into a route to a critical asset.
Read more
Rather than treating every backlog item as equally urgent, they recommend starting with adversaries relevant to an organization’s industry, geography and technology, then using that context to decide which assets and weaknesses deserve attention first.
In a post on threat debt, Baker describes how a vulnerability near a critical asset, a misconfigured endpoint control and stale detection can combine to let an adversary advance unseen. The goal, they say, is to break those paths—not merely process findings faster.
For Baker, threat-informed security means testing controls against techniques used by relevant adversaries rather than relying on generic scenarios.
Read more
In a four-part preparation list, they also call for inventorying AI-related assets—such as agents, automation frameworks, MCP servers and third-party integrations—and applying the same control-validation discipline used for other critical assets.
Baker’s response to the call to “patch faster” is to map critical assets against relevant adversaries, validate defences against their documented techniques, inventory AI exposure and improve detection engineering. They present these steps as a way to move from managing vulnerability lists to managing risk with evidence.
Baker says alert triage, SIEM correlation and containment processes were built for threats moving at human speed.
Read more
They propose continuously validating detection logic and tuning it as attacker techniques change, so security operations can keep pace.
In the same four-part post, Baker identifies detection engineering as the final step, linking ongoing validation and tuning to a response that can keep pace with AI-augmented attacks.
Baker’s posts offer practical guidance for security leaders and practitioners on organizing a threat-informed CTEM program, assessing maturity, assigning roles and addressing adoption barriers.
Read more
They present the workshop as facilitated learning rather than a product pitch.
Baker announced a CTEM and MITRE INFORM workshop with Peter Luban, promising guidance and leadership materials attendees could use. They also described a FIRST Conference session on combining threat-informed defense, MITRE ATT&CK and CTEM to prioritize exposures and improve security operations.
This is the clearest single statement of how Baker thinks about exposure management: not as a race to close findings, but as a question about which paths an adversary can actually walk.
Read more
A newcomer who reads only one post should read this one.
Baker opens by rejecting the obvious reaction to faster, AI-assisted attack tooling.
Their argument: the useful question is not how quickly a team patches, but which vulnerabilities create a viable route to the assets that matter, and whether the defences on those routes would hold.
They set out four concrete preparation steps: map critical assets against the adversaries relevant to your industry, geography and technology profile, so the asset list tells you what to fix first; validate defences against the specific techniques documented for those adversaries rather than generic scenarios; inventory AI exposure such as agents, automation frameworks, MCP servers and third-party integrations, which most programmes have no way to discover or test; and accelerate detection engineering, because triage, correlation and containment workflows were designed for threats moving at human speed.
They frame the shift as moving from managing a list of vulnerabilities to managing risk with evidence rather than assumptions, and link to a blog post.
For brands planning a campaign
For a cybersecurity vendor weighing Baker as a speaker or advisor, this post shows a practitioner who teaches prioritisation and validation rather than a product pitch. It supports an engagement built around risk-based exposure management, threat-informed testing, or AI-era detection tuning, and gives a ready-made structure for a talk or workshop.
This introduces Baker’s own framing, “threat debt”, in a short, self-contained explanation.
Read more
Readers who want to understand the vocabulary they use in workshops and talks should start here.
Baker argues that individual findings are not the danger; the danger appears when they line up.
Their examples include a vulnerability one step from a critical asset, a misconfigured endpoint detection tool that lets the next step run unseen, and a stale detection rule that means nothing fires when an attacker acts.
They call the accumulated opportunity those combinations create “threat debt” and say the way to reduce it is to break the paths they form rather than work through findings faster.
They describe cybersecurity as being at an inflection point where the pace of adversary discovery and exploitation has outrun the cycle most programmes were built to run, and announce a webinar with Peter Luban and a guest.
For brands planning a campaign
This co-presented, teaching-oriented format features a named collaborator, useful context for a vendor considering a joint webinar or panel. The “threat debt” framing gives a campaign a memorable hook that is Baker’s own rather than borrowed vendor language.
This post states Baker’s conference topic in one line and shows where they are invited to speak.
Read more
It answers what they are known for on stage.
Baker announces a session titled “Threat-INFORM to Optimize Security Operations” at the FIRST Conference, which they describe as a gathering for cybersecurity practitioners, incident response teams and security leaders.
They say the session covers how organisations can use threat-informed defence, MITRE ATT&CK and continuous threat exposure management together to prioritise exposures, measure maturity and continuously improve security operations.
They invite attendees to connect.
For brands planning a campaign
The post shows that Baker’s speaking sits inside the practitioner and incident-response community, and that the topic combines three named frameworks rather than one product. A vendor looking for a speaker on threat-informed defence or CTEM can point to this as an established conference topic.
This shows what Baker does with an audience beyond posting and makes clear that the format is teaching rather than selling.
Read more
Baker and Peter Luban invite people to a CTEM and MITRE INFORM workshop in Dallas.
Baker says plainly that it is not a product pitch but a facilitated workshop for cybersecurity leaders on standing up a threat-informed CTEM programme.
The stated learning outcomes are CTEM principles and lifecycle; applying INFORM to build threat-informed defence maturity; organisational readiness, roles and operating structures; and common adoption challenges and structural blockers.
Baker says participants leave with practical guidance and leadership materials they can act on immediately.
For brands planning a campaign
This post shows that Baker can carry a facilitated, non-sales session for senior security audiences. A vendor wanting an educational workshop or sponsored leadership session has a concrete precedent to build on, including the stated takeaway materials.
This is the one post that shows Baker building a team rather than explaining a concept, and it carries a concrete career fact about their hire.
Read more
Baker writes that the people you build with matter more than almost anything else and welcomes David Mihelcic to the team.
They note that Mihelcic spent 18 years at DISA, more than 12 of them as CTO, where he was the senior engineering authority behind one of the largest and most demanding IT and cybersecurity environments in the world.
They say Mihelcic now works on advancing customers’ missions.
For brands planning a campaign
This is secondary content for a campaign aimed at senior operational audiences, but it offers useful context: Baker is recruiting senior operational experience and positioning themself as someone who builds a security team.
For an advisory or speaker engagement, it supports credibility in operational security.
Ask about Baker’s technical background if that is important to the engagement.
Validating defenses against real attacker techniques2
Workshops and conference sessions2
Building security teams1
Threat-informed defense and CTEM
Baker's recurring argument is that security programs should decide what to fix by starting with the adversaries relevant to a specific industry, geography, and technology profile, then mapping critical assets and the paths that lead to them.
Read more
In the posts, threat-informed defense pairs with MITRE ATT&CK and CTEM (continuous threat exposure management) as the working method for prioritizing exposures, measuring program maturity, and improving security operations. A workshop announcement with Peter Luban describes a facilitated session covering CTEM principles and lifecycle, applying MITRE INFORM, and the organizational readiness, roles, and operating structures needed to adopt the approach.
Uses named frameworks (CTEM lifecycle, MITRE ATT&CK, INFORM) and structures posts as numbered action lists readers can execute.
For brands planning a campaign
A vendor can position Baker with audiences that already run a vulnerability or exposure management program but are stuck on prioritization. The pitch is the move from a ranked list of findings to evidence-based risk decisions, so pair them with product content on exposure management or attack-path analysis rather than general awareness material.
Baker frames threat debt as the adversary opportunity created when individually unremarkable findings line up: a vulnerability one step from a critical asset, a misconfigured EDR that lets the next step run unseen, or a stale detection that means nothing fires.
Read more
In this framing, reducing it means breaking the paths those combinations form rather than working through the backlog faster. They announced a webinar with Peter Luban and a guest to discuss threat debt and how they are putting it into practice.
For brands planning a campaign
Threat debt is Baker's own term, so a campaign can build around the concept rather than a product name—for example, a webinar or explainer series with them as the framing voice. Ask them to define the measure for a specific sector; the concept spans exposure management, detection, and endpoint messaging.
Validating defenses against real attacker techniques
A recurring point is that generic scenarios are not enough: validate controls against the tactics and techniques documented for the adversaries that actually target an organization, then surface the gaps that matter.
Read more
In a post on preparing for AI-enabled threats, Baker lays out four actions: map critical assets and the pathways that lead to them; validate defenses against real TTPs; inventory and assess AI exposure such as agents, automation frameworks, MCP servers, and third-party integrations; and accelerate detection engineering so alert triage, SIEM correlation, and containment keep pace with AI-augmented attackers.
Prescriptive lists that turn each point into an action and name the tools of the job directly (TTPs, SIEM, MCP servers).
For brands planning a campaign
Suited to technical audiences in detection engineering, security validation, and AI security. Content should carry operational specifics—such as which assets, which TTPs, and which detections fire—rather than abstract thought leadership.
Baker's posts promote teaching formats rather than product pitches.
Read more
One announces a facilitated CTEM + MITRE INFORM workshop with Peter Luban in Dallas for cybersecurity leaders, explicitly described as "not a product pitch," covering lifecycle, maturity, organizational readiness, roles, and operating structures, with leadership materials to take away. Another announces a session at the 38th Annual FIRST Conference titled "Threat-INFORM to Optimize Security Operations," on combining threat-informed defense, MITRE ATT&CK, and CTEM to prioritize exposures and improve security operations.
Facilitated workshop and conference session formats for practitioners and security leaders.
For brands planning a campaign
Baker can anchor a half-day workshop or field event and leave attendees with practical leadership materials, making them a fit for a vendor buying a conference slot or executive session rather than a demo presenter. Ask for the workshop agenda and any takeaway templates before committing.
A secondary theme in the posts is people and hiring.
Read more
Baker welcomes David Mihelcic, who spent 18 years at DISA, more than 12 as CTO, to the AttackIQ team, describing that experience as bringing senior engineering authority from one of the largest IT and cybersecurity environments to customer missions. They also write that the people you build with matter more than almost anything else.
For brands planning a campaign
Usable for employer-brand, talent, or public-sector-adjacent content. For a speaker or advisor brief centered on threat-informed defense, treat this as supporting evidence of leadership credibility rather than a main topic.
Jonathan Baker's posts tie them most clearly to AttackIQ, which they name in their own first-person account of the work they and colleagues are doing.
Read more
Two other organizations appear as contexts for their speaking and workshops — MITRE, whose ATT&CK and INFORM frameworks shape their session and workshop titles, and the FIRST Conference, where they announced a speaking slot.
AttackIQ
Employment
Jonathan Baker's own posts place them inside AttackIQ: they welcome David Mihelcic "to the AttackIQ team," refer to "our customers' missions," and describe how they and Peter Luban are "putting threat debt into practice at AttackIQ."
Read more
AttackIQ also appears as a hashtag on their CTEM and threat-informed defense posts. For a buyer assessing the relationship, ask for their title, start date and relationship terms.
MITRE's frameworks recur in Baker's speaking and training material: their FIRST Conference session, "Threat-INFORM to Optimize Security Operations," covers using "threat-informed defense, MITRE ATT&CK, and CTEM together," and the Dallas workshop they co-host is titled "CTEM + MITRE INFORM Workshop."
Baker announced they are speaking at the 38th Annual FIRST Conference, describing FIRST as "a unique gathering for cybersecurity practitioners, incident response teams, and security leaders" and naming their session on threat-informed defense and CTEM.
Start with Baker’s post on threat debt, which explains why a backlog of findings is less useful than the attack paths those findings create.
Read more
Then read the four-step post on threat-informed exposure management: map critical assets, test defenses against relevant adversary techniques, inventory AI-related exposure, and keep detection current. The workshop and conference announcements show how they present the same ideas to security leaders and practitioners.
Both write for cybersecurity readers about how to understand and use threat information, not just collect it.
Read more
Baker focuses on threat-informed defense, CTEM, and the attack paths that connect findings; Karanjalkar explains indicators of behavior and the gap between behavior analytics and behavioral threat intelligence.
Karanjalkar’s posts explain threat-intelligence standards and behavioral detection. Baker’s offer structured action lists for exposure prioritization, control validation, and security-program operations.
Both address cybersecurity exposure that organizations struggle to see and govern.
Read more
Baker frames exposure management around adversary-relevant paths and validated controls; LaMantia focuses on external DNS exposure, ownership gaps, and attack-surface management.
LaMantia focuses on DNS governance, brand top-level domains, and externally visible assets. Baker covers a broader CTEM and detection-engineering agenda.
Jonathan Baker’s posts focus on threat-informed defense, CTEM, and cybersecurity operations, making their work relevant to vendors seeking a speaker or advisor on those subjects.
Read more
Before deciding whether their audience fits a specific brief, request recent LinkedIn audience demographics and, if employer, occupation, or seniority matters, a documented audience survey or equivalent evidence covering those attributes.
Jonathan Baker's posts do not say whether they offer partnership, sponsorship, or paid collaboration formats.
Read more
Across five posts published between April and September 2026, they cover speaking and workshop delivery, blog promotion, and team announcements rather than brand partnerships.
They posted about presenting a session titled "Threat-INFORM to Optimize Security Operations" at the 38th Annual FIRST Conference; hosting a CTEM + MITRE INFORM workshop in Dallas with Peter Luban, described as a facilitated leadership workshop rather than a product pitch; a webinar planned with Peter Luban on threat debt; and a blog series on threat debt and threat-informed defense.
They also announced David Mihelcic joining the AttackIQ team, referencing "our customers' missions" and "our AI footprint."
Those references show a company affiliation in their own words, but no post sets out sponsorship terms, pricing, formats, deliverables, or a route for brands to inquire.
Buyers should confirm directly whether they accept sponsorships and, if so, what they charge, produce, and how to get in touch.
Good fit to consider as a speaker or workshop co-facilitator. Baker’s posts repeatedly connect CTEM, threat-informed defense, and MITRE frameworks to practical decisions: which assets matter, which attacker paths are viable, and how to validate defenses against relevant techniques. Baker announced a FIRST Conference session on combining threat-informed defense, MITRE ATT&CK, and CTEM, and a facilitated CTEM + MITRE INFORM workshop covering program maturity, organizational readiness, roles, and adoption barriers. For a campaign aimed at security practitioners, ask for a proposed agenda and practical takeaways; confirm scope, availability, and terms directly rather than assuming a product endorsement.
Read more
Brief
A cybersecurity vendor is planning an educational session for security leaders who need to prioritize exposures and improve threat-informed defense.
Sources
When to choose a specialist
Poor fit based on the posts here. Baker’s posts focus on professional cybersecurity topics such as exposure management, attacker techniques, and security operations; they show no consumer or lifestyle content, product testimonials, or sponsored-post formats. Do not select Baker for consumer reach or paid promotion on the assumption that the posts can deliver it. If the brand can reshape the campaign as an educational session for security practitioners, reassess that campaign and ask for current audience and performance information, rates, deliverables, and an inquiry route.
Read more
Brief
A consumer-facing security brand wants a paid social campaign with guaranteed reach, lifestyle content, and product testimonials.
Sources
A worked campaign example
Campaign angle
“Find the paths that create threat debt”: a practical session for security leaders on prioritizing connected exposures instead of racing through a vulnerability backlog.
Decision checks
Confirm Baker’s availability, paid-participation terms, and approval of the proposed format.
Request current audience and performance information if reach is part of the campaign objective.
Agree on whether the session is educational, promotional, or both, and review any product claims and materials with Baker in advance.
Ask for an agenda and usable attendee takeaway. Baker’s workshop announcement says participants received practical guidance and leadership materials; ask which materials are available.
Execution
Invite Baker to propose a 30–40 minute educational webinar, followed by a moderated Q&A. Structure the discussion around their stated examples: a vulnerability near a critical asset, an EDR misconfiguration that enables the next step, and a stale detection that fails to fire. Ask them to show how a team could map relevant adversaries to critical assets, validate defenses against documented techniques, and identify which paths to break first. Close with a short audience exercise: attendees name one important asset, one plausible attacker path, and one control or detection to validate. The vendor can provide a neutral worksheet and introduce its relevant product only in a clearly separated closing segment. Baker’s workshop post describes a teaching format, not a product pitch, so do not present them as endorsing a product without explicit agreement.
Choose Karanjalkar when the session or advisory engagement focuses specifically on behavioral threat intelligence: representing adversary behavior, distinguishing it from anomaly detection, and connecting CTI standards to detection and threat hunting.
Read more
The two posts argue that behavior analytics often stops at “something unusual happened,” while behavioral threat intelligence explains the adversarial objective, attack stage, and likely next move.
One post also explains how the OCA Indicators of Behaviour project uses STIX 2.1 to make behavioral observations shareable across tools.
This is a better fit than Baker if the audience’s main gap is behavioral CTI vocabulary and detection context rather than CTEM program design.
Karanjalkar is a narrower fit for CTEM and threat-informed defense program questions.
The posts don’t show CTEM lifecycle facilitation, exposure prioritization against named adversaries, control validation, workshop design, or organizational readiness.
If the vendor needs a speaker to connect CTEM, MITRE ATT&CK, and program maturity in one session, Baker’s posts align more directly.
Choose Karanjalkar when the session focuses on behavioral intelligence; ask whether they can also address the broader program needs.
Choose LaMantia when the session focuses on external DNS exposure and attack surface governance.
Read more
The posts describe recurring DNS assessment findings—legacy records, third-party dependencies with unclear ownership, incomplete SPF/DMARC coverage, and externally visible assets outside governance—and frame the core risk as an ownership gap rather than a single misconfiguration. LaMantia is a better fit than Baker for security leaders who need to govern domains, subdomains, DNS records, and externally exposed assets end to end.
The posts focus on DNS and EASM governance, not CTEM program lifecycle, threat-informed defense maturity, MITRE ATT&CK-based validation, or workshop facilitation.
If the buyer needs help prioritizing exposures through adversary context and validating defenses, Baker’s posts fit more directly.
Choose LaMantia when DNS governance is the primary decision; ask whether they can also address the broader program needs.
This profile covers five LinkedIn posts by Jonathan Baker about threat debt, threat-informed exposure management, AI-related assets, detection engineering, a CTEM and MITRE INFORM workshop, a FIRST Conference session, and a colleague joining the AttackIQ team.
Posts by two other cybersecurity creators provide context.
The posts here carry no publication dates, and the linked blog articles, session recordings, and workshop materials are not discussed here.
The posts do not state audience size or commercial terms.
Statements about employers and other organizations reflect what Baker's own posts say; Baker's posts do not state a job title or start date, or establish sponsorship or a formal partnership.
