When a breaking physical security event hits, the information environment doesn't get clearer as more data arrives — it gets noisier. Rumor, speculation, and verified reporting arrive in the same feeds at the same speed, and the pressure to produce something fast is exactly when the worst intelligence mistakes get made. This piece follows Leo, a crisis intelligence analyst, through the four-stage workflow that separates defensible analysis from educated guessing: triaging before typing, building an attributed collection under pressure, generating a confidence-calibrated first draft, and reviewing with the skepticism the moment demands.