Watergate’s lesson for incident response: don’t mistake the initial intrusion for the operation. Five suspects, sophisticated tools, sequential cash, and campaign ties preceded findings of a broader sabotage campaign. Keep scope and attribution provisional until investigation tests them.