In past Security Weeklies we have often noted how analyzing terrorism is like assembling a puzzle. After an attack has transpired, it is easier to piece the disparate clues together because you have the luxury of knowing what the finished puzzle should look like. You know the target, the method of attack, the time, the place, etc. These factors frame your approach to the bits of evidence you gather and allow you to assemble them into a cohesive, logical framework. While there will certainly be missing pieces at times, having the reference point of the attack itself is helpful to investigators and analysts.
On the other hand, analyzing a potential threat before an attack takes place is far more difficult. It is like sifting through pieces of thousands of different puzzles, all jumbled together in one big pile, and attempting to create a complete picture without knowing what the end result -- the attack -- will look like. Sometimes pieces look like they could be related, but it is often difficult to determine if they really are without having the picture of the finished attack and the important framework for investigative reference: target, method of attack, time and place. It is often easy to look back after an attack and criticize authorities for not making a critical connection, but it is difficult to piece things together before the attack occurs without the assistance of hindsight.