The head of MI5 said he was “profoundly sorry” the security service did not prevent the Manchester Arena attack.
A public inquiry found MI5 missed a significant chance to take action that might have stopped the 2017 bombing.
Chairman Sir John Saunders said the intelligence could have led to suicide bomber Salman Abedi being followed to a car where he stored his explosives.
MI5 director-general Ken McCallum said he regretted that such intelligence was not obtained.
“Gathering covert intelligence is difficult,” he said, “but had we managed to seize the slim chance we had, those impacted might not have experienced such appalling loss and trauma.”
Twenty-two people died and hundreds were injured when Abedi detonated his homemade device in the foyer of Manchester Arena as crowds left an Ariana Grande concert on 22 May 2017.
The inquiry found two pieces of information about Abedi were assessed at the time by the security service as not being terrorism-related.
An officer admitted they considered a possible pressing national security concern on one of them but did not immediately discuss it with colleagues and did not write up a report that same day.
In his 207-page report, Sir John said: “The delay in providing the report led to the missing of an opportunity to take a potentially important investigative action.
“Based on everything the security service knew or should have known, I am satisfied that such an investigative action would have been a proportionate and justified step to take.
“This should have happened.”
But he added that Abedi “demonstrated some security consciousness and that this might have affected the efficacy of the investigative action that I have identified”.
Sir John said the intelligence could have led to Abedi being followed to the parked Nissan Micra where he stored his explosives and later moved them to a city-centre rented flat to assemble his bomb.
He said that if MI5 had acted on the intelligence received then Abedi could also have been stopped at Manchester Airport on his return from Libya four days before the attack.
The public inquiry also found Abedi was probably assisted by someone in Libya but it was not possible, on the available evidence, to say who this might have been.
It is the first time an official conclusion has been made about the possible involvement of other people from abroad.
In making this finding, Sir John contradicts an MI5 assessment which said no-one other than Salman Abedi and his brother Hashem were knowingly involved in the plot.
The report also found that while Didsbury Mosque in south Manchester, where the Abedi family worshipped, was not an active factor in the brothers’ radicalisation, politicisation did happen there.
Sir John said “there was a form of wilful blindness” to some activities, and “weak leadership”.
Didsbury Mosque chairman Fawzi Haffar told the BBC he disagreed with Sir John and added: “The chairman can say whatever he wants.
“The chairman has not been to the mosque, none of the lawyers have been to the mosque, they don’t know the workings of the mosque.
“I would say to him [the chairman] that they are wrong,” Mr Haffar added.
The report concluded that the Abedi family held “significant responsibility” for the radicalisation of Salman and Hashem Abedi.
Those family members responsible include their father Ramadan Abedi, mother Samia Tabbal and elder brother Ismail Abedi, each of whom has held extremist views, the inquiry found.
But Sir John said, other than Hashem Abedi, there was insufficient evidence to attribute specific knowledge of the attack to them.
The first volume has been made publicly available while the second has only been circulated to a limited readership of people with security clearance.
This does not include the families of those who died, their legal teams, or the media as its contents would be damaging to national security if made public, the inquiry was told.
The inquiry process began more than three years ago, and there were 194 days of oral evidence from 267 witnesses.
It seems a contradiction of the term “public inquiry” to keep some findings private, but the chairman says that he had to balance the principle of open justice with the issue of national security.
He’s added that all private evidence has been scrutinised to make sure that restricting it can’t be seen as a “cloak to cover up mistakes”.
Given that the previous two inquiry reports were highly critical of the private companies and public authorities involved with the arena and the emergency response, this document was also expected to be tough on MI5.
Bereaved families and survivors will be pleased that in some areas the report doesn’t pull its punches.
They’ll find it upsetting to hear that the security service missed a significant opportunity. But there will also be some frustration that they’ll never learn the full detail of exactly what that opportunity involved.
Andrew Roussos, whose eight-year-old daughter Saffie-Rose was killed in the blast, said hearing how this tragedy might have been avoided was “devastating for us all”.
“This was a cataclysmic failure… In my view the fact that MI5 failed to stop him despite all of the red flags available demonstrates they are not fit to keep us safe and therefore not fit for purpose.”
Caroline Curry, whose 19-year-old son Liam was killed in the attack, said: “From top to bottom, MI5 to the associates of the attacker, we will always believe you all played a part in the murder of our children.”
Figen Murray, the mother of Martyn Hett, 29, who also died in the blast, said she accepted MI5’s apology although “it didn’t surprise me that there’s yet another catalogue of errors and failings”.
“I’m not excusing anybody making mistakes don’t get me wrong, but these people are human beings and I’m sure nobody made any mistakes deliberately.”
“It is difficult to hear things could have been different, but you know what, we can’t turn the clock back,” she said, adding that it would be a “disservice” to her son’s “people-loving” and “fun” nature “if I became a bitter and angry person”.
Richard Scorer, principal lawyer at Slater and Gordon, who represented 11 of the bereaved families at the inquiry, said the report had been “deeply painful to read, but also eye-opening” while providing “less information than we would have wanted”.
Nicola Brook, from Broudie Jackson Canter, which represents five bereaved families, said it was “disappointing that the families will never know the full truth of what happened”.
“All of the families signed an undertaking not to reveal confidential information which they have not breached,” she added.
“They, above all others, are entitled to know what the security services knew and had the most interest in keeping it confidential.”
Following publication of the report, MI5 said since the attack it had made more than 100 improvements.
“But we are determined to do more. As the chair now considers his recommendations, we will engage fully,” said Mr McCallum.
“Where there are opportunities to strengthen the UK’s defences further, MI5 will act.”
A spokesman for Prime Minister Rishi Sunak said the government would look at the report’s findings before responding fully and formally.
Asked if anyone would be held accountable, Downing Street said they could not pre-empt a formal response but added ministers “will of course learn from this to ensure mistakes are not repeated”.
Home Secretary Suella Braverman said she was “committed to working with MI5, policing and partners to study the recommendations”.
“Together we will do everything possible to prevent a repeat of this horrifying attack,” she added.