Manchester bomber Salman Abedi was known to the security services and his risk to the public remained "subject to review" before he carried out his deadly attack.
Abedi, whose sister said he "wanted revenge" for Western military strikes in the Middle East, was a "former subject of interest" to MI5, a Whitehall source confirmed.
Hours before the attack, he had phoned his mother and said "forgive me", according to a Libyan anti-terror official.
Libyan investigators believe Abedi acted alone when perpetrating the outrage, Special Deterrent Force spokesman Ahmed bin Salem added.
Relatives of the British-born bomber are being interrogated by Libyan authorities in Tripoli, where his father Ramadan and teenage brother Hashim were arrested on Wednesday.
Abedi's mother, Samia Tabbal, was said to have told them her son left the North African country bound for the UK four days before detonating his device at Manchester Arena.
Mr Bin Salem said of the final phone call: "He was giving farewell."
Hashim, 18, allegedly claimed his older brother learnt to build bombs from the internet, hoping to "seek victory for the Islamic State", Mr Bin Salem added.
Despite the belief of the Libyan authorities that Abedi acted alone, British investigative efforts remained focused on smashing the potential terror ring which may have assisted him.
Police hunting the "network" behind his attack said they had made "significant" arrests and seized "very important" items in raids linked to the investigation.
After chairing a meeting of the Cobra emergency committee, Theresa May said the terror threat level will remain at critical - meaning another attack is expected imminently.
In an indication of the level of counter-terrorism activity, a senior Whitehall source revealed that 18 plots had been foiled since 2013 in Britain, including five in just nine weeks since the Westminster attack in March this year.
It is understood the scale of the threat being dealt with by counter-terror agencies is "unprecedented" and intelligence officers faced "difficult professional judgments" about where to focus their investigations.
The source said: "MI5 is managing around 500 active investigations, involving some 3,000 subjects of interest (SOIs) at any one time.
"Abedi was one of a larger pool of former SOIs whose risk remained subject to review by MI5 and its partners.
"Where former SOIs show sufficient risk of re-engaging in terrorism, MI5 can consider reopening the investigation, but this process inevitably relies on difficult professional judgments based on partial information."