MPs reviewing the 2017 terror attacks say MI5 has accepted it made a mistake in not tracking the Manchester bomber.
A report by the Intelligence and Security Committee said MI5 recognised it had moved "too slowly" to establish how dangerous Salman Abedi, 22, was.
The security service had cause to monitor Abedi's return to the UK from Libya days before the attack in which 22 people died, the report said.
Martin Hibbert, injured in the blast, said the truth was now coming out.
And Dan Hett, from Survivors Against Terror - who lost his brother Martyn in the attack - said the "litany of mistakes in 2017 must urgently be learnt from".
In wide-ranging criticisms, the committee said the government had also failed to fully learn lessons from attacks dating back 13 years.
Abedi is believed to have been taught bomb-making while in Libya, before returning to Manchester in May last year to construct his device.
He walked into the foyer of Manchester Arena, where thousands had been watching US singer Ariana Grande perform, and blew himself up.
A previous report into the attack revealed that MI5 had planned to review the risks posed by Abedi - but the meeting was not scheduled to take place before the attack occurred.
In its findings, the ISC said there had been "no follow-up action" after Abedi visited a jailed terrorist organiser from Manchester.
Last December, an independent assessment of MI5's own secret review of the attack revealed for the first time that an opportunity had been missed to monitor Abedi's movements - which would have revealed his return to the UK from Libya, days before he struck.
"MI5 have since admitted that given the information they had on Abedi, they should have done so," said the committee.
"Abedi had been flagged for review but MI5's systems moved too slowly."
Since then, MPs said the security service had already changed its systems in an attempt to better identify potential extremists like him.
The committee said one failing it had identified was so sensitive, it could not be shared publicly.
But it added: "What we can say is that there were a number of a failings in the handling of Salman Abedi's case.
"While it is impossible to say whether these would have prevented the devastating attack on 22 May, we have concluded that as a result of the failings, potential opportunities to prevent it were missed."
Mr Hibbert, who was left paralysed by the explosion, welcomed the report's release. His daughter was also wounded as they left the arena when the bomb went off.
"It doesn't make things any easier but it means at last there is some compassion being shown and some accountability in terms of people saying 'We didn't do our job'.
"It's a start. It's just sad that it's taken 18 months," he said.
Another survivor, Robby Potter, who took his 11-year-old daughter Tegan to the concert, said he was considering taking legal action against MI5.
His injuries from 37 pieces of flying shrapnel have meant he's been unable to return to his job as a drainage engineer, and now drives lorries.
"I'd have more respect for them if they had said immediately after [the attack] 'we made a mistake - we underestimated this man'," he said.
"I love my country but I was let down. This could have been stopped, and we're finding out now that it should have been stopped."
In their highly-critical report, MPs and peers on the committee also found:
- Measures to control access to chemicals needed for bomb-making were "hopelessly out of date"
- Communication companies were still failing to meet their social duties to detect terror planning online - and it recommended putting pressure on them by targeting their profits
- There had also been "fundamental failings" by the Home Office, police and Surrey County Council over their handling of the teenager who placed a bomb on the London Underground in September 2017
- MI5 should rethink how it "joins the dots" on some suspects because it had failed to appreciate the potential dangers posed by Khalid Masood, the Westminster Bridge attacker, despite a trail of evidence over six years
The committee also attacked the Home Office for failing to properly co-operate over its attempts to investigate how the Parsons Green attacker, Ahmed Hassan, went undetected.
It had made "multiple attempts" to extract the "full evidence" from the Home Office - but the information had not been provided in time.
"This is unacceptable," said the committee. "From what we have seen to date there were fundamental failings in the handling of this case by the Home Office, the police and Surrey County Council.
"This litany of errors will require a separate comprehensive review to which the Home Office must be directly answerable."
Analysis: Intelligence on suspects is fragmentary
Salman Abedi was a "closed subject of interest" for MI5 - someone who had once been a cause of concern - but there had been an assessment on the available intelligence that he was not going to turn to violence.
That meant the 22-year-old went into a pool of 20,000 closed SOIs - people who are not under active investigation anymore.
What the review makes clear is that the system for triggering a rethink of individuals in that closed group was too slow to react to a changing picture - and the security service has acknowledged its processes didn't, on this occasion, deliver.
The big problem is that intelligence on suspects is fragmentary. A British-Libyan young man travelling to Libya is not the stuff of red alerts.
But his visit to a jailed recruiter and facilitator would have been a relevant piece of information for the review of Abedi that had been planned. That information hadn't reached MI5 before the attack.
And that's why the committee says there are really serious questions to be answered by all arms of government over whether everyone is learning lessons from every terrorism conspiracy of recent years.
The committee said that despite these concerns about government, it recognised that MI5 and the police had taken the mistakes seriously.
"We note that both MI5 and counter-terrorism policing have been thorough in their desire to learn from past mistakes," it said.
"We also know and acknowledge the determination with which they approach their work, which we regard as impressive.
"However, it has been striking how many of the issues which arose in relation to the 2017 terrorist attacks have been previously raised by this committee in our reports on the 7/7 attacks [in 2005] and on the killing of Fusilier Lee Rigby [in 2013].
"We have previously made recommendations in all these areas yet the government failed to act on them. The lessons of last year's tragic events must now result in real action."
Home Secretary Sajid Javid said: "We have updated our counter-terrorism strategy, introduced new legislation to allow threats to be disrupted earlier and have increased information-sharing with local authorities.
"We are also ensuring technology companies play their part by stopping terrorists from exploiting their platforms," he added.
Scotland Yard said the police and MI5 have foiled 13 plots since the Westminster attack in March 2017.
Assistant Commissioner Neil Basu, the head of counter-terrorism policing, said: "We will not let the terrorists who carried out these appalling attacks to succeed in scaring and dividing us."
The Met was, he said, doing more now to improve the handling and assessment of intelligence and making better use of data.
It is currently handling more than 700 live investigations, involving 3,000 people posing the biggest threat and another 20,000 who are also considered a concern.
Terror attacks in 2017
22 March: Khalid Masood runs down and kills four people on Westminster Bridge before stabbing a policeman to death outside Parliament.
22 May: Salman Abedi, 22, detonates a home-made bomb in Manchester Arena's foyer blowing crowds off their feet as they leave an Ariana Grande concert. Twenty-two people die and more than 800 are injured.
3 June: Eight people are killed when three attackers drive a van into pedestrians on London Bridge and launch a knife attack in Borough Market.
19 June: Darren Osborne drives a van into worshippers near Finsbury Park Mosque, killing one man and injuring nine others.
15 September: Ahmed Hassan, 18, plants a home-made bomb on a Tube train at Parsons Green, which injures 51 people when it partially explodes.