Behaviour is the major factor when identifying a terror suspect, rather than ethnicity, a security expert told the Manchester Arena Inquiry.
Tony Holyland from the Security Industry Authority (SIA) said Salman Abedi's actions on the night he bombed the venue should have raised suspicion.
Twenty-two people died in the attack on 22 May 2017.
Mr Holyland said Abedi's "loitering", the way he was dressed and his multiple visits would have been indicators.
He told the inquiry security staff had been taught how to identify such behaviours in their SIA training.
Abedi initially visited the arena's foyer for 20 minutes and then returned later, hiding in an "out-of-the-way" place for an hour in a CCTV blind spot, the court heard.
The 22-year-old, dressed all in black and carrying a large rucksack, had been reported to security by a member of the public at 22:15.
Security guard Kyle Lawler earlier told the inquiry he had a "bad feeling" about Abedi but did not approach him for fear of being branded a racist.
Mr Holyland said: "The training focuses on behaviour not features such as ethnicity.
"There were behaviours [from Abedi] that identify as suspicious", he said, adding: "Loitering, being incorrectly dressed for the time of year, and multiple sightings of the same person."
Abedi detonated his bomb at 22:31 as fans left the Ariana Grande concert.
The court was told he was seen praying before the explosion but Mr Holyland said he was not aware of praying being classed as a suspicious activity.
Earlier, Michelle Russell from the SIA said the authority did not distinguish between bag checks and bag searches but she believed a bag check would require a staff member to hold a licence.
Security staff have previously told the inquiry the instruction on the night of the bombing was a 100% bag check.
"If the activity is wholly or partly responsible for determining suitability of admission it would be potentially be caught by the legislation," she said.
Ms Russell also said the authority licensed individuals but businesses could become approved contractors on a voluntary basis.
CCTV blind spots
The inquiry also heard evidence about the CCTV system that was in operation in the City Room where the bomb was detonated.
Mike Cowley, from Manchester Arena operator SMG, previously said in a statement that in his view "the CCTV system was a good system".
"The images were good, the functionality met the needs of the operation and it was a reliable system," he told the inquiry.
But the inquiry head there was a CCTV blind spot on the mezzanine level of the City Room where someone sitting down would not be captured by the cameras.
"I don't believe it was an area of concern," he told the inquiry.
"The area, when events were occurring, was physically manned so there were multiple sets of eyes and cameras that covered maybe 95% of the area."
The inquiry continues.