The report's author, David Anderson, said it was conceivable the attack by Salman Abedi on May 22 could have been avoided had "cards fallen differently".
After the bombing, which left 22 people dead, Scotland Yard's internal review found that better resources and infrastructures were needed.
Internal reviews were also conducted by MI5 intelligence service, which remain largely secret, are summarised in Anderson's report.
On two occasions in the months before Abedi killed 22 people, MI5 received intelligence, but its significance was not fully appreciated at the time and, in hindsight, was "highly relevant" to the planned attack.
More From This Section
The two other attackers who had been on MI5's radar were Khuram Butt, who attacked at London Bridge and Borough Market, and Khalid Masood on Westminster Bridge in June this year.
Anderson, a former independent reviewer of terror legislation in the UK, said: "Despite elevated threat levels, the fundamentals are sound and the great majority of attacks continue to be thwarted.
"In particular, MI5 and the police have identified the need to use data more effectively, to share knowledge more widely, to improve their own collaboration and to assess and investigate terrorist threats on a uniform basis, whatever the ideology that inspires them.