The terror attacks in Sri Lanka were another missed early warning. How does this happen?

Since more than 250 people were killed in coordinated terrorist attacks in Sri Lanka on Sunday, thousands of security forces have fanned out across the country in a massive operation intended to neutralise the ongoing threat of another attack.

Late Friday, at least 15 people, including six children, were killed in bomb blasts and a gun battle in the town of Sainthamaruthu, where police said a group tied to the Easter bombings was hiding out. In the past week, dozens of other people have been rounded up and arrested - including a wealthy spice trader whose two sons and daughter-in-law were allegedly among the suicide bombers who carried out the attacks.

On Friday, President Maithripala Sirisena said officials would restructure Sri Lanka's security forces to try to better protect civilians, declaring the whole ordeal the result of a major intelligence failure. The country's defence secretary and police chief resigned this week. Sirisena said they had been warned of the attacks but "did not say a word about this warning letter."

"It was a serious lapse on their part and shirk of responsibility," he said.

Underlying all these developments lies a single, pressing question: Could the carnage have been stopped before it ever started?

It's a question intelligence officials around the world grapple with in the aftermath of every deadly terrorist attack - from 9/11 to the Paris attacks, the Manchester Arena bombing and beyond.

In New Zealand, Prime Minister Jacinda Ardern has announced that a Royal Commission of Inquiry will be held into the Christchurch mosques terror attack.

People were asking how the attack, in which 50 people died and dozens more injured, was able to take place, including how the alleged gunman obtained the weapons, the role of social media and the role of agencies, she said when announcing the inquiry.

Ardern said she also had questions.

The inquiry would take in the agency review already announced, she said.

There would be a focus on whether security agencies were focused the right way and whether there were any clues that were missed.

Royal commissions were reserved for the gravest of events and the mosques attack was one of those, she said.

Ardern said the inquiry would look at events leading up to the attack rather than the response - that would come later.

"Any terrorist attack is by definition an intelligence failure," said Raffaello Pantucci, director of international security studies at the Royal United Services Institute for Defense and Security Studies in London.

"Intelligence's job is to stay on top of these problems and stop them from happening."

But experts say it's much easier in hindsight to understand what was a crucial piece of information and to see that security forces should have acted on it.

On a daily basis, intelligence officials "may be getting swamped" with tips and warnings, said Seth Jones, a terrorism expert at the Centre for Strategic and International Studies.

"Sometimes it can be difficult for individuals to desegregate which is most important and which isn't," he said.

"People make mistakes."

After the 9/11 attacks, the United States launched the National Counterterrorism Centre in an effort to close intelligence gaps and ensure incoming information was being appropriately processed.

In 2016, months after deadly terrorist attacks rocked Paris, French lawmakers urged a similar solution, suggesting leaders merge France's intelligence agencies to ensure stronger monitoring of potential terrorists.

Last year, British lawmakers determined that British intelligence failed to recognize the level of danger posed by Salman Abedi, the bomber who killed 22 people at an Ariana Grande concert.

"[A]s a result of the failings, potential opportunities to prevent [the bombing] were missed," lawmakers said.

There is no doubt that the attacks in Sri Lanka were also an intelligence failure, Pantucci said.

But it's a good sign, he noted, that officials were at least familiar with the local group, National Thowheed Jamaath, that they say was responsible for the attacks.

That they were able to quickly make a number of arrests signals they at least had some individuals on their radar before the attacks occurred.

The Islamic State has also claimed responsibility for the attacks, but it's not entirely clear what role it may have played.

"It would be worse if someone launched an attack and we'd never heard of him and never heard of the group, because then what are our security services doing?" Pantucci said.

Still, details about just how much officials knew remains murky. It's been widely reported that India offered specific intelligence warnings about the attack weeks ahead of time and that officials still did not act. Whether that was the result of scepticism, incompetence or other obstacles remains to be seen.

"Sometimes, we have a name and concerns about an individual and the possibility of an attack but not a date," Jones said. "What is surprising here is that there appears to have been a lot of information."

As officials have rounded up individuals believed to be linked to the attacks, they will have to sort through new layers of information to try to figure out how this happened - and how the next attack can be stopped.

"If an attack was able to get through, you missed something and you missed something big," Pantucci said. "If you missed something big, what else is out there that you also missed?"

Additional reporting: NZ Herald