Britain has become more vulnerable to terrorist attacks because “frustrated travellers” are finding it more difficult to get to Syria and are being urged by different extremist groups to commit atrocities in the UK.

The return of some British fighters from Syria has added to a complex picture, which means the UK’s counter-terrorism agencies are feeling heat from all sides, intelligence sources said.

“There is pressure on the counter-extremism strategy because of the confluence of frustrated travellers who would go to Syria if they could but are stuck here, and returnees,” said one Whitehall source.

“Both Isis (Islamic State) and al-Qaida are calling for these travellers to stay at home and attack in the west instead. The risk seems far greater now. The risk is changing.”

The police and intelligence services are seeking to establish the motive of the Manchester killer, Salman Abedi, and whether he was working alone or part of a wider network. Although Isis claimed responsibility, the police have not found any evidence to support this.

The MI5 director, Andrew Parker, cautioned last year that the agencies could stop most but not all attacks, while his MI6 counterpart, Alex Younger, warned of highly organised external attack-planning structures within Isis.

Sources pointed to a message posted earlier this month by Hamza bin Laden, the son of Osama bin Laden. He urged lone actors to seek martyrdom in the west, echoing the calls more frequently made by Isis as the group comes under intense military pressure in Iraq and Syria.

Hamza called on followers to “avenge” the “children of Syria”, the “widows of Palestine”, the “free, honourable women of Iraq” and “the orphans of Afghanistan”.

Messages like this are being supplemented with instructions to commit jihad made on subscription channels set up on messenger services such as Telegram. “They are echo chambers and war rooms where they plan how to spread material on social media,” said the source.

Raffaello Pantucci, a counter-terrorism expert at the Royal United Service Institute thinktank based in London, said: “Al-Qaida has always been a threat, and Isis persists in calling for attacks.

“I think this is reflected in recent patterns of arrest in the UK. There appear to have been more for plotting terrorist attacks than before, rather than the usual funding and propaganda. The tempo may be changing.”

The UK has faced 13 serious terrorist plots since the murder of Fusilier Lee Rigby in May 2013, the Met police’s assistant commissioner and national lead on counter-terror policing, Mark Rowley, said in an BBC interview in March. But the list has grown by several more since then.

In addition to these plots and alleged plots, the police make arrests almost every week for lesser offences, from alleged support for terrorists to downloading terrorist-related material from jihadi websites.

More than 850 UK citizens have travelled to fight for Isis and other jihadi groups in Syria and Iraq, of whom about half have returned. The MI5 watchlist of people of concern has risen to about 3,000 and includes some who have returned from Syria. Those returning are assessed and placed in various categories, ranging from high to low risk.

Although the budget of all three intelligence agencies has been increased, MI5 only has the resources to maintain physical surveillance on a limited number of people. The people needed to maintain surveillance varies from case to case but a large number would be needed to keep tabs on even one person for 24 hours.

After the London bombings, MI5, which had been concentrated in London and Belfast, decentralised, establishing regional centres in the north-west of England and elsewhere around the UK.

The joint terrorism analysis centre, which is housed in MI5 headquarters and brings together the UK agencies and police dealing with counter-terrorism, upgraded the threat level from severe, the fourth highest ranking, established in 2014 amid fears of jihadis returning from Syria.

Moving it on to the fifth and highest level, critical, is only supposed to reflect security service fears that another attack is imminent. But it may be a precautionary, temporary measure until it is established whether Abedi was acting alone or with others.

The role of MI5 will come under scrutiny over whether the bomber was under surveillance. Abedi had been on MI5’s radar but was not considered high-risk. His name had come up in relation to other investigations but he was viewed as a peripheral figure, much the same as the terrorist responsible for the Westminster attack, Khalid Masood.

The intelligence agencies repeatedly warn that they do not have the resources to mount 24-hour physical surveillance of more than a small number of the 500 suspects regarded as being of concern.

The failure to prevent the Manchester attack will be felt keenly by all the intelligence agencies. Parker reflected this in an unusually personal statement for one of the heads of the UK’s three intelligence agencies.

“Everyone at MI5 is revolted by the disgusting terrorist attack in Manchester last night,” he said, adding: “We remain relentlessly focused, in numerous current operations, on doing all we can to combat the scourge of terrorism and keep the country safe.”