The chair of the inquiry into the May 2017 Manchester Arena bombing has criticised “serious shortcomings” in security provision by the venue’s owners, security contractors and British Transport Police on the night of the attack, which killed the bomber and 22 other people.

John Saunders blamed “failings and mistakes by some individuals” for “missed opportunities” to lessen the death toll of the bombing by Salman Abedi, an Islamist radical, after a concert by American singer Ariana Grande.

Saunders spoke on Thursday as he published findings from the first of three phases of the inquiry into the attack, the most serious in the UK since the July 2005 London bombings.

The report detailed how Abedi spent two hours around the venue before detonating his bomb. He was identified as suspicious by several people, including a member of the public who alerted Mohammed Agha, a member of the security staff, 15 minutes before the explosion.

“I have concluded that there were serious shortcomings in the security provided by those organisations which had responsibility for it and also failings and mistakes by some individuals,” Saunders said.

SMG, operators of the 21,000-seat Manchester Arena, Showsec, SMG’s security contractors, and British Transport Police, which oversees the area where the bomb was set off, were “principally responsible” for the missed opportunities, according to the report.

Despite the UK terror alert level being “severe” at the time, meaning an attack was seen as highly likely, those involved in securing the venue failed to take the risk seriously, according to Saunders.

“Everybody concerned with security at the arena should have been doing their job in the knowledge that a terrorist attack might occur on that night,” he said, adding: “They weren’t. No one believed it could happen to them.”

The report recommended venue operators should face a “protect duty” to conduct a comprehensive assessment of attack risks and plan and implement measures to reduce vulnerability.

Home secretary Priti Patel said the government had launched a consultation on a potential protect duty earlier this year and that Saunders’ remarks would help to shape its response.

The relatively small security perimeter in the City Room, the area around the exit that Abedi targeted, allowed him to conduct surveillance without detection, the report said. It also meant the rucksack containing the improvised bomb went unsearched.

Abedi was able to spend two prolonged periods during the two hours before he set off his bomb in a “blind spot” invisible to security cameras.

The chair focused particular blame on BTP officers’ failure to ensure at least one officer was in the City Room in the key half-hour before the concert’s end at 10.30pm. The device went off at 10.31pm.

Lucy D’Orsi, BTP chief constable, which policed the area adjoining Manchester Victoria station, said the force had been reviewing “procedures, operational planning and training” since the “dreadful attack”.

SMG said the inquiry had found no evidence security procedures on the night of the attack were out of line with those at other comparable venues at the time, adding that the group had “learnt a lot” since the bombing.

Showsec said it had “learnt lessons” from the “terrible events” and that improvements had been put in place.

Ultimate responsibility lay with Salman Abedi and Hashem Abedi, his younger brother, Saunders stressed. Hashem Abedi was jailed for life in March last year after being convicted of murder for his role.