MI5 had enough intelligence to regard Salman Abedi as a threat to national security and open an investigation before he bombed the Manchester Arena, killing 22 people and injuring hundreds of others, an inquiry has heard.

The Security Service was “struggling to cope” with an increased workload, and the team responsible for the north-west of England had declared an “amber” period of stress and high capacity the month before the attack in 2017.

The information, revealed on Tuesday, came from the testimony of four MI5 witnesses and 10 officers from north west counter-terrorism police, who gave evidence in closed sessions last year after the chair of the Manchester arena inquiry, Sir John Saunders, ruled it could compromise national security if it were heard in public.

Families of those killed in the attack have said they are shocked and appalled and found the admission from one MI5 officer that he had raised concerns with superiors and worried something could “get through” because of the high volume of documents “difficult to swallow”.

Summarising the evidence heard in secret over 10 days, Paul Greaney QC, counsel for the inquiry, said the MI5 officer who first assessed one piece of intelligence accepted during questioning that it could be understood, at the time, to indicate “activity of pressing national security concern”.

Two pieces of intelligence received by MI5 in the months leading up to the attack were not passed to counter-terrorism police and the security services did not fully appreciate their significance. Had the significance of the intelligence been understood, two witnesses agreed further investigative steps may have been taken.

Witnesses from counter-terrorism police and MI5 described IT systems for sharing information between them as “clunky” and “hit and miss” and the “system for triaging unsolicited intelligence was admitted to be a bit haphazard”. That system has now changed.

A senior MI5 witness gave evidence that large electronic files would occasionally not send properly, so that PowerPoint presentations had to be sent slide by slide.

Occasionally documents would be sent to police but it might not be realised for a day that they had not arrived. MI5 did not tell police that the agency had information that Abedi had travelled from Istanbul to Libya in May 2016, despite an intention to do so.

One witness described the role of an MI5 investigator as being “like a spider in the centre of a web, with strands of intelligence from many sources coming together for them to assess”, while another said that the team in MI5 responsible for the north west was surprised by the pace of the change in workload after the declaration of a “caliphate” by Islamic State in 2014. The north west investigative team went into “amber” on its workload dashboard in April 2017, some of its casework was suspended that month and into May – the month of the attack.

By the time Salman Abedi had murdered 22 people and injured hundreds more when he detonated a suicide vest at the end of an Ariana Grande concert on 22 May 2017, he was a closed “subject of interest” after being red-flagged by the security services twice in 2014 and 2015.

He first came on their radar in 2010, just before his 16th birthday. MI5 had intelligence that Abedi supported Islamic State, but one witness said there were a large number of people during this period who expressed such support who “did not pose a threat to UK national security”.

Saunders said he understood the evidence had raised “questions that may not have been raised before”, and that would inform his conclusions, but were not a finding of fact.

Kim Harrison, of Slater and Gordon, solicitor for families of 12 of the victims, said they were “deeply shocked and appalled by the evidence read today that the MI5 north west investigative team were struggling to cope with a significant increase and change in workload from 2015”.

“To hear that concerns had apparently been raised with superiors regarding the triaging of intelligence, including worries that something could get through due to the volumes of documents being considered is difficult to swallow,” she said.