IT is too early for any definitive analysis of the Manchester suicide bombing, but the nature of the attack and the device used provides significant indicators as to who might be behind it. To begin with, this was a bomb – not the knives and vehicles used to stab and mow down victims as in other UK attacks like the attack at Westminster in March.

Most security experts agree that to be able to assemble such a device safely and to detonate it in such a key location at a key time suggests a more organised effort. For that reason the suggestion of a so-called “lone wolf” attacker is pretty much ruled out in this attack.

At the very least, the bomber would most likely have had help either in person or electronically through messaging apps or online forums.

There are simple bombs and there are sophisticated bombs but, as Explosive Ordnance Disposal (EOD) experts will attest, it does always require a certain level of technical ability that either requires a degree of training or practice or some sort of technical skills.

In the case of Manchester, most likely some kind of reconnaissance was also undertaken prior to the attack.

The first thing investigators will be looking to establish is the nature of the bomb residue. Terror groups tend to have what’s known as an “explosive signature”. On the face of it, the Manchester bomb bears a strong similarity to that used by seven of the eight attackers in the Paris bomb attacks of November 2015. Those bombers detonated shrapnel-packed vests designed for causing the maximum number of casualties while committing suicide.

The key ingredient in these bombs was a compound called triacetone triperoxide, or TATP, a crystalline powder that is easy to make and hard to detect, but is also incredibly unstable.

In fact, all it takes is a firm blow to explode TATP with a force that’s about 80 per cent as strong as TNT. The higher the volume of TATP, the more volatile it becomes. Jihadist terrorists who make it have dubbed it “the Mother of Satan”.

One reason TATP is difficult to detect is because it is peroxide-based and does not contain nitrogen, a key component of homemade “fertilizer” bombs that security scanners are now very good at finding. This is why there has been so much concern lately over taking laptops aboard aircraft as TATP can easily be placed inside such devices.

Since 2014, Daesh has used TATP in Europe. While no claim of responsibility has been made, the Manchester attack also fits with past targeting patterns of Daesh.

Concert venues and clubs targeted previously include the attack on the Bataclan concert hall in Paris in November 2015 which killed 89 people, and the attack on the Pulse nightclub in Orlando, Florida, in June last year, which killed 49 people.

It should be stressed, however, that al-Qaeda has also used such devices and there has been much speculation that the group, which has been overshadowed of late by Daesh, has been making a comeback and has always shown a capacity for more elaborate strikes.

As ever, Daesh-linked websites showed lots of activity in the wake of the Manchester attack, but this is to be expected. Daesh central media, on the other hand, according to security experts, were effectively dormant from 9.30pm on Monday night. These factors are significant, because it important to remember there is a difference between official Daesh channels and unofficial ones. It is on official channels that claims are posted. Beyond these there are hundreds of unofficial pro-Daesh channels and forums.

Later yesterday Daesh finally released a bulletin in multiple languages that called the attacker “a soldier of the Caliphate”, their term for their fighters. The translated bulletin read: “He (the bomber) detonated the devices in an arena for a profligate concert … what is coming is tougher and worse for the worshippers of the cross and their helpers.”

The bulletin said the bombing was retaliation for “transgressions against the homes of Muslims”.

What’s key here is what is not mentioned. Daesh says explosive devices (plural) were placed at the venue. The bulletin made no mention of martyrdom of the attacker. For a group that glorifies the death of its own and proudly proclaims it, this is unusual and has led some security analysts on jihadist- inspired terror to believe this could mean the attacker was not one of theirs.

Daesh social media accounts also circulated a suspicious video of the alleged perpetrator of the bombing.

For now it appears the Manchester suicide bomber who demonstrated a deadly competence most likely was part of a terror cell already known to MI5.

GCHQ will now be looking for a digital trail and, if necessary, MI6 will speak to foreign partners to build a picture of who this man was and whom he knew. They will check whether the bomber might have been remotely “directed” by a centralised body, for example, Daesh leadership in the Syrian city of Raqqa, or whether it was indeed orchestrated closer to home.

Already one man has been arrested in South Manchester in connection with the attack which would suggest the security services have some very solid leads to follow.