In the days after Sunday night’s terrorist attack at Bondi Beach, a familiar pattern has emerged. Shock gives way to grief. Grief turns into questions. And questions, inevitably, become accusations. How did this happen? Who failed? Who didn’t do their job?

Because this was a terrorist attack, the blowtorch has now been turned on Australia’s police and intelligence agencies. That scrutiny is understandable. Scrutiny is also necessary in a liberal democracy. But it must be informed by some uncomfortable truths about how intelligence, policing and risk actually work.

The first truth is the nature of intelligence itself. Intelligence isn’t a crystal ball. It’s more like being handed four or five pieces of a jigsaw puzzle, at best, without the picture on the box, without knowing how many pieces exist, and being asked to describe the full image. Analysts must make judgements based on fragmentary information, uncertainty and probability. After an attack, when the picture is suddenly complete, everything looks obvious. Beforehand, it rarely is.

That isn’t an excuse. It’s a reality. Intelligence is an estimative discipline, not a forensic one. It deals in likelihoods, not certainties. Demanding perfect prediction is to demand the impossible.

The second truth is that Australia’s police and intelligence agencies have, over the past 25 years, enjoyed extraordinary success. Since 9/11, Australia has disrupted dozens of terrorist plots and prevented mass-casualty attacks. We’ve suffered tragedy, but not on the scale seen in parts of Europe, nor with the grim regularity experienced in North America. Quietly and consistently, Australian agencies have performed at a level that’s the envy of partners in Britain, France, Germany, Canada and elsewhere.

Success, however, has consequences. Because Australians don’t routinely experience terrorism, many no longer feel it as a threat. It fades into abstraction, something that happens overseas, not at home.

That perception is increasingly divorced from reality. The Taliban are back in control of Afghanistan. Al-Qaeda and Islamic State have re-established their space and freedom of movement. Islamic State remains active from Libya to Syria and across parts of Africa. In Southeast Asia, too, such groups continue to operate—for example, Abu Sayyaf in the southern Philippines and East Malaysia. At home, Australia faces a diverse array of violent extremism: some Islamic-inspired, others right-wing extremists, white nationalists, anti-authority movements, antisemitic networks and ideologically motivated lone actors.

All of this is occurring against the backdrop of the most strategically uncertain period since at least the 1930s. Great-power competition, foreign interference, cyber operations, climate-driven instability, conflict in Ukraine and Gaza, and social polarisation are interacting in ways that amplify risk. Terrorism doesn’t exist in isolation; it feeds off this wider volatility.

From more than three decades working alongside Australia’s national security community, I know this much: police and intelligence agencies are relentlessly focused on protecting the public. But they must prioritise. They cannot be everywhere, watching everyone, all the time. Governments can always spend more on security, but every additional dollar comes at the expense of health, education or social services. Those trade-offs are political decisions, not operational failures.

There’s another constraint that matters as much. Australia is a liberal democracy. Our agencies are responsible for investigating terrorism and politically motivated violence, not policing thought. Planning or carrying out terrorist violence is illegal; holding extremist views isn’t. I despise those views, but I value deeply the freedom that allows them to exist without the state becoming omnipresent and coercive.

For more than a year, ASIO Director-General Mike Burgess has assessed the terrorism threat as ‘probable’. He was criticised by some for overstatement. Yet the threat was probable on Sunday afternoon, and it remains probable today. That assessment was not alarmism; it was realism.

There’ll be hard questions to answer.

In issuing a gun license, did the NSW police properly use firearms-registry information about links between the applicant and any household member with extremist affiliations?

Should the offenders’ travel to the Philippines have triggered reassessment of the offender with the firearm licence and the threat that the two men posed, and was that information visible to and acted upon by relevant authorities? This goes to whether travel intelligence, risk indicators and licensing frameworks were sufficiently integrated to reassess ‘fit and proper person’ status for license holders and ensure that access to firearms remained appropriately constrained as risk profiles evolved.

Those questions must be answered, but calmly and based on evidence.

And we need to wait. We need to establish who knew what and when.

Australia’s response must now move beyond reactive blame to systemic accountability. The Bondi attack has exposed potential weaknesses in how information flows between intelligence agencies, state police, and administrative systems such as firearms registries. A Royal Commission could examine not just what went wrong in this case but how our fragmented risk frameworks can be integrated to prevent similar failures in an era where ideology, technology, and access to weapons are increasingly intertwined.

Above all, we need to remember that for Australia’s police and intelligence officers this attack has landed as a hammer blow. And tomorrow, and the day after, they’ll return to work confronting an enduring threat, on behalf of all of us.

This article was originally published in the Australian Financial Review.