The suicide bomber who killed 22 people at the Manchester Arena on Monday (May 22) was exploiting a security vulnerability or soft spot that allowed him to walk into a crowd unchecked and detonate his device.

Concert-goers have said that security at the stadium was lax as many of them did not have their bags checked.

But it's unlikely that bag checks would have stopped the attacker, 22-year-old Salman Abedi, who detonated his bomb in a foyer just outside the venue's doors.

The space that links the Arena to the nearby Victoria rail station is a grey area, as far as security is concerned.

SMG, the company that manages the Arena, said that it is not responsible for policing that space.

Parents had gathered there and were waiting to pick up their children, and people were streaming through the area to get home after the concert, when the blast ripped through the foyer of the 21,000-seat Manchester Arena at about 10.30pm on Monday.

Abedi used an improvised explosive device, apparently packed with metal, to massacre concert-goers and end his own life.

Citing CCTV footage recovered by detectives, Abedi had placed the device in a suitcase which he set on the ground before it blew up, The Financial Times said.

"It was within the walkway between the stadium and the station.. this would have been an area with a high footfall with people leaving the stadium..," Security expert Will Geddes was quoted as saying by The Daily Mail.

"People are at their most vulnerable when they are either leaving or arriving at a venue," he said.

US news site The Daily Beast also reported that Abedi did try to get into the concert area and that he was stopped by a security guard. The report cited a senior official at the US Department of Homeland Security.

However, security measures also seemed to be lacking during the concert, according to many British reports.

Two men who were at the concert said their bags were not checked, The Metro reported.

Several other witnesses said they were waved through without any checks, the paper said.

Children were among the 22 killed and at least 59 people were wounded and taken to eight hospitals in the city, some with life-threatening injuries.

While ISIS has claimed the attack, it is unclear if it was directed by the terrorist organisation or just inspired by it.

That the perpetrator had put together or was in possession of a working bomb indicated greater sophistication than recent attacks that involved cars or knives, Mr Raffaello Pantucci, director of International Security Studies at the Royal United Services Institute, told CNBC.

Steven A. Adelman, the vice president of the Event Safety Alliance, a trade group, likened the attack to the Boston Marathon bombing.

"It's less like the Bataclan than it is the Boston Marathon bombing, which also took place on a public street, surrounded by law enforcement," Mr Adelman told The New York Times, referring to the Paris attacks of November 2015, when gunmen entered the Bataclan theater during a performance and killed 90 people.

Security consultant Michael Downing, a former deputy chief of the Los Angeles Police Department said entertainment venues have become standard "soft targets" for terrorists.

"This is something we've been anticipating, something we've seen in the electronic magazines of Al-Qaeda and ISIS," Mr Downing said. "They encourage attacks on stadiums and arenas, malls, transportation hubs."