What do you do about the ones who quietly slip back into the shadows? Who have previously been on the radar of police or intelligence agencies or so-called "watchlists" but then drop off, perhaps returning to a former life of petty crime or drugs, or who simply lie in wait until they are no longer deemed a threat?
And then, seemingly out of the blue, they strike. Just like the London Bridge attackers struck on the weekend, as 29-year old Yacqub Khayre struck in Melbourne's Brighton on Monday, and as gunman Man Haron Monis struck in the Lindt cafe in Sydney two-and-a-half years ago.
The carnage differs only in scale. But the trail of suffering is achingly familiar: bereaved families, traumatised survivors, a legacy of nightmares for first responders whose job it is to tend to the dying and wounded. And in each case, these men (including at least two out of the three British attackers) had been flagged at some stage to authorities.
The recriminations started to flow almost immediately this week when it emerged that Khayre had been on parole for unrelated offences when he committed Australia's latest Islamist-inspired terrorist attack, taking a woman hostage, killing receptionist Kai Hao and wounding several police officers in the Brighton shootout.
Eight years earlier, he had escaped conviction on terrorism charges for his alleged role in a 2009 plot to kill soldiers based at Holsworthy barracks outside Sydney. And in the months leading up to the Brighton attack, he had been part of a state government-run deradicalisation program.
It didn't take long for the finger-pointing to start. Prime Minister Malcolm Turnbull demanded to know why someone with Khayre's history hadn't been locked behind bars until his full sentence was up. Victorian Premier Daniel Andrews shot back, saying if federal agencies were so sure about how to identify a potential terrorist, then perhaps they should be taking part in parole decisions. Caught in the crossfire were the Victorian parole board and the Australian Federal Police, as the issue reverberated through to Friday's meeting in Tasmania of COAG, the nation's summit of political leaders. Turnbull has since announced there will be a further special COAG meeting on national security as early as practicable, and Andrews told his counterparts that "the community will take a dim view of each of us if [after that] we don't have a detailed list of concrete commonplace steps to keep every Australian safe."
NSW Premier Gladys Berejiklian had already put herself ahead of the pack by announcing a suite of new anti-terrorism measures in response to recommendations made by state coroner Michael Barnes in his searing report last month on the Lindt siege.
Flanked by her stern-faced new police commissioner Mick Fuller, NSW Police Minister Troy Grant and Counter-Terrorism Minister David Elliott, Berejiklian said NSW would legislate within a fortnight to strengthen the legal foundation for police to pre-emptively unleash "lethal force" against terror-motivated attackers.
Long-arms would be put into the hands of the riot squad in addition to the high-powered weapons already used by tactical police. And anyone in jail who showed extremist links could effectively kiss goodbye to parole, regardless of whether their original offence had been terrorism-related or not.
Her government's laws would not only be the "strongest in the land" but "potentially some of the strongest in the world" she declared on Thursday. Shortly afterwards, federal Attorney-General George Brandis chimed in with Canberra's response to the Lindt report, saying the Turnbull government too would accept every recommendation which applied to the federal sphere, including reviewing when the Australian Defence Force could be called out to assist police in terrorism events.
NSW Police chief Fuller has promised his officers will use their new powers "sparingly". They had learnt the lesson that "people will lose their lives if they don't act quickly".
But he also made a key admission at Thursday's press conference: "At the end of the day, I can't stop every crime." Specialist officers would double-down on prevention efforts, establishing a strategic intelligence hub and accelerating the work of the new "Fixated Persons Unit", designed to work with people who may not be on ASIO's radar but who are showing signs of concerning behaviour to friends, acquaintances or family. (Lindt gunman Man Haron Monis is a textbook example.)
"My biggest concern is that after an attack someone always knows," Fuller said. "I really need to reach in and give those people confidence about police and other agencies so we can prevent these attacks from happening."
It's an anxiety shared by NSW Counter Terrorism Minister David Elliott. "What concerns me is that in most of the case studies in the last three years, offenders have been known to authorities but have been at the lower end of the list of parties of interest," he tells Fairfax Media.
Part of the solution could be greater engagement with the private sector to help pick up warning signals, he suggests. In the case of the March Westminster Bridge attack, the perpetrator had hired a car for a week that was not returned, and had bought "two very large carving knives".
"The government can only monitor so much," Elliott says. "It's quite clear we're probably going to have to expand the net when it comes to monitoring by the private sector."
The scale of the challenge is daunting. As Islamic State collapses militarily in Syria and Iraq, its online networks are ratcheting up calls to followers in the West and elsewhere to launch opportunistic attacks wherever they can. Andrew Zammit, a Melbourne-based counter-terrorism researcher, says Australia has faced an "unprecedented" series of terror attempts since September 2014,when since-deceased IS spokesman Mohammad al-Adnani issued a global "call to arms". In addition to the five attacks that have succeeded, 12 more plots had been disrupted.
The most serious was planned for Melbourne's popular Federation Square precinct just before Christmas. Brandis says that plan could have meant mass casualties and "had been prepared with a high level of sophistication".
Despite much talk of watchlists this week, ASIO insists it does not keep "watchlists as such." It says "the intelligence agencies use a range of systems to prioritise and review their caseload in relation to counter terrorism investigations - not a single 'watchlist'."
But it has more than 400 priority counter terrorism investigations currently active - the vast majority, sources say, centred in the two largest states. In NSW, police say there have been more than 80 terrorism arrests since December 2014.
"The thing most people in police and security agencies fear is what we call 'going dark'," says Nick O'Brien, a former counter-terrorism chief at New Scotland Yard. "Since the Snowden revelations, more and more people are using encrypting technology which is of great concern to the security world."
Nor is there an end in sight to that challenge, says O'Brien, now an academic at Charles Sturt University. The companies are based overseas and, if one is shut down today, another will spring up tomorrow. That's forcing police back to old-school human intelligence gathering, an incredibly resource-intensive task, he says.
Brandis flagged this week that he will be putting the challenges of encrypted messaging high on the agenda of a meeting of his counterparts from the "five eyes" intelligence partners (Australia, US, Canada, UK and New Zealand) later this month.
"There does need to be a level of co-operation from the carriage service providers and the telcos, from Facebook and Google and so on," he told Sky News on Wednesday. "There is a corporate social responsibility issue here."
But O'Brien says creators of encryption apps are reluctant to co-operate with authorities for fear of undermining the secure product they spruik to users. The creators of Telegram, the heavily-encrypted app of choice for Islamic State and its supporters, maintain that they shut down 70 IS channels a day but have point-blank refused to give so-called "backdoor" access to authorities.
David Wells, a former Australian intelligence officer now working privately in the UK, says criticisms in the wake of the most recent British attacks that some radicalised individuals are falling through the cracks are unfair. In Europe investigators face a near-impossible task keeping watch on potentially thousands of suspects.
"People's path towards violent action is usually a long one but the ultimate decision might be just a switch that has flicked, it might be made quite quickly," Wells says. Investigators will "triage" leads based on signs of growing terrorist intent and capability. "But if a potential target is tailed for three months and there is no obvious sign of attack planning, they could well drop off the list ... The biggest challenge is you have to look at someone and you have to look at them at the right time."
There is no easy answer to spotting the outliers who might suddenly turn violent. "With the sort of attacks we're seeing now, it just isn't possible to protect at the level that probably the public would want, which is a 100 per cent success rate," Wells warns. "That doesn't mean we're going to see this every month for the next two years but it means there's only so much that intelligence can do in the current climate and it's doing a lot."
Thus far, police appear to believe Australia is still better placed than Europe in terms of the terrorism threat. But ASIO boss Duncan Lewis says foreign fighters returning from the IS battlefield will pose a challenge, not just here, but for our near neighbours as well. The Bali bombings remain a searing memory. "Australians are at risk of being caught up in terrorist attacks overseas, including, particularly, those in South-East Asia," Lewis warned a Senate committee last month.
Intervention programs to try and turn those most susceptible to extremist indoctrination are being trialled by federal and state governments, particularly in the eastern states, though with mixed results.
Low-profile, manpower-intensive programs strongly rooted in local Islamic communities seem to offer the best chance of success.
In NSW, for instance, the state Corrective Services department and the Australian National Imams Council have begun a program of sending respected imams to Friday prayers at correctional centres.
Federal Counter-Terrorism minister Michael Keenan says Canberra is investing more than $45 million in Countering Violent Extremism (CVE) programs over four years.
But some experts like the Australian National University's Dr Clarke Jones, say top-down government programs are having a low "buy-in" rate from disaffected youth.
"The government can design programs till the cows come home but it they do not make any sense on the ground ... if they don't take into account different cultural backgrounds or religious beliefs, there is not much efficacy to those programs," he says. "These things take time, and building relationships takes time. Much more has to be done in consultation with communities," but without feeding a superficial "dash for CVE cash".
Labor MP Anne Aly, a former counter-terrorism researcher at Edith Cowan University, recalls taking under her wing a young Somali-Australian who, when his family life started breaking down, had fallen under the influence of extremist Islamic preacher Junaid Thorne.
Seeing the boy had too much idle time, she offered him a job working for her two days a week researching the lives of terrorists. "After two weeks he came to me with tears in his eyes." says Aly. "He said 'I don't want to do that project any more ... because they all died.' I said 'For what?'. He said, 'They died for nothing'."
With her help he is now in the second year of an engineering degree.
"It's intensive work," she says, "and it has to be done one-on-one. But without that help he may well have gone down a violent path. The problem with government programs is that they come in too late. The only referral system is through law enforcement and by that stage it's too late."
Keysar Trad is a Muslim community leader who was involved in NSW government consultation on combating radicalisation in the wake of the shooting of police staffer Curtis Cheng in Sydney in 2015.
Trad warns that the impact of anti-Muslim rhetoric in Australia can't be underestimated. "We're placed on the back foot in trying to win over some of the more disenfranchised elements ..."
Referring to the storm that followed his appearance on Andrew Bolt's TV show, where he struggled to explain a Koranic verse about chastising women, he said: "If someone like me, with all the work I've done for years to build bridges, can be painted as radical, then what hope is there for the rest of the community?"
It's an important message - one that struggles to break through the rising drumbeat of anxiety fuelled by the latest wave of jihadist attacks, which have taken place not just in Berlin, Paris, Brussels and Nice, but in Tehran, Kabul, Iraq, and Istanbul.
Brandis told a Senate committee last month: "This is not something that is the work of a day or a week or a month of a year; this is a problem that will be with us for the forseeable future."
Lewis put it even more eloquently: "This is not the end and it is not the beginning of the end; it is more like the end of the beginning. We do not see this finishing any time soon."
