Six days after Salman Abedi killed 22 people attending an Ariana Grande concert
at Manchester Arena, authorities have searched several apartments in an investigation that extends to Libya, where his relatives live.
They also have published CCTV images of Abedi on the night of the attack, which show him wearing a hat, glasses and a dark top.
On Monday, police arrested a 23-year-old man in Shoreham-by-Sea in Sussex, south of London, "on suspicion of offenses contrary to the Terrorism Act," according to a statement.
The investigation into Abedi, who was known to security agencies and had just returned from Libya before the bombing, has so far led to the detention of 14 people. Two other people were arrested and released, authorities said.
On Sunday, police arrested a 19-year-old man in Gorton and a 25-year-old man in the Old Trafford area of Manchester on suspicion of terror offenses.
In an interview with the BBC on Sunday, Rudd acknowledged some members of Abedi's network could still be free.
"The intelligence services are still collecting information about (Abedi) and about the people around him," Rudd said.
"But I would not rush to conclusions ... that they have somehow missed something.
"What this reminds us is the scale of the problem that we have, the enemy that we have, Daesh, that is trying to weaponize the young people in our society."
Daesh is another name for ISIS, the terror group that claimed responsibility for the attack.
Terror threat reduced
Rudd's statement comes the day after Britain reduced its terror threat to "severe" from "critical"
following a meeting between British Prime Minister Theresa May and security chiefs.
The decision to lower the threat rating from its highest level was made by the country's Joint Terrorism Analysis Centre in light of the arrests made in the Manchester attack investigation, May said. The level had been raised to "critical" after Monday's deadly bombing.
It means that soldiers deployed to bolster security will stand down on Monday night as an attack is no longer considered imminent.
At least 17 raids have been carried out across the country
since Monday's attack, according to Assistant Commissioner Mark Rowley, Britain's senior police officer for counterterrorism .
There are also concerns that other British citizens who have returned from fighting for ISIS or other extremist groups in the Middle East could pose a threat, with Rudd unable to provide a figure on how many may have returned to the country.
Manchester-born Abedi likely received some ISIS training in Syria
in the months before the attack, according to information gathered in the preliminary investigation, a US official told CNN on Thursday.
Abedi spent time in Libya before the attack and traveled through Istanbul and Dusseldorf airports on his way back to Britain.
"What we do know, in engaging with the intelligence services and with the police and with the Border Force, we make sure that they have the tools to track them and to keep them out where we can," Rudd said of those who may be aiming to return to Britain.
Rudd also said the British government was making "good progression" with online companies whose tools are used for secure messaging by terrorists, such as Whatsapp.
"What we are doing is challenging the people who are delivering end-to-end encryption to work with us so that we have a way of keeping people safe," she said.
"Nobody wants terrorists to have a safe place to exchange information and to be able to plot their terrible atrocities.
"I believe we can get them to be more successful in working with us to find a way of getting some of that information."
British authorities say they have disrupted five plots since March 22, when a terror attack outside Parliament in London left five people dead.
On Friday, UK Security Minister Ben Wallace told CNN in Manchester
that there are "over 400 investigations currently ongoing by the security services and police into terrorist planning or people thinking about terrorist planning."
Police know where bomb was made
Meanwhile, police believe they have made a significant breakthrough in their investigation.
On Saturday, police said they had identified the location where they believe Abedi assembled the bomb used in the attack.
In a statement, police said: "The investigation is making good progress and we know one of the last places Abedi went was a city center flat and from there he left to make his way to the Manchester Arena. The flat is highly relevant as a location which we believe may be the final assembly place for the device."
Police said they are working "around-the-clock" with more than 1,000 people involved in the investigation, pursuing more than 1,500 "actions."
"In the past five days we have gathered significant information about Abedi, his associates, his finances, the places he had been, how the device was built and the wider conspiracy," the police statement said.