For the thirteenth time in three years, Australian counter-terrorism authorities have stopped a mass-casualty terrorist attack from occurring.

The frequency of these raids means that Saturday’s news wasn’t surprising — indeed, it was only in June that Sydney last experienced counter-terrorism raids. What is causing concern is the government’s advice that this plot ­involved an explosives attack ­targeting aviation, and that the group had the capability to ­construct some form of improvised explosive device, and that authorities assessed the threat as so serious that they intervened only three days after learning of the attack planning.

Saturday’s disruption by the NSW Joint Counter Terrorism Team — a joint agency team comprising the Australian Federal Police, Australian Security Intelligence Organisation and the NSW Police saw four men arrested and properties searched in inner-city Surry Hills and Lakemba, Punchbowl and Wiley Park in the city’s west. AFP Commissioner Andrew Colvin described the plot as ­“elaborate”, and authorities at Sydney airport immediately bolstered security.

With the Westminster, Manchester Arena and London Bridge attacks in Britain still fresh in our minds, are we seeing a new, more complex and deadly terrorist threat to Australia?

To work through this, it’s ­crucial to look not just at what’s happening in Australia but also the global threat environment. And just as significantly, to look at how Australia is responding to this threat. After all, despite the threat uncovered through this operation, the weekend raids are a counter-terrorism success.

Almost three years ago, in ­August 2014, the government took the unprecedented step of raising the national terrorism threat alert level to “probable”, meaning a terrorist attack is likely, where it has since remained. The change came about following advice from ASIO on two factors: first, that Australia was being targeted by terrorists, specifically Islamist extremists such as Islamic State (ISIS) and ­al-Qa’ida and their followers; and second, that there was the capability to undertake attacks. The type of attack, as we have seen since, could range from low-level, single-actor attacks such as the five seen to date in Australia, or more sophisticated and complex attacks, such as the one disrupted on the weekend.

So what has been happening is what the intelligence agencies have assessed: individuals and groups seeking to do what they can to mount attacks.

But it’s only since December last year that we’ve seen demonstrated capability accompanying the intent for major mass-casualty attacks. The Christmas Day plot in Melbourne — successfully disrupted by the Victorian JCTT — was described by AFP and ASIO heads as the most concerning they’d seen to date. The group had intended to use bladed weapons, IEDs and firearms to attack multiple locations in the CBD. Authorities were alert to it about three weeks before, disrupting only when the balance was right between obtaining sufficient evidence to prosecute and ensuring the public would be protected from the planned attack. At the time, authorities described it as the most complex and concerning plot to date, particularly because materials to build IEDs were found. The disruption occurred just a month after ISIS released a video showing footage of Melbourne airport — including planes — and CBD landmarks, along with a call to mount attacks.

This video indicated a dramatic change in the way ISIS presented itself to followers, calling primarily for attacks “at home” rather than calling for followers to migrate or make “hijrah” to the so-called “caliphate”, and also in the way ISIS presented itself, with grainy and amateurish footage of urban and desert guerilla fighting, rather than its more polished representations of glorified warriors in its ­established “state”. This was a ­direct result of the substantial loss of ISIS territory, and the commencement of the Mosul offensive — which has now, eight months later, been completed, with the Iraqi government officially declaring victory over ISIS.

This has profound repercussions beyond the Middle East. As ISIS has lost its caliphate project in Iraq, and likely soon also in Syria, it is moving its focus beyond. Groups and individuals, emboldened and inspired by the recent developments of Islamist extremism, are taking the opportunities to access financial support, technical advice and notoriety from association with ISIS. We have seen this in North Africa, and are also now seeing the ramifications for the Southeast Asian region, including foreign fighters recently and dramatically appearing on the scene in Marawi in The Philippines.

British authorities have said the recent Manchester Arena bombing attacker, Salman Ramadan Abedi, obtained his technical training and instruction from an ISIS affiliate in Libya.

What this means for Australia’s most recent attack plot is that there is a global and disbursed support group available for those who wish to carry out an attack. While a complex attack such as this one is difficult to pull off, Islamist terrorist groups are continuing to focus on conducting high-profile and mass-casualty attacks in order to keep their movement alive.

In March, the US imposed a ban on laptops being on flights travelling from certain destinations. This was soon followed by a similar ban by Britain, and in May Malcolm Turnbull advised that Australia was considering doing the same. At the time, the advice was that this was based on credible intelligence that Islamist extremist groups were trying to use laptops to carry IEDs on planes; the ban tells us that intelligence agencies assessed it credible that these groups could get the explosives on to planes without detection.

This most recent plot puts a name and a place to the type of threat being described at that time. What we know so far is that the group was assessed to have the capability and materials to develop such a device, and were planning to evade security screening at Sydney airport. Authorities have been careful to note, however, that they cannot confirm whether such an explosive could have been­ successfully deployed.

Despite the significance of this threat, however, there are many positive outcomes. The first, as noted, is that the planned attack was stopped. Another is that our airports and airlines, as well as the police and Australian Border Force units who operate at the airports, have well established and practised security arrangements, and are not only alert to the threat but able to swiftly boost security provisions when needed — as seen at the weekend. Another success story is the co-operation and collaboration of the state and federal agencies, notably through the JCTTs, which are longstanding and working well. And the information leading to this disruption may well have come from our communities in western Sydney, who have so often provided the leads necessary to protect the broader community from attack.

Challenges, however, remain. Almost all recent terrorist activity in Australia has involved the use of encrypted communications. Based on past experience, and the complex nature of this current plot, it is highly likely that forensic examination will reveal heavy use of freely and easily available encrypted voice and video communication to bring the cell and their overseas contacts together, with law enforcement and security intelligence agencies unable to easily capture the communications. The recent debate on this issue in Australia and abroad has rightly raised the issue of privacy being balanced with security but the ease with which terrorists can ­access and use this technology to facilitate crimes must stop.

The threat of mass casualty ­attacks also remains. Our airports and other critical infrastructure have a long and strong history of collaborating with counter-terrorism agencies to prevent and ­respond to terrorist acts. But ­recent terrorist attacks on pedestrians in Nice, Stockholm and London — and non-terrorist attacks such as that on Melbourne’s Bourke Street Mall in January — tell us that more must be done to understand how to best protect ­exposed areas that have also been highlighted as targets by terrorist groups.

The federal government’s work to develop a national strategy to protect places of mass gathering from terrorism — including a risk-assessment tool — is a crucial measure in this regard, but businesses, local government and the broader community must also be aware and get involved.

And once again, this incident reminds us that our counter-terrorism agencies and our broader police and security elements are stretched as never before. The speed of action in the Sydney case reflects the capability and professionalism of these organisations but also the large workload. Authorities advise they are investigating more than 400 cases — more than double the number of three years ago. This makes it even more challenging to be alert to new and developing threats.

The creation of a Home Affairs portfolio and reshaping of the ­national intelligence community — as a result of the third Independent Intelligence Review — ­announced two weeks ago, are key steps in this regard. These should provide, in complementary ways, the capacity for a strategic overview and management of counter-terrorism and broader security and intelligence, including the vital need to plan appropriately for future capability and legislative development.

The Sydney raids confirm that Australia’s terrorist threat level is real and appropriate. We should be alert and prepared for a mass-casualty attack to occur. But the complexities involved with such attacks continue to mean they are more likely to be disrupted than the low-profile attacks of a lone actor. And the lone actor attack still remains the most likely form.

Even with the demise of Islamic State in the Middle East, this form of extremism will continue for the foreseeable future.

We all — ­governments, business, communities — must focus on how best to mitigate against this.