The fatal attack on beloved Melbourne identity Sisto Malaspina in Bourke Street three years ago was a premeditated act of terrorism.
Victorian State Coroner John Cain has handed down his findings into the horrifying 19-second attack by Hassan Khalif Shire Ali in November 2018, finding it was motivated by his adherence to Islamic extremism and ISIS.
While opportunities to prevent the attack may have been missed, Judge Cain was unable to conclude Shire Ali's trajectory could have been averted if intelligence gaps had been filled, threat assessments were different or he had not been bailed weeks earlier.
Mr Malaspina, the co-owner of Pellegrini's Espresso Bar, was one of three people stabbed in a frenzied attack by Shire Ali who was regarded as a low risk national security person of interest.
The horror began just after 4pm on November 9 when Shire Ali set fire to gas tanks in his car.
Bystander Rod Patterson believed he was running to help the driver when he was blindsided by Shire Ali and stabbed with a 22cm hunting knife.
Shire Ali then overpowered Mr Malaspina, stabbing him twice, before chasing down security guard Shadi and stabbing him.
He turned then on police, who tried first to disarm him with their batons before one fired his weapon.
Shire Ali later died in hospital.
Judge Cain found Shire Ali's actions constituted a premeditated act of terrorism and an ISIS-inspired attack.
While his actions were intended to intimidate and harm, the actions of civilian and on and off duty police demonstrated the opposite.
"These individuals acted with great courage and scant regard for the consequences to themselves in service to the Victorian community," the coroner said, praising their selfless actions.
He also found police use of lethal force was justified in the circumstances.
The first officers on scene believed they were responding to a car fire but were confronted with an armed and determined assailant.
The coroner commended their presence of mind, restraint and effective collaboration in a volatile and dangerous situation, noting one of the officers had graduated from the police academy five months earlier.
Shire Ali's criminal behaviour had escalated in the lead-up to the attack. There were allegations he assaulted a person with a hammer, took to a car with a sledgehammer and was involved in a hid-run.
On October 12, 2018 Shire Ali was pulled over by police. He had five warrants outstanding and was bailed in a move Judge Cain described as reasonable and appropriate.
The coroner found the absence of intelligence indicating Shire Ali was sympathetic toward Islamic extremism wasn't indicative that he no longer held those views, but it was regarded that way anyway.
The decision to manage Shire Ali as a low risk national security person of interest was premature given gaps in intelligence, he found.
He also said while there was insufficient evidence of mental illness it was not possible to rule out the possibility Shire Ali had a psychiatric illness at the time of his attack.
He recommended Victoria Police review and amend policy relating to national security person of interest warning flags, including around how notes might be tailored to address intelligence gaps.
The development and implementation of a review to identify opportunities for national security intelligence collation, analysis, assessment and management after an attempted or actual terrorist incident was also recommended, along with consideration of a joint review process with intelligence partners.
Victoria Police Commissioner Shane Patton said an independent review into information sharing with partner agencies had already taken the force "a long way further forward" but they would consider what else from the coroner's findings to take on board.
He said the commendation of officers at the scene was a tribute to their training, courage and discipline, and was recognition of the risk officers put themselves in.