Sri Lanka’s president has vowed to overhaul state security after several bomb blasts on Sunday killed 321 people and wounded 500.
Late on Tuesday, Maithripala Sirisena announced changes to the heads of defence forces “within 24 hours”.
He said threat reports had not been shared with him, and promised to take “stern action” against officials.
The country’s Prime Minister Ranil Wickremesinghe said the Islamic State (IS) group may be linked to the blasts.
He added that the government believed Sunday’s attacks could not have been carried out without help from terror groups abroad.
IS claimed the attack on Tuesday, although did not provide evidence.
In a televised address late on Tuesday President Sirisena said he would completely restructure the police and security forces in coming weeks.
“The security officials who got the intelligence report from a foreign nation did not share it with me. I have decided to take stern action against these officials.”
The BBC World Service’s South Asia Editor Ethirajan Anbarasan said it was an embarrassing admission by President Sirisena that security officials did not share with him the intelligence report warning about the attacks.
With IS claiming responsibility for the attacks, Sri Lanka is now entering uncharted territory, our correspondent explains.
Authorities say they are looking into possible links between the local Muslim youths who carried out the suicide bombings and the global jihadist group.
Sri Lanka’s government has blamed the blasts on local Islamist group National Thowheed Jamath (NTJ).
Media captionThe footage shows a man wearing a large backpack calmly walking towards St Sebastian’s church
But Mr Wickremesinghe said the attacks “could not have been done just locally”.
“There had been training given and a coordination which we are not seeing earlier,” he said.
Police have now detained 40 suspects in connection with the attack, all of whom were Sri Lankan nationals. A state of emergency remains in effect to prevent further attacks.
The nearly simultaneous attacks targeted three churches packed for Easter services and three major hotels in the capital, Colombo.
An attack on a fourth hotel on Sunday was foiled, Mr Wickremesinghe said. He also warned that further militants and explosives could still be “out there” following the attack.
Who could be behind the attacks?
IS said it had “targeted nationals of the crusader alliance [anti-IS US-led coalition] and Christians in Sri Lanka” via its Amaq news outlet.
It provided no evidence for the claim but shared an image on social media of eight men purported to be behind the attack.
The group’s last territory fell in March but even then experts had warned it does not mean the end of IS or its ideology.