As bad as it was, the death toll from the May 2017 Manchester, England, bombing that killed 22 people and injured hundreds — many of them children — could have been much higher.

The suicide bomber detonated a homemade bomb as people were leaving the Manchester arena following a concert by Ariana Grande.

But “as horrifying as that incident was,” it could “have been far worse had that person been able to get into that event,” said Joe Finnegan, customer group president at Morristown, New Jersey-based ProSight Specialty Insurance, a unit of ProSight Global Inc., who specializes in film and live media.

Since the event, which involved a single attacker, insurers have been working hard to understand and underwrite a risk that has no common pattern and can happen with no warning, experts say.

“At what point are we safe, and at what point is the vendor or a promoter responsible?” asked Cari Hernandez, Los Angeles-based senior vice president for entertainment and hospitality at JLT Specialty USA, a unit of Jardine Lloyd Thompson Group P.L.C.

After that incident, major event companies began conducting security and impact analyses within a 2- to 3-mile radius around an event, she said.

Manchester is a “pretty good example of how we’ve evolved in this space,” said Mr. Finnegan. “There was a time when the general public could get relatively close in a live event.” Now, though, good risk and safety management has “pushed that perimeter out.”

Referring to Manchester, Christian Phillips, Philadelphia-based contingency focus group leader for specialty insurer Beazley P.L.C. said that as an insurer, Beazley assesses the risk regardless of the possible nature of the attack.

“It’s very difficult to know where the next one’s going to be. There’s no common pattern. These things just spring up all over the place. The only thing you can do is be diligent as to where the event is, what security is and just underwrite the risk,” whether it is similar to Las Vegas or Manchester, Mr. Phillips said.