PARIS—The prime suspect in the Berlin truck attack arrived in Europe five years ago, at the leading edge of a wave of nearly uncontrolled immigration. That influx, culminating in the 2015 mass arrival of refugees, has exposed the region to security threats that will linger far into the future.

The path of the suspect—a 24-year-old Tunisian named Anis Amri who served jail time in Italy, then was detained briefly and released in Germany—has laid bare multiple failings in Europe’s security apparatus, including poor cooperation between national governments, porous borders and lack of biometric data to identify people who use false identities.

Compounding those problems, the rise of Islamic State and Germany’s decision to throw open the door to refugees last year has left security services overwhelmed as they try to track jihadist threats among the new arrivals.

The attacks in Paris in 2015 and Brussels in March confirmed fears that Islamist groups had exploited refugee flows to smuggle operatives into the heart of Europe. Investigators have determined most of the assailants in those cases traveled from Syria through the Balkans and then Central Europe along with a river of refugees in the summer and fall of 2015.Around the same time, Mr. Amri was released after four years in an Italian prison for starting a fire at a refugee shelter. The authorities ordered him to return to Tunisia. Instead, he headed to Germany, where he roamed freely using a series of false identities and sought asylum.

His path to Berlin is prompting calls for Europe to fix the longstanding security flaws of the Schengen Zone, which allows border-free travel throughout much of the region.

“We are very late, and we’re in the process of catching up,” said Georges Fenech, chairman of the French parliamentary committee that investigated the Paris attacks. “Because today, these terrorists move freely in the Schengen area. From the moment they enter with the migrants, they pass borders without much difficulty.”

Overtaxed security agencies dropped 24-hour surveillance of Mr. Amri this year when they failed to find enough evidence to make him a high-priority target. Mr. Amri had been under scrutiny after authorities discovered links between him and a radical cleric.

Police detained him in July when they discovered his request for asylum was denied and he was to be deported. But they released him a day later, because of Germany’s strict legal limits on the detention of migrants and Tunisia’s unwillingness at the time to take him back.

German officials in November provided information that prompted the U.S. to put Mr. Amri’s name on a no-fly list.

Authorities aren’t certain whether Mr. Amri is their only suspect. Islamic State issued a boilerplate claim of responsibility for the massacre.

Jean-Charles Brisard, head of the Center for Analysis of Terrorism in Paris, said the fact that Mr. Amri was allowed to leave Italy with a criminal record and apply for asylum again in Germany underscores the disorder of Europe’s refugee system. Authorities still don’t routinely fingerprint migrants or check their fingerprints against national criminal databases, he noted.

“This is clearly a failure of exchange of information, but also of initial screening and control of refugees,” Mr. Brisard said.

The scale of the inflow is daunting. The German Interior Ministry said as of Nov. 30, there were 32,714 Tunisian asylum seekers in the country. Decisions had been made for nearly 1,500 to be repatriated, but only 111 had been sent back to Tunisia. The acceptance rate for Tunisian asylum requests is 0.8%, a ministry spokeswoman said.

In 2015, meanwhile, European Union countries designated 533,395 people for deportation, but only 36% were sent back, according to Eurostat, the bloc’s statistics office.

Since the Paris attacks, European security services have raced to detect jihadist threats among the millions of refugees who arrived in recent years. Evidence has mounted this year that Islamic State sent dozens of operatives to Europe over the past two years, to Germany in particular, officials say.

Authorities say those people are plotting attacks and trying to recruit other refugees.

On Wednesday, German authorities announced the arrest of a Moroccan national they identified as Redouane S. who had been in the country since May 2015. Prosecutors described him as an accomplice of Abdelhamid Abaaoud, the Belgian Islamic State operative who led the group that attacked Paris in 2015. They said he rented apartments in Greece and Turkey that Abaaoud used to plot an attack that was foiled in January 2015 when security services stormed an apartment in Verviers, Belgium, killing two jihadists.

“Even after his entry into Germany in May 2015, he was in contact with the group around Abaaoud and was ready for further instructions,” the prosecutor said.

Yet the mushrooming of terrorism probes has strained European police forces. It can often take months for security services to make arrests, as they struggle to penetrate encrypted communications and probe connections of suspects back in Syria and Iraq.

In one case, German police arrested three Syrians at refugee centers in northern Germany on suspicion of being Islamic State operatives. The three, however, had been interrogated in December 2015 and February, only to be released for lack of evidence, according to investigative documents seen by The Wall Street Journal.

Europe’s stretched security officials are set to face another test. Authorities expect the looming fall of Islamic State’s strongholds of Raqqa, Syria, and Mosul, Iraq, will prompt many jihadists to flee and attempt to enter Europe.

Yet the bloc’s control of the Schengen borders remains patchy. The EU has set up “hot spots” where officials from Europol, the body’s police-coordinating agency, conduct security checks of migrants, using high-speed internet connections to the necessary security databases.

But the hot spots still don’t have necessary infrastructure, according to a note prepared by the EU’s counterterrorism coordinator for national governments. Relatively small numbers of migrants arrive through the hot spots; security checks elsewhere are minimal and hobbled by regulations that prevent law-enforcement officials from accessing refugee data.

“Further progress needs to be made with regard to systematic checks of the migrants against all relevant databases,” the note says.