Police have appealed for information to trace any “associates” of the Westminster attacker, Khalid Masood.
They have named his fourth victim as retired window cleaner Leslie Rhodes, 75, from Streatham in south London – one of three killed by Masood’s car on Westminster Bridge on Wednesday.
A Romanian woman who fell from the bridge is stable in hospital.
Police said they had made two more “significant arrests”, taking the total number to 10.
Nine people are still being questioned by police.
Fifty people were injured in the attack, with 31 receiving hospital treatment. Two are in a critical condition; one has life-threatening injuries.
The injured include Andreea Cristea, who had an operation for a blood clot on her brain after Masood’s car hit her on the bridge, pushing her into the river.
The Romanian ambassador told the BBC that Ms Cristea’s boyfriend Andrea Burnaz, who was also injured, had been planning to propose to her later that day.
Meanwhile, Prince Charles is visiting victims of the attack who are being treated at King’s College Hospital.
Assistant Deputy Commissioner Mark Rowley said two police officers remained in hospital with “very significant” injuries.
PC Keith Palmer died after being stabbed in the attack.
Masood, 52, mounted the pavement and drove into pedestrians on Westminster Bridge before crashing his car into railings and running into the grounds of Parliament.
Armed with a knife, he stabbed PC Palmer, before being shot dead by police.
The Metropolitan Police said Masood had used a number of aliases and had been known to police.
His previous convictions included possession of offensive weapons and public order offences.
Born as Adrian Russell Elms, in Dartford, Kent, Masood was also known as Adrian Russell Ajao in childhood after taking his stepfather’s name.
Mr Rowley said the investigation would focus on his “motivation, preparation and his associates”.
He said police would investigate whether Masood “acted totally alone inspired by terrorist propaganda, or if others have encouraged, supported or directed him”.
Mr Rowley added: “There might be people out there who did have concerns about Masood but did not feel comfortable for whatever reason in passing those concerns to us.”
He also said there would be a review of Parliamentary security to see if changes were needed.
In the early 2000s Masood was convicted of causing grievous bodily harm after slashing a man across the face with a knife in a pub.
Heather Mott, of Northiam, East Sussex, said her late husband, Piers, had been defending someone when he was assaulted.
Masood was believed to have been living in the West Midlands, and had previously spent time in Luton, Crawley, West Sussex, and Rye and Eastbourne, both in East Sussex.
The night before the attack, Masood stayed at the £59-a-night Preston Park Hotel in Brighton.
Manager Sabeur Toumi told the BBC he checked in as Khalid “Masoud” and said he had come from Birmingham and was visiting friends.
Mr Toumi said he was “friendly and smiley”, while the hotel receptionist noted on their system he was a “nice guest”.
Businessman Michael Petersen, who was also staying there, told Sky News he came across as “polite… there is nothing in his conduct that would make me have any suspicious thoughts towards him”.
Asked about reports that Scotland Yard’s acting head Craig Mackey was rushed away from Parliament in the aftermath of the attack, Mr Rowley said: “It’s frustrating that we get nonsense like this from armchair critics.”
Deputy Commissioner Mackey joined Home Secretary Amber Rudd, London Mayor Sadiq Khan and hundreds of people at a candlelit vigil in Trafalgar Square on Thursday evening to remember the people who lost their lives.
The latest arrests took place in the West Midlands and at an address believed to be West Didsbury, in Manchester.
Three women and five men were held in London and Birmingham on Thursday on suspicion of preparation of terrorist acts but Mr Rowley said one person has now been bailed.
Police said searches at five address were ongoing and 16 have finished. Detectives have seized 2,700 items, including “massive amounts of computer data”.
It has emerged that a house searched in Carmarthenshire belongs to Masood’s mother, although police said nobody at the property was a suspect.
Held his hand
Aysha Frade, a teacher in her 40s, and US tourist Kurt Cochran, 54, were killed on Wednesday, while Mr Rhodes died on Thursday evening when his life support machine was turned off.
Army veteran Mike Crofts, who witnessed the attack and rushed to help PC Palmer, told BBC Breakfast it was his military training that made him react.
“Unfortunately despite our best efforts we were unable to save him.
“He was at the time surrounded by a whole host of colleagues who really loved him. We held his hand through the experience, talked to him throughout.”
Meanwhile, a US tourist says she posed for a photograph with PC Palmer 45 minutes before he was attacked.
Less than an hour later, Staci Martin was in a taxi when she heard there had been a shooting and saw a helicopter and emergency vehicles.
She recognised PC Palmer from the photo released after it was confirmed he had been killed.
Ms Martin believes her picture with the officer must be one of the last photos of him taken alive and she feels “obligated” to get it to his family, adding: “I just want to make sure they have that of him.”
Dominic Grieve, the chair of Parliament’s intelligence and security committee, said there was no evidence at present to suggest that Masood’s “activities could have been stopped before he came on to the bridge in his car”.
He told Radio 4’s Today programme that about 12 plots had been stopped over the past 18 months and the UK had been “extremely fortunate… it really has been a miracle it hasn’t happened sooner”.
Asked about arming all police officers, Mr Grieve said: “The idea that arming all police is going to be a panacea and a solution to this type of problem may well be mistaken.”
Send us your questions on the London attack:
We’d like you to tell us what you want to know about the London attack. Use the form below:
If you are reading this page on the BBC News app, you will need to visit the mobile version of the BBC website to submit your question.