"Their response could and should have been more effective," judge Nicholas Loraine-Smith said in his conclusions after a series of hearings that began in January.
"The response by the police was at best shambolic, at worst cowardly," he said, adding that the hotel guards were not armed and had no walkie-talkies.
But he said there was no "neglect" by the tour operator TUI because the victims were "not in a dependent position" and said there was "nothing that the hotel might have done before the attack".
Gunman Seifeddine Rezgui killed 38 people, including 30 British tourists and three Irish citizens, in a shooting spree in June 2015 at the Riu Imperial Marhaba Hotel in Sousse, Tunisia. The attack was claimed by the Islamic State jihadist group.
"The simple but tragic truth in this case is that a gunman armed with a gun and grenades went to that hotel intending to kill as many tourists as he could," the judge said.
The British inquest, which is in fact a series of individual inquests into the circumstances of death of each British citizen, is not a trial but the ruling could be used in civil lawsuits.
Some families said they were now planning to sue TUI.
"We will now be preparing to commence civil proceedings against TUI," said lawyer Kylie Hutchinson, whose firm represents most of the victims' families.
"It is now crucial that the whole travel industry learns from what happened in Sousse to reduce the risk of similar catastrophic incidents in the future."
TUI managing director Nick Longman said outside court that everyone had been left "shocked and devastated" by the attack.
"I would like to again extend our deepest sympathy. We are so very sorry for the pain and loss those affected have suffered."
Signup to our newsletter and follow us on Facebook and Twitter!
He said changes had been made so that Foreign Office travel advice was now on almost every page of its website and staff in shops had it to hand to inform customers.
Tunisia's ambassador to Britain, Nabil Ammar, told BBC radio on Tuesday: "The police was not ready as it should be".
"A lot has changed now. Many improvements have been made in terms of security services, security efficiency, security of hotels, the level of general security in the whole country".
Britain's Foreign Office warns against all travel to some border regions of Tunisia and "all but essential travel" to the rest of the country.
Tunisia's economy is heavily dependent on tourism and has repeatedly asked for the warning to be lifted.
Samantha Leek, the main lawyer for the inquest, said at one of the hearings that a report by a Tunisian judge had identified failings by local security which could have ended the attack before more police arrived and killed Rezgui.
"He said the units that should have intervened in the events deliberately and unjustifiably slowed down to delay their arrival at the hotel," she said.
"They had the ability to put an end to the attack before the police arrived but wasted a considerable amount of time in getting to the hotel," she added.
But Ammar said the accusation that the police had deliberately delayed their arrival was "exaggerated and unfair".
A report on security at the hotels by a British embassy staff member conducted in January 2015 was also read out in court during one of the hearings by Andrew Ritchie, a lawyer representing 20 victims' families.
"There seems to be little in the way of effective security to prevent or respond to an attack" from the beach, he quoted the report as saying.