Bethel, Justice. Collectively, these cases present an opportunity to explore the scope and nature of the liability faced by premises owners, occupiers, and security contractors in cases involving personal injuries arising from third-party criminal conduct. Although the underlying appeals vary with respect to their facts and specific issues presented, the resolution of each appeal necessitates consideration of fundamental principles of premises liability under Georgia law. In granting certiorari in these cases, we posed the following questions: 1. For a claim brought under OCGA § 51-3-1 that alleges negligent security, to what extent, if at all, is proof that the underlying criminal act occurring on the premises was reasonably foreseeable part of the plaintiffs burden to prove the elements of duty, breach, or proximate cause? In light of the answer to the first question, is the question whether a criminal act occurring on the premises was reasonably foreseeable generally for the judge or the factfinder? What is the legal test for determining whether a criminal act occurring on the premises was reasonably foreseeable? For example, is reasonable foreseeability determined based on the totality of the circumstances, or is some more specific showing required, such as prior, substantially similar crimes occurring on or near the premises? In Case No. S22G0527, we also specifically asked the following: When apportioning fault, can a rational factfinder determine that an intentional tortfeasor whose actions directly caused the plaintiffs injuries bears no fault for those injuries? Finally, in Case No. S22G0618, we posed the following question: Under Georgia law, does a party rendering security services to the owner or occupier of property in a premises-liability case owe a duty of care to third parties under any of the bases set out in Section 324A of the Restatement (Second) of Torts? Today, as discussed more fully below, we clarify that the reasonable foreseeability of a third-party criminal act is a determination linked to a proprietor’s duty to keep the premises and approaches safe under OCGA § 51-3-1, and that the totality of the circumstances informs whether a third-party criminal act was reasonably foreseeable. Moreover, the question of reasonable foreseeability is generally reserved to the trier of fact, but the trial court may resolve the issue as a matter of law where no rational juror could determine the issue in favor of the non-moving party. Additionally, with respect to Case No. S22G0527, we hold that, under the specific circumstances of the case before us, the verdict apportioning no fault to the intentional tortfeasor is not inconsistent because, when considered in conjunction with the instructions to the jury, the verdict is capable of a viable construction. And with respect to Case No. S22G0618, we hold that a party rendering security services to a proprietor may owe a duty of care to third parties visiting the premises in accordance with the standard outlined in Section 324A of the Restatement (Second) of Torts. Consistent with these conclusions, we affirm the judgment of the Court of Appeals in Case No. S22G0527; and in Case Nos. S22G0617 and S22G0618, we reverse in part and vacate in part the judgments of the Court of Appeals and remand the cases for reconsideration consistent with this opinion. I. Background In each of the cases at bar, the plaintiffs, while present as invitees on property owned, operated, and/or secured by the defendants, sustained injuries resulting from third-party criminal conduct. One person died as a result of his injuries. We summarize the relevant factual and procedural histories of the cases before us below.[1] A. Case No. S22G0527 Plaintiff James Carmichael was shot during an armed robbery that took place in and around his vehicle in the parking lot of a CVS store; Carmichael thereafter filed a premises liability claim against CVS. Following a trial, the jury awarded damages to Carmichael, finding CVS ninety-five percent at fault for Carmichael’s injuries and Carmichael five percent at fault, but apportioning no fault to the shooter. The Court of Appeals affirmed, holding that there was sufficient evidence from which a reasonable jury could conclude that the crime was foreseeable. The Court of Appeals further concluded that the jury’s verdict apportioning no fault to the shooter was not void because the jury “‘considered’ the fault of all who potentially contributed,” including the shooter, and because, the court reasoned, the jury could have decided, based on the evidence, not to assign any fault to the shooter. Ga. CVS Pharmacy, LLC v. Carmichael, 362 Ga. App. 59, 63-67, 70-71 (1), (3) (865 SE2d 559) (2021). The Court of Appeals also noted that, even if the evidence was insufficient to support the jury’s apportionment of fault, any error was harmless because, under its reading of OCGA § 51-12-33 (b), damages may be reduced only when multiple defendants are named in a case. Thus, the Court of Appeals concluded, CVS would not have been entitled to apportionment of damages. See id. at 71 (3). CVS filed a petition for certiorari in this Court, which we granted. B. Case Nos. S22G0617 and S22G0618 Anthony L. Welch (“Anthony”) was killed during an armed robbery in the parking lot of the Pappadeaux restaurant; the parking lot was patrolled by Tactical Security pursuant to Tactical’s contract with Pappas Restaurants, Inc., the owner of Pappadeaux. Anthony’s surviving spouse, Cynthia Welch (“Welch”), filed suit[2]against Pappas and Tactical (collectively, “the defendants”), raising several claims, including one for premises liability based on the defendants’ alleged negligence in securing the property. The trial court denied the defendants’ separate motions for summary judgment, but the Court of Appeals reversed, holding that Anthony’s shooting was not reasonably foreseeable and that the defendants’ liability was therefore precluded. Pappas Restaurants, Inc. v. Welch, 362 Ga. App. 152, 154-161 (1) (a)-(b) (867 SE2d 152) (2021). Further, the Court of Appeals declined to hold that Tactical owed any duty to the Welches under Section 324A of the Restatement (Second) of Torts. Id. at 162-163 (2). We thereafter granted Welch’s petitions for certiorari. II. Premises Liability Claims Involving Third-Party Criminal Activity Turning to the underlying legal principles, we recognize that the case law that has developed over the years in Georgia premises liability cases involving third-party criminal activity has not plotted a clear roadmap for parties, litigators, or trial courts. It is well- settled that a proprietor owes its invitees a duty “to exercise ordinary care in keeping the premises and approaches safe.” OCGA § 51-3-1.[3] It is also generally accepted that, while a proprietor is “bound to exercise ordinary care to protect the invitee from unreasonable risks” of which he has knowledge, he is not an insurer of an invitee’s safety. See Lau’s Corp. v. Haskins, 261 Ga. 491, 492 (1) (405 SE2d 474) (1991). See also Martin v. Six Flags Over Georgia II, L.P., 301 Ga. 323, 328 (II) (801 SE2d 24) (2017) (same). Moreover, the law recognizes that, where an invitee is injured by a third party’s intervening criminal act, the proprietor is generally insulated from liability; an exception to this general rule arises, however, where the proprietor had sufficient reason to anticipate such criminal conduct. See Martin, 301 Ga. at 328 (II). We granted certiorari in these cases in part to address the relationship between reasonable foreseeability and the specific elements of a premises liability claim involving third-party criminal activity, the respective roles of the trial court and the jury in that analysis, and how reasonable foreseeability should be determined.[4] A. The reasonable foreseeability of a crime informs the duty owed. As a general rule, in order to recover on a premises liability claim arising from third-party criminal conduct, a plaintiff must present evidence of a duty, a breach of that duty, causation, and damages. See Goldstein, Garber & Salama, LLC v. J.B., 300 Ga. 840, 841-842 (1) (797 SE2d 87) (2017); Laus Corp., 261 Ga. at 492. In our first question to the parties, we asked whether and how the concept of reasonable foreseeability informs each of these elements – that is, whether reasonable foreseeability is part of the plaintiff’s burden to prove the elements of duty, breach, or causation. We hold that the reasonable foreseeability of third-party criminal conduct is properly considered as part of a proprietor’s duty to exercise ordinary care in keeping the premises and approaches safe under OCGA § 51-3-1 although considerations of foreseeability also inform other elements of a premises liability claim, as we will discuss below. Relying on prior decisions of this Court, Pappas and CVS both argue – and we agree – that reasonable foreseeability factors into the analysis of the duty element. More specifically, the foreseeability of the criminal act informs whether the proprietor’s duty of ordinary care owed pursuant to OCGA § 51-3-1 encompasses the duty to keep invitees safe from third-party criminal conduct. Under longstanding precedent, “[i]f the proprietor has reason to anticipate a criminal act, he or she then has a duty to exercise ordinary care to guard against injury from dangerous characters.” (Citation and punctuation omitted.) Lau’s Corp., 261 Ga. at 492 (1). See also Sturbridge Partners, Ltd. v. Walker, 267 Ga. 785, 786-787 (482 SE2d 339) (1997) (same); Atlantic Coast Line R. Co. v. Godard, 211 Ga. 373, 377 (1) (86 SE2d 311) (1955) (“The petition in this case, which alleged that the defendants well knew that dangerous, reckless, and lawless characters and persons who were strangers frequented the premises described during the nighttime, including prowlers and hoboes, was sufficient to charge the defendants with the duty to anticipate the criminal act alleged, and to exercise ordinary care to protect its employees therefrom.”); Restatement (Second) of Torts § 344 cmt. f (1965) (“If the place or character of his business, or his past experience, is such that he should reasonably anticipate careless or criminal conduct on the part of third persons, either generally or at some particular time, [a proprietor] may be under a duty to take precautions against it[.]“). But “without foreseeability that a criminal act will occur, no duty on the part of the proprietor to exercise ordinary care to prevent that act arises.” Days Inns of America v. Matt, 265 Ga. 235, 236 (454 SE2d 507) (1995). See also Martin, 301 Ga. at 328 (II) (“[T]he [proprietor's duty extends only to foreseeable criminal acts." (citation and punctuation omitted)); Doe v. Prudential-Bache/A.G. Spanos Realty Partners, L.P., 268 Ga. 604, 605 (492 SE2d 865) (1997) ("It is well-settled that a landlord only has a duty to protect tenants from the criminal attacks of third parties if those attacks are foreseeable.").[5] In other words, a proprietor necessarily owes a duty to invitees to exercise ordinary care to keep his premises reasonably safe, see OCGA § 51-3-1; whether that duty of ordinary care embraces the specific duty to protect invitees against third-party criminal conduct hinges on foreseeability.[6] Of course, a finding that third-party criminal conduct was reasonably foreseeable and thereby gave rise to a duty to protect invitees from that harm does not itself establish the proprietor’s liability for the plaintiff’s injury. Instead, a factfinder must go on to address the next element of negligence: to determine whether the proprietor acted reasonably in the face of the particular foreseeable risk or whether the proprietor breached its duty to do so. So, foreseeability bears on this separate inquiry, too, but in a relative sense: for example, the factfinder must weigh the likelihood and severity of the foreseeable harm against the cost and feasibility of additional security measures in considering whether the duty owed was breached. See, e.g., Jackson v. Post Properties, Inc., 236 Ga. App. 701, 703 (2) (2) (513 SE2d 259) (1999) (whether the extra window locks offered by the apartment complex were sufficient to demonstrate ordinary care and whether the plaintiff’s rape “was the result of the flimsy nature of the [builder-installed] windows” were issues for the jury’s determination). In such circumstances, a factfinder must decide whether the proprietor’s security measures were reasonable, even though the criminal act was reasonably foreseeable in the broad sense necessary to establish a duty. See Lau’s Corp., 261 Ga. at 494 (2). If the trier of fact deems the proprietor’s security measures reasonable in light of the circumstances, or if the plaintiff fails to present evidence that the security precautions employed to protect against the particular foreseeable risk of harm violated the applicable standard of care, then there was no breach of duty, and there can be no finding of negligence. See, e.g., Lau’s Corp., 261 Ga. at 493 (2) (“[T]o be negligent, the conduct must be unreasonable in light of the recognizable risk of harm.”); Martin, 301 Ga. at 335 (II) (B) n.8 (“Undertaking measures to protect patrons does not heighten the standard of care; and taking some measures does not ordinarily constitute evidence that further measures might be required.”); Hunter v. Rouse-Atlanta, Inc., 211 Ga. App. 131, 132 (2) (438 SE2d 188) (1993) (“There was no evidence that any security efforts undertaken by appellees were otherwise below a reasonable standard of care[.]” (citation and punctuation omitted)); Shell Oil v. Diehl, 205 Ga. App. 367, 368 (1) (422 SE2d 63) (1992) (noting that “appellee introduced no evidence that the security precautions which were being employed on appellants’ business premises did not comply with the standard of care” or were otherwise unreasonable). B. The jury generally decides reasonable foreseeability, but as with any jury question, the trial court may resolve the issue as a matter of law where no rational juror could determine the issue in favor of the non-moving party. We also asked the parties to address whether the reasonable foreseeability of a crime is determined by the trial court as a matter of law or by the jury as a matter of fact. CVS and Pappas rely on the settled understanding that the existence of a legal duty is a question of law for the court. The plaintiffs point to our settled law which holds that, in this context, the question of reasonable foreseeability of a criminal attack is generally decided by a jury. Each proposition is generally correct. It is well established that “[t]he existence of a legal duty, which can arise by statute or be imposed by decisional law, is a question of law for the court.” (Citation and punctuation omitted.) Maynard v. Snapchat, Inc., 313 Ga. 533, 535-536 (2) (870 SE2d 739) (2022). See also Rasnick v. Krishna Hospitality, Inc., 289 Ga. 565, 567 (713 SE2d 835) (2011) (“The legal duty is the obligation to conform to a standard of conduct under the law for the protection of others against unreasonable risks of harm. This legal obligation to the complaining party must be found, the observance of which would have averted or avoided the injury or damage[.]“); City of Rome v. Jordan, 263 Ga. 26, 27 (1) (426 SE2d 861) (1993) (same). Here, the duty is imposed by statute. OCGA § 51-3-1 imposes on proprietors a legal duty to exercise ordinary care to keep the premises safe for invitees, and we have held time and again that, “[i]f there is reason to anticipate some criminal conduct, the landowner must exercise ordinary care to protect its invitees from injuries caused by such conduct[.]” (Citation and punctuation omitted.) See Martin, 301 Ga. at 328 (II). See also Sturbridge, 267 Ga. at 785-786; Lau’s Corp., 261 Ga. at 492 (1). Because “landowners need not guard against imagined dangers[,]” this duty of care “ extends only to foreseeable criminal acts.” (Citations and punctuation omitted; emphasis in original.) Martin, 301 Ga. at 328 (II). But because the question of whether a legal duty arises in a particular case turns on the presence of certain factual circumstances, the factfinder also has a role to play in determining whether a third party’s criminal attack was reasonably foreseeable. This determination will often turn on factual questions, such as the nature of the crimes, if any, that previously occurred on or near the premises, where and when those crimes happened, what information the proprietor knew about the crimes, and whether that information gave him reason to anticipate the harm that occurred. See Sturbridge, 267 Ga. at 786. For this reason, it is well settled that the question of reasonable foreseeability in this context is generally a question for the jury to decide. See, e.g., id. at 786 (“[T]he question of reasonable foreseeability of a criminal attack is generally for a jury’s determination rather than summary adjudication by the courts.” (citation and punctuation omitted)); Doe, 268 Ga. at 606 (“[Q]uestions of foreseeability are generally for a jury to decide[.]“); Lau’s Corp., 261 Ga. at 493 (2) (“The particular standard of care to be applied and whether the owner breached that standard are usually issues to be decided by a jury.”); Lay v. Munford, Inc., 235 Ga. 340, 341 (219 SE2d 416) (1975) (“The question of reasonable foreseeability and the statutory duty imposed by [the predecessor to OCGA § 51-3-1], to exercise ordinary care to protect the plaintiff in the circumstances of this case, is for a jury’s determination rather than summary adjudication by the courts.”). Of course, as with any jury question, the trial court, in “plain and palpable cases,” may resolve the question of reasonable foreseeability as a matter of law – that is, if the court concludes on summary judgment that no rational juror could resolve the issue in the non-moving party’s favor. See Lau’s Corp., 261 Ga. at 493 (1) (“The particular standard of care to be applied and whether the owner breached that standard are usually issues to be decided by a jury. However, these issues may be decided by the court in plain and palpable cases where reasonable minds cannot differ as to the conclusion to be reached.” (citation and punctuation omitted)); see also Doe, 268 Ga. at 606 (determining, under the facts of the case, that the prior property crimes were insufficient to create a factual issue regarding foreseeability); Sun Trust Banks, Inc. v. Killebrew, 266 Ga. 109, 109-110 (464 SE2d 207) (1995) (affirming grant of summary judgment because, in the absence of knowledge of criminal activity, the proprietor did not have a duty to investigate police files to determine whether criminal activities had occurred on its premises); Shadow v. Fed. Express Corp., 359 Ga. App. 772, 775 (4) (860 SE2d 87) (2021) (summary judgment appropriate where the plaintiff failed to raise a question of fact as to whether a mass shooting was reasonably foreseeable). But where the evidence is sufficient to create a genuine issue of material fact with respect to whether third-party criminal conduct was foreseeable under the facts of a given case, then the matter is for the jury to resolve. See, e.g., Sturbridge, 267 Ga. at 787 (“[E]vidence of the prior burglaries was sufficient to give rise to a triable issue as to whether or not [the proprietor] had the duty to exercise ordinary care to safeguard its tenants against the foreseeable risks posed by the prior burglaries.”); Mason v. Chateau Communities, Inc., 280 Ga. App. 106, 113-114 (633 SE2d 426) (2006) (determining that questions of fact existed as to whether a landlord should have reasonably foreseen a criminal attack upon its tenant and whether it exercised ordinary care in response, which were for the jury to resolve). In short, as a matter of law, the legal duty to keep the premises safe is imposed by statute and has been construed to encompass a duty to protect against foreseeable third-party criminal acts. But whether the third-party criminal acts were foreseeable under the facts of a particular case – thus triggering the duty to protect against them – is a question for the factfinder (unless no rational juror could find the criminal act reasonably foreseeable). C. The reasonable foreseeability of a third-party criminal act is determined from the totality of the circumstances. We next asked the parties how reasonable foreseeability itself is determined in this context. For reasons we explain below, we conclude that the pertinent question is whether the totality of the circumstances relevant to the premises gave the proprietor sufficient “reason to anticipate the criminal act” giving rise to the plaintiffs injuries on the premises. This determination is not susceptible to a mechanical formulation and instead must be made on a case-by-case basis. In decisional law spanning almost 70 years, we have looked to a variety of evidence in considering whether such evidence was sufficient to allow a jury to decide if the criminal conduct in a given case was reasonably foreseeable. See, e.g., Atlantic Coast Line, 211 Ga. at 377 (1), 382 (9) (considering whether evidence supported allegation that night clerk at train depot knew that “dangerous, reckless, and lawless characters” frequented the premises at night, which gave reason to anticipate criminal act and so was sufficient to charge defendants with a duty to anticipate the resulting crime and to exercise ordinary care to protect its employees therefrom); Lay, 235 Ga. at 340-341 (reversing grant of summary judgment where defendant was “aware” that an armed robbery might occur because the convenience store had been the “scene of numerous armed robberies” and had hired a stakeout unit as a result); Lau’s Corp., 261 Ga. at 492-493 (1) (evidence of one prior purse snatching in a high crime area was enough to raise triable issue as to duty in the context of a robbery); Days Inn, 265 Ga. at 236 (proof of one prior robbery committed by force was enough to raise a triable issue of reasonable foreseeability); Sturbridge, 267 Ga. at 787 (recent daytime burglaries of vacant apartments created a triable issue regarding the reasonable foreseeability of a rape by an intruder into an occupied apartment during morning hours); Doe, 268 Ga. at 606 (property crimes in a parking garage involving vandalism and thefts of bicycles and from vehicles did not create triable issue regarding the reasonable foreseeability of rape and robbery in that same parking garage); Martin, 301 Ga. at 331-332 (II) (A) (evidence that a park was “routinely the site of gang congregation and activity,” which came up in daily employee briefings at least once a week, that gang graffiti was present in the men’s employee locker room, and that a drive-by shooting had occurred at bus stop in the parking lot were all relevant to determining reasonable foreseeability of a gang attack on a patron). The facts establishing foreseeability in a particular case may vary, but evidence of substantially similar prior criminal activity is typically central to the inquiry. As this Court has previously set forth, reasonable foreseeability can be established by evidence showing that the proprietor had knowledge[7] of prior criminal activities that “occur[red] on or near the premises so that a reasonable person would take ordinary precautions to protect his or her customers or tenants against the risk posed by that type of activity.” Sturbridge, 267 Ga. at 786. This reflects the commonsense notion that knowledge of past criminal conduct can give a proprietor “reason to anticipate” – and thus protect against – future criminal conduct on the premises. See id. Whether knowledge of such past crimes in fact gave the proprietor reason to anticipate the criminal act in question – i.e., whether the act was reasonably foreseeable – depends on the “location, nature and extent of the prior criminal activities and their likeness, proximity or other relationship to the crime in question.” Id.[8] This makes good sense: if the past crimes in question (1) happened closer in proximity to the subject premises, (2) happened closer in time to the criminal conduct at issue, (3) happened more frequently, and (4) were more similar to the act that is the subject of the litigation, then all else equal, a proprietor will ordinarily have better and stronger reasons to anticipate that the particular criminal act could occur on the premises. See, e.g., id. at 785-787 (three prior burglaries of vacant apartments at a complex, two of which the defendant knew about, in the months preceding the sexual assault inside an occupied unit created issue of fact regarding foreseeability); Martin, 301 Ga. at 326-332 (I), (II) (A) (prior gang activity on the property within the year preceding the gang-related crime made that crime foreseeable). Although these characteristics are neither exhaustive nor required in every case, where they are present, the question is where the mix of evidence of past incidents falls on the spectrum of foreseeability. Given the importance of prior criminal acts to proving foreseeability, this inquiry will be part of the typical premises liability cases arising from third-party criminal conduct. However, we do not think the sweep of our cases in this space can be fairly read to impose a bright-line rule that only certain, specific kinds of evidence must be shown to establish foreseeability, especially because an inquiry under the totality of the circumstances is necessarily case-specific. In Martin, this Court noted that “the foreseeability of future criminal acts may be established by evidence of prior criminal acts of a ‘substantially similar’ nature,” as well as “[a]n establishment’s location in a high crime area”[9] and “evidence that the landowner had knowledge of a volatile situation brewing on the premises.”[10] 301 Ga. at 331 (II) (A). See also Lau’s Corp., 261 Ga. at 493 (2) (“[A] high crime rate in a particular area may increase the risk of harm to patrons so that a prudent owner will take security precautions.”).[11] And though, notably, two of our prior cases might be read to suggest a bright-line rule requiring evidence of a “substantially similar” prior crime, we now reject any such reading. More specifically, this Court’s opinions in Sturbridge and Tyner include language that could be understood to require that, in every case pertaining to a proprietor’s liability for third-party criminal acts, the plaintiff cannot establish reasonable foreseeability without pointing to a substantially similar prior crime. See Sturbridge, 267 Ga. at 786 (“[T]he incident causing the injury must be substantially similar in type to the previous criminal activities occurring on or near the premises so that a reasonable person would take ordinary precautions to protect his or her customers or tenants against the risk posed by that type of activity.”); Tyner, 305 Ga. at 485 n.7 (“Cases pertaining to landlord liability for third-party criminal acts are also informative. In those cases, reasonable foreseeability of the risk is essential to proving liability; plaintiffs must show that the landlord had a reason to anticipate or foresee the harmful acts of others based on prior experience with substantially similar types of acts that gave the landlord superior knowledge of the danger posed.” (citing Walker v. Sturbridge Partners, Ltd., 221 Ga. App. 36, 40 (470 SE2d 738) (1996) and Sturbridge, 267 Ga. 785). The Court of Appeals has recited this language as an essential element of reasonable foreseeability, as well. See, e.g., Camelot Club Condominium Assn., Inc. v. Afari-Opoku, 340 Ga. App. 618, 621 (1) (a) (i) (798 SE2d 241) (2017) (“In order to be reasonably foreseeable, the criminal act must be substantially similar in type to the previous criminal activities occurring on or near the premises so that a reasonable person would take ordinary precautions to protect his or her customers against the risk posed by that type of activity.”); Johns v. Housing Authority for City of Douglas, 297 Ga. App. 869, 871 (678 SE2d 571) (2009) (same); Wojcik v. Windmill Lake Apartments, 284 Ga. App. 766, 768 (645 SE2d 1) (2007) (physical precedent only) (same); Mason v. Chateau Communities, Inc., 280 Ga. App. 106, 112-113 (633 SE2d 426) (2006) (same); Walker v. St. Paul Apts., 227 Ga. App. 298, 300 (489 SE2d 317) (1997) (same); Doe v. Briargate Apartments, Inc., 227 Ga. App. 408, 409 (1) (489 SE2d 170) (1997) (similar); Hillcrest Foods, Inc. v. Kiritsy, 227 Ga. App. 554, 559 (1) (489 SE2d 547) (1997) (citing Sturbridge and stating, “[o]ur Supreme Court has reaffirmed the requirement of substantially similar criminal acts to establish the foreseeability of the proprietor”). Properly understood, however, Sturbridge does not hold that a plaintiff must point to a past crime (substantially similar or otherwise) to establish reasonable foreseeability. The question presented in Sturbridge was not whether a plaintiff had to point to a past crime to establish reasonable foreseeability; indeed, there is no dispute the plaintiff had done that. See Sturbridge, 267 Ga. at 785-787. Instead, once a plaintiff had identified a past crime, the question was whether that crime was the same kind of crime as the crime at issue – there, whether the plaintiff had to identify a past, violent crime on the premises to establish that the rape at issue was reasonably foreseeable. We rejected that “restrictive and inflexible approach” to reasonable foreseeability. Id. at 786. Instead, we held that the proprietor’s knowledge of prior burglaries in that case created a jury question as to whether the proprietor should have reasonably anticipated the criminal act in question. See id. at 787. Put simply, Sturbridge did not hold that a plaintiff was required to identify a past crime as a prerequisite to establishing reasonable foreseeability; it merely held that the past crimes that the plaintiff had identified there were sufficient to raise a jury question on reasonable foreseeability. See id. That this is the extent of the Court’s holding is confirmed by Sturbridge s language when properly viewed in context. In setting out the analysis for determining whether a proprietor’s duty in a given case extended to protecting against the risk posed by criminal activity, Sturbridge began with the familiar and well-established standard: “if the proprietor has reason to anticipate a criminal act, he or she then has a duty to exercise ordinary care to guard against injury from dangerous characters.” (Citation and punctuation omitted; emphasis supplied.) Id. at 786. That standard says nothing about having to identify a specific past crime, or any past crime at all, to establish that a proprietor had “reason to anticipate” the crime at issue. Id. Next, we said, “[a]ccordingly, the incident causing the injury must be substantially similar in type to the previous criminal activities occurring on or near the premises so that a reasonable person would take ordinary precautions to protect his or her customers or tenants against the risk posed by that type of activity.” (Emphasis supplied.) Id. (citing Matt v. Days Inns of America, Inc., 212 Ga. App. 792 (443 SE2d 290) (1994)). This explains why “the previous criminal activities” at issue must be “substantially similar in type” to the crime at issue to establish foreseeability: as we have already explained, similar past crimes – those closer in time, proximity, and type – give a proprietor stronger reasons to anticipate that the crime at issue would happen. See id. But Sturbridge does not say that a plaintiff must identify a past crime as a requirement of proving reasonable foreseeability. Rather, the analysis takes the existence of such crimes as a given (“the incident causing the injury must be substantially similar in type to the previous criminal activities”) to address the question presented by the facts of that case – i.e., are these crimes enough, based on their “likeness, proximity or other relationship to the crime in question” to give the proprietor reason to anticipate the criminal act? Id. at 786. That is the context in which Sturbridge used the word “must.” Neither does Matt, the 1994 Court of Appeals decision that we cited in this discussion in Sturbridge, say otherwise. See Sturbridge, 267 Ga. at 786 (citing Matt, 212 Ga. App. 792). In Matt, the Court of Appeals held that, while knowledge of an unreasonable risk of criminal attack was a prerequisite to recovery under OCGA § 51-31, “such knowledge may be demonstrated by evidence of the occurrence of prior substantially similar incidents.” (Emphasis supplied.) Matt, 212 Ga. App. at 794. But Matt did not say that, in every instance, a prior substantially similar crime must be shown in order to establish the foreseeability of a criminal attack. Finally, again, this Court’s more recent opinion in Martin reiterates that “the foreseeability of future criminal acts may be established by evidence of prior criminal acts of a ‘substantially similar’ nature[.]” Martin, 301 Ga. at 331 (II) (A). For these reasons, we reject a reading of Sturbridge that imposes a new requirement, inconsistent with our body of law in this area, that necessarily requires a plaintiff to identify a past crime as an essential element of reasonable foreseeability, and we disapprove of the Court of Appeals’ decisions to the extent they apply that rejected reading of Sturbridge.[12] In the end, the relevant question here is the one our cases have asked for nearly 70 years: whether the totality of the circumstances establish reasonable foreseeability such that the proprietor has a duty to guard against that criminal activity. While evidence of substantially similar prior crimes – crimes with a likeness, proximity, or other relationship to the criminal act at issue that give a proprietor reason to anticipate such an act occurring on the premises – may often be one of the most probative considerations in answering that question, it is not a required consideration, and other circumstances may be relevant, too. And unless the court determines that no rational juror could disagree on the answer, that question is one for the jury. D. Application to the Cases on Appeal Having clarified the relevant legal principles, we now apply them to the cases at hand. (1) Case No. S22G0527 Following a shooting in the parking lot of a CVS store, Carmichael brought this premises liability case against CVS, alleging that it failed to implement adequate security measures to protect its customers. At trial, employees who worked at the store at which Carmichael was injured testified that the store was located in a high-crime area and that the employees and managers considered the parking lot unsafe. The employees further testified that female employees were regularly escorted to their vehicles and that employees parked near the building because of the poor lighting in the parking lot. CVS had previously employed a security guard, and evidence showed that after CVS discharged the security guard, three crimes occurred at the premises prior to the shooting at issue in this case – two armed robberies of employees inside the store (one of which occurred fewer than thirty days before the crime at issue, and the other of which occurred about two years earlier) and one robbery of a customer in the parking lot (approximately six months before the crime at issue). CVS argues on appeal that these three prior crimes were not substantially similar to the one at issue in the underlying case. Specifically, with respect to the two in-store robberies, CVS attempts to distinguish the crimes on the bases that they occurred in the store rather than in the parking lot, were committed against employees rather than customers, and did not involve the discharge of a firearm. As for the parking lot robbery, CVS argues that the crime did not involve the use of a weapon and resulted in a less severe injury. These arguments are unavailing. Prior crimes need not be identical to the crime in question to be relevant evidence bearing on foreseeability. See Sturbridge, 267 Ga. at 787. Accordingly, the facts that the two armed robberies were committed in the store (as opposed to in the parking lot), were committed against employees (as opposed to customers), and did not involve the discharge of a weapon do not, as a matter of law, establish that they were so dissimilar or so remote as to make them improper for consideration with respect to the proprietor’s duty. Viewed as part of the totality of the circumstances, the proximity, timing, frequency, and similarity of the prior acts all informed the question of reasonable foreseeability of the crime at issue. See Sturbridge, 267 Ga. at 786. The in-store crimes and the parking lot robbery of a customer all involved confrontational attacks on persons, and a jury could rationally conclude that they were “sufficient to attract the [proprietor's] attention to the dangerous condition which resulted in the litigated incident,” and were of the sort that could have prompted a “reasonable person . . . [to] take ordinary precautions to protect his or her customers . . . against the risk posed by that type of activity.” Id. at 786-787. See also Piggly Wiggly Southern, Inc. v. Snowden, 219 Ga. App. 148, 149 (1) (a) (464 SE2d 220) (1995) (“Although the attack on plaintiff was far more serious, these prior incidents outside defendant’s store also involved confrontational attacks on persons, and thus, were sufficiently similar to put defendant on notice of the unreasonable danger of criminal attack; the differences were merely of degree.” (emphasis supplied)). And taking into account the totality of the circumstances, the jury was authorized to consider (among other evidence) evidence that female employees were regularly escorted to their vehicles, that the store was in a high-crime area, and that employees considered the parking lot dangerous demonstrated CVS’s knowledge of the hazardous conditions in assessing whether the attack was reasonably foreseeable. Accordingly, we cannot say that no rational juror could find that these prior crimes gave the proprietor reason to anticipate a criminal attack like the one that occurred constituted a risk that the proprietor had a duty to account for. Moreover, while CVS insists that Carmichael’s injury did not result from a condition at the store, this argument misapprehends the principles of reasonable foreseeability relevant to the duty analysis, which must focus on the foreseeability of “the incident causing the injury” as opposed to the foreseeability of the resulting injury. (Emphasis supplied.) Sturbridge, 267 Ga. at 786. Properly understood, CVS’s argument goes to the issue of proximate cause and, for reasons outlined above, lacks merit. As we have discussed, for purposes of determining foreseeability in the proximate causation (as opposed to duty) context, the relevant question is whether, assuming the proprietor had and breached a duty to protect against certain criminal conduct, the kind of harm that occurred was a foreseeable result, or a “probable or natural consequence of,” that breach. Salama, 300 Ga. at 842 (1). Here, there can be little question that a jury would be authorized to find that the harm to Carmichael – being shot by a robber in the parking lot – is the kind of harm that is a probable and natural consequence of the failure to take adequate security measures to protect the property, including the parking lot, from armed robberies. But see Lau’s Corp., 261 Ga. at 494 (3) (“A landowner does not become an insurer of safety by taking some security precautions on behalf of invitees.”). Therefore, we affirm the Court of Appeals’ judgment on these issues. (2) Case No. S22G0617 The claims against Pappas arise from a shooting in its parking lot which resulted in injuries to Welch and the death of her husband, Anthony. The trial court denied Pappas’ motion for summary judgment on Welch’s claims, and the Court of Appeals reversed. Welch challenges that decision, arguing that she produced evidence, including detailed police reports regarding property crimes in the surrounding area, to establish that Pappas was aware of the high number of prior thefts (including thefts of firearms) on the property, which, she says, the Court of Appeals ignored. She further argues that Pappas knew of multiple break-ins at “surrounding” restaurants, hotels, and office complexes, as well as in the “Windy Hill” area, and she points to Pappas’ knowledge of an altercation “down the street” involving armed assailants. According to Welch, the Court of Appeals mischaracterized this evidence as referencing incidents in an undefined “‘area’ and not specifically Pappas’ property” and erroneously concluded that such information constituted “general crime statistics” that were insufficient to raise a question of fact as to foreseeability of risk. 362 Ga. App. at 160-161 (1) (b). Although much of the Court of Appeals’ analysis was sound, we ultimately disagree with its conclusion that the crime at issue was not foreseeable as a matter of law. As an initial matter, the Court of Appeals properly grounded its analysis of reasonable foreseeability in the proprietor’s duty to protect against criminal activity. See id. at 159-160 (1). And the Court of Appeals recognized that evidence of substantially similar prior crimes is not a requirement for finding reasonable foreseeability, and that other evidence that the proprietor knew of the danger can inform the analysis, too. See id. at 160 (1). Ultimately, however, the Court of Appeals’ analysis was too rigid and was not consistent with a totality-of-the-circumstances approach to the question of reasonable foreseeability. First, rather than consider the evidence as a whole to determine whether the jury was authorized to find that the crime was reasonably foreseeable, the Court siloed off the evidence of similar past crimes from “other evidence,” such as evidence of Pappas’ knowledge. More specifically, the Court of Appeals first considered whether the police reports, testimony from Pappas’ and Tactical’s representatives, and the opinion of Welch’s security expert were sufficient to create a factual question on foreseeability with respect to the prior crimes. See id. at 160-163 (1) (a). After concluding they were not, the Court separately considered whether Pappas’ knowledge of the prior crimes was established by the frequency of the prior crimes, emails between Pappas and Tactical, or the testimony of Pappas’ security manager. See id. at 163-164 (1) (b). But the proper analysis considers the proprietor’s knowledge of all the circumstances together to determine whether the proprietor had reason to anticipate the criminal act at issue. See Martin, 301 Ga. at 331 (II) (A). Second, the Court of Appeals was too quick to exclude, as a matter of law, past crimes as relevant to the foreseeability analysis based on certain differences from the criminal act at issue and without considering whether crimes that were not identical might still put the proprietor on notice of a hazardous condition. For example, while specifically recognizing that it was “undisputed that Pappas knew that there were a large number of break-ins in its [parking] lot prior to the shooting,” see Pappas, 362 Ga. App. at 156 (1) (a), it also held that evidence of those prior crimes was insufficient to show that Pappas was on notice of the possibility of a shooting because “there was no evidence of violence occurring in the parking lot or of the use of firearms, only break-ins of unoccupied cars.” See id. at 161 (1) (b). However, the Court of Appeals failed to consider whether the frequency, proximity, or other similarities between the prior crimes and the criminal act at issue raised a question of fact for the jury with respect to reasonable foreseeability. See Sturbridge, 267 Ga. at 786. Indeed, viewing the evidence in the light most favorable to the nonmovant,[13] there was evidence of a large number of break-ins at the Windy Hill location (which included thefts of weapons from automobiles), a vehicle break-in at a property “down the street” that resulted in that suspect firing shots (and which preceded the incident at issue by a year or so), and indications that the “suspects [we]re armed” with respect to incidents at surrounding properties. These were all facts a jury would have been authorized to consider in applying a totality of the circumstances analysis to determine whether it was reasonably foreseeable that the break-ins could escalate to a violent encounter. As such, we conclude that the answer to the question of reasonable foreseeability in this case was not so “plain and palpable” to require judgment as a matter of law. The Court of Appeals erred by reaching a contrary conclusion. See Pappas, 362 Ga. App. at 159-165 (1). Therefore, we reverse the judgment of the Court of Appeals on this issue. III. Under the circumstances of this case, the verdict apportioning no fault to the intentional tortfeasor is not inconsistent. In Case No. S22G0527, CVS gave notice under Georgia’s apportionment statute, OCGA § 51-12-33, that it intended to ask the jury to assign some fault for Carmichael’s injuries to the unknown shooter, who was not a party to the case, and at trial, the jury was instructed regarding apportionment to both named parties and nonparties. The jury returned a verdict in Carmichael’s favor, finding CVS ninety-five percent at fault and Carmichael five percent at fault, while also finding that the shooter bore no fault for Carmichael’s injuries. CVS raised no objection to the verdict before the jury’s release, but in a post-trial motion, CVS challenged the verdict as void, asserting that the jury’s failure to allocate any fault to the shooter conflicted with the requirements of OCGA § 51-1233.[14] This argument was rejected in turn by the trial court and by the Court of Appeals. We thereafter granted certiorari to consider whether a jury could rationally allocate fault to CVS, but no fault to the shooter, an intentional tortfeasor, whose actions directly caused Carmichael’s injuries. While we posed this question in a general sense, as explained more fully below, we now reach the question in a manner limited to the specific facts of this case. And though we disagree with the rationale employed by the Court of Appeals below, we nevertheless affirm its decision. That is, under the specific circumstances of this case, we reject CVS’s argument that the verdict is inconsistent and therefore void because, when considered in light of the trial court’s instructions to the jury here, the verdict can be logically construed. OCGA § 51-12-33, the apportionment statute, provides that, after the amount of damages awarded is reduced according to the plaintiffs percentage of fault, the trier of fact – in this case, the jury – shall “apportion its award of damages among the persons who are liable according to the percentage of fault of each person.” OCGA § 51-12-33 (b). The statute further provides that, “[i]n assessing percentages of fault, the trier of fact shall consider the fault of all persons or entities who contributed to the alleged injury or damages, regardless of whether the person or entity was, or could have been, named as a party to the suit.” OCGA § 51-12-33 (c). See also Couch v. Red Roof Inns, Inc., 291 Ga. 359, 362 (729 SE2d 378) (2012). We have already held that “‘fault,’ as used in OCGA § 51-12-33, encompasses intentional torts.” See Couch, 291 Ga. at 365. When reviewing a jury’s verdict, of course, we keep in mind the “presumption in favor of the validity of verdicts.” Pepsi Cola Bottling Co. v. First Nat’l Bank, 248 Ga. 114, 115 (1) (281 SE2d 579) (1981). See also OCGA § 9-12-4 (“Verdicts shall have a reasonable intendment and shall receive a reasonable construction. They shall not be avoided unless from necessity.”). However, a “verdict that is contradictory and repugnant is void” and will be set aside in a civil case.[15] Anthony v. Gator Cochran Constr., 288 Ga. 79, 79 (702 SE2d 139) (2010). See also Hilltop Terrace, Ltd. v. Baker, 261 Ga. 592, 593 (1) (408 SE2d 704) (1991). For example, we have deemed void a verdict awarding damages to the plaintiff for a defendant’s trespass while concomitantly finding that the defendant owned the land upon which he was found to have trespassed. See Baker, 261 Ga. at 593 (1). See also Thompson v. Ingram, 226 Ga. 668, 671-672 (2) (177 SE2d 61) (1970) (concluding that the verdict was contradictory where the jury found that the defendant was liable for tearing down a fence on the plaintiff’s property while also finding that the property belonged to someone other than the plaintiff). Critically, though, “not merely any irregularity will render a verdict void.” Anthony, 288 Ga. at 80. Rather, “[e]ven if the verdict is ambiguous and susceptible of two constructions, one of which would uphold it and one of which would defeat it, that which would uphold it is to be applied.” (Citation and punctuation omitted.) Id. at 80-81. Here, the trial court instructed the jury in relevant part that if it found “that the damages sustained by the plaintiff were caused by persons or entities who are not parties to the action, [the jury] shall consider the fault of all persons or entities whose negligence contributed to the injury or damage.” (Emphasis supplied.) CVS did not object to the charge as given, and the charge is not challenged on appeal. In its verdict, the jury apportioned ninety-five percent of the fault to CVS, five percent of the fault to Carmichael, and no fault to the unknown shooter. CVS now argues that the verdict is inconsistent and thus void as repugnant because the jury found CVS liable for failing to keep Carmichael safe from an intentional tortfeasor while finding the intentional tortfeasor not at fault. The Court of Appeals rejected that argument, concluding that the verdict was not “indefinite, imperfect, ambiguous, or inconsistent” and, therefore, not void. CVS Pharmacy, 362 Ga. App. at 69 (3). In support of this conclusion, the Court of Appeals reasoned that it was sufficient that the jury “considered” the shooter’s fault without actually apportioning fault to the shooter because the “plain language of [OCGA § 51-13-33 (c)] does not itself require that the trier of fact assign some minimum percentage of fault to each party.” Id. at 70 (3). According to the Court of Appeals, “it is possible that the jury either found that the robber ended up shooting in self-defense and was worthy of no fault or that the jury instead assigned the amount of fault it would have assigned to the shooter to Carmichael[.]” Id. at 70-71 (3). While we agree that CVS has not shown that the verdict is inconsistent, the reasoning employed by the Court of Appeals in reaching that conclusion misses the mark. As an initial matter, we disagree that the apportionment statute’s use of the word “consider” necessarily means that a jury can comply with the statute merely by thinking about apportioning fault. While OCGA § 51-12-33 does not require the jury to apportion fault to each party or nonparty alleged to be at fault in every case, the statute does not authorize the jury to decline to apportion fault to a nonparty where the evidence compels a finding that the nonparty shares some fault for the harm alleged. Further, the Court of Appeals’ attempt to rationalize the verdict is flawed. Because the jury determined that CVS was liable for the injuries Carmichael sustained at the hands of the shooter, it is impossible for the jury to have also found that Carmichael bore all of the fault for the shooting or that the shooter acted in self-defense; a proprietor cannot be found liable for failing to protect an invitee from injuries that the invitee sustained solely as a result of his or her own fault. Thus, the jury verdict appears contradictory on its face. Generally speaking, we have doubts that a jury could logically determine both that a defendant is at fault for failing to protect against a third party’s intentional tortious conduct and that the third party is not at all at fault for his intentional conduct. See Couch, 291 Ga. at 359 (1) (“[A]n assailant who evades hotel security to intentionally abduct, rob, and assault a hotel guest is, at the very least, partially at ‘fault’ for the brutal injuries inflicted by the assailant on that guest. As a party at fault, such an assailant must be included with others who may be at fault . . . for purposes of apportioning damages among all wrongdoing parties.”). See also H&H Subs v. Lim, 213 Ga. App. 371, 372 (1) (444 SE2d 404) (1994) (holding that a verdict finding the principal liable under a theory of vicarious liability but finding the agent not liable was “void and unenforceable” because “there [wa]s no reasonable construction” that could uphold it); LDS Social Svcs. Corp. v. Richins, 191 Ga. App. 695, 698-699 (2) (382 SE2d 607) (1989) (holding that the verdict was repugnant where it simultaneously found that the decedent’s foster mother was not liable for the decedent’s death but that the agency which placed the decedent with the foster mother was liable). But we need not decide that issue in this case. Indeed, when the verdict is considered in light of the jury instructions – specifically, that the jury was to consider “the fault of all persons or entities whose negligence contributed to the injury or damage” – it is susceptible of another construction. That is, a logical jury could have found that an intentional tortfeasor was not negligent in inflicting injury upon the plaintiff. See Reeves v. Bridges, 248 Ga. 600, 603 (284 SE2d 416) (1981) (“It is almost redundant to state that an essential element of an intentional tort is intent to commit the act.”); Roddy v. Tanner Med. Ctr. Inc., 262 Ga. App. 202, 204 (585 SE2d 175) (2003) (“[Evidence of] negligence, without more, is not evidence of a reckless disregard of the rights of others, equivalent to an intentional tort.” (citation and punctuation omitted)). See also Stephanie A. Giggetts, 14 Ga. Jur. § 21:5 (2023) (“Because an intentional tort focuses on the state of mind of the defendant, there can be no such thing as a negligent intentional tort.”); Restatement (Second) of Torts Sec. 282 cmt. d (1965) (“[Negligence] includes only such conduct as creates liability for the reason that it involves a risk and not a certainty of invading the interest of another. It therefore excludes conduct which creates liability because of the actor’s intention to invade a legally protected interest of the person injured or of a third person.”). In other words, the jury could have reasonably believed that the unidentified shooter acted deliberately, as opposed to negligently, with an intent to do harm. Accordingly, because the verdict can be construed in a way that is consistent, we reject CVS’s argument that it is void due to inconsistency. We therefore affirm the judgment of the Court of Appeals. See Anthony, 288 Ga. at 80-81.[16] IV. A party rendering security services to the proprietor may owe a duty of care to third parties on the bases set out in Section 324A of the Restatement (Second) of Torts. In Case No. S22G0618, the trial court denied Tactical’s motion for summary judgment, rejecting the argument that Tactical owed no duty of care to the Welches and finding that questions of material fact remained as to whether Tactical was liable under Section 324A of the Restatement (Second) of Torts (“Section 324A”) for the negligent performance of a voluntary undertaking. The Court of Appeals reversed, holding that Tactical was entitled to summary judgment because “it had no duty toward the Welches as either third-party beneficiaries to its contract with Pappas, or under [Section 324A],” which, the court reasoned, does not apply to “these types of premises liability claims.” Pappas Restaurants, 362 Ga. App. at 161-162 (2). The Court of Appeals further noted that Tactical was entitled to summary judgment because the crime was not foreseeable. Id. at 162 (2). We thereafter granted certiorari to decide whether, under Georgia law, a party rendering security services to an owner or occupier of land owes a duty of care to third parties on the bases set out in Section 324A. For the reasons that follow, we answer that question in the affirmative. We further hold that the scope of the duty owed may be informed by the contract between the security provider and the proprietor. This Court has described Section 324A “as an accurate statement of the common law.” Herrington v. Gaulden, 294 Ga. 285, 287 (751 SE2d 813) (2013). See also Huggins v. Aetna Cas. & Sur. Co., 245 Ga. 248, 249 (264 SE2d 191) (1980) (adopting “the majority rule” as stated in Section 324A). Section 324A provides: One who undertakes, gratuitously or for consideration, to render services to another which he should recognize as necessary for the protection of a third person or his things, is subject to liability to the third person for physical harm resulting from his failure to exercise reasonable care to protect his undertaking, if (a) his failure to exercise reasonable care increases the risk of such harm, or (b) he has undertaken to perform a duty owed by the other to the third person, or (c) the harm is suffered because of reliance of the other or the third person upon the undertaking. A party may be liable for a failure to exercise reasonable care with respect to a voluntary undertaking only if one or more of the requirements stated in Section 324A is present. Initially, cases considering Section 324A often did so in the context of negligent inspection claims. See Universal Underwriters Ins. Co. v. Smith, 253 Ga. 588, 589-590 (III)-(IV) (322 SE2d 29) (1984); Huggins, 245 Ga. at 248; Davenport v. Cummins Alabama, Inc., 284 Ga. App. 666, 672-673 (2) (644 SE2d 503) (2007); Finley v. Lehman, 218 Ga. App. 789, 790-791 (1) (463 SE2d 709) (1995); Wright v. Osmose Wood Preserving, Inc., 206 Ga. App. 685, 687-688 (1) (426 SE2d 214) (1992); Fosgate v. American Mut. Liability Ins. Co., 161 Ga. App. 376, 376 (288 SE2d 647) (1982); American Mut. Liability Ins. Co. v. Jones, 157 Ga. App. 722, 722 (278 SE2d 410) (1981); Argonaut Ins. Co. v. Clark, 154 Ga. App. 183, 184-187 (2) (267 SE2d 797) (1980); St. Paul Fire & Marine Ins. Co. v. Davidson, 148 Ga. App. 82, 83 (2) (251 SE2d 32) (1978). But negligent undertaking claims brought pursuant to Section 324A are not so limited and can arise in other contexts. See Restatement (Second) of Torts § 324A cmt. b (“This Section applies to any undertaking to render services to another, where the actor’s negligent conduct in the manner of performance of his undertaking, or his failure to exercise reasonable care to complete it, or to protect the third person when he discontinues it, results in physical harm to the third person or his things.” (emphasis supplied)). See, e.g., Herrington, 294 Ga. at 288 (considering Section 324A in a medical malpractice context); Hyde v. Schlotzsky’s, Inc., 254 Ga. App. 192, 193 (561 SE2d 876) (2002) (considering a negligent undertaking claim under Section 324A based on the defendant’s alleged failure to insure minimum standards for cleanliness and sanitation in its restaurant); Herrin Business Products, Inc. v. Ergle, 254 Ga. App. 713, 715-716 (2) (563 SE2d 442) (2002) (considering Section 324A in the context of a claim that the defendant was negligent “in failing to satisfy the duties it assumed in attempting to render aid” to an employee); BP Exploration & Oil, Inc. v. Jones, 252 Ga. App. 824, 830-832 (2) (a)- (c) (558 SE2d 398) (2001) (considering negligence claim under Section 324A arising from the defendant’s handling of customer complaints); Beam v. Omark Indus., Inc., 143 Ga. App. 142, 144-145 (1) (b) (237 SE2d 607) (1977) (considering Section 324A in the context of a products liability suit). And we see no basis in the law to artificially limit the common-law duties reflected in Section 324A in negligent-security premises-liability cases.[17] Cf. Adler’s Package Shop, Inc. v. Parker, 190 Ga. App. 68, 70-72 (1) (b) (378 SE2d 323) (1989) (considering Section 324A and its subsections in relation to a claim for negligent performance of security operations and ultimately concluding that the section was inapplicable to the claim). The Court of Appeals has repeatedly held that the duty imposed upon an owner or occupier of land by OCGA § 51-3-1 is nondelegable. See Camelot Club, 340 Ga. App. at 627 (2) (b); Davidson v. Meticulously Clean Sweepers, LLC, 329 Ga. App. 640, 643 (1) (765 SE2d 783) (2014); FPI Atlanta, LP v. Seaton, 240 Ga. App. 880, 886 (5) (a) (524 SE2d 524) (1999) (physical precedent only); Johnson v. Kimberly Clark, 233 Ga. App. 508, 510 (504 SE2d 536) (1998); Griffin v. AAA Auto Club South, Inc., 221 Ga. App. 1, 2 (1) (470 SE2d 474) (1996). But this means only that an owner “will not be excused from liability for an injury occurring on his property unless he delivered full possession and complete control of the premises to a third party.” (Punctuation and citation omitted.) Sherwood v. Williams, 347 Ga. App. 400, 402-403 (1) (a) (820 SE2d 141) (2018). The duty imposed upon an owner or occupier of land by OCGA § 51-3-1 is inapplicable to independent contractors, such as parties providing security services. Cf. Davidson, 329 Ga. App. at 643 (1); Maddox v. Cumberland Distrib. Svcs. of Georgia, Inc., 236 Ga. App. 170, 171 (1) (511 SE2d 270) (1999); Kelley v. Piggly Wiggly Southern, Inc., 230 Ga. App. 508, 509 (1) (496 SE2d 732) (1997). Accordingly, a party providing security services as an independent contractor cannot be held liable under a theory of premises liability. See Maddox, 236 Ga. App. at 171 (1). However, a party providing security services still may be held liable in tort for the negligent performance of voluntarily undertaken duties because that party has a duty to use reasonable care in carrying out its voluntary undertaking. See Davidson, 329 Ga. App. at 643-646 (2); Osowski v. Smith, 262 Ga. App. 538, 540 (1) (586 SE2d 71) (2003); Kelley, 230 Ga. App. at 509 (1); Seaton, 240 Ga. App. at 890 (Pope, J., concurring specially); Sims v. American Cas. Co., 131 Ga. App. 461, 473 (4) (206 SE2d 121) (1974). See also Crockett v. Uniroyal, Inc., 772 F2d 1524, 1531 (II) (11th Cir. 1985) (citing Section 324A and holding that “[o]ne who undertakes to perform a task must perform it in a non-negligent manner”). And where a contract sets forth the duties alleged to be the basis of the negligent undertaking claim found in Section 324A, the scope of the duties contractually agreed upon will inform the question of whether a party – here, a security company – “has undertaken to perform a duty owed by the other to the third person.” See, e.g., Urban Svcs. Group, Inc. v. Royal Group, Inc., 295 Ga. App. 350, 351-353 (1) (671 SE2d 838) (2008) (determining, in the context of a Section 324A claim, whether the defendant had a duty to clear ice from the courthouse steps based on the contract between it and the General Services Administration). The duty to exercise ordinary care in performing the services assumed under a contract arises not from the contractual obligation but from Georgia tort law. See, e.g., Sims, 131 Ga. App. at 469 (4) (noting that the failure to exercise ordinary care in performing a safety inspection one has contracted to undertake gives rise to common-law tort liability); ENGlobal U.S., Inc. v. Gatlin, 449 SW3d 269, 281-282 (III) (B) (II) (Tx. Ct. App. 2014) (noting that, under Section 324A, duty is generally understood as a tort obligation). Accordingly, the Court of Appeals erred in concluding that Section 324A categorically does not apply in the premises liability context. We therefore vacate the judgment of the Court of Appeals on this issue, see Pappas, 362 Ga. App. at 161-163 (2), and remand for further proceedings consistent with this opinion.[18] V. Conclusion In rendering our decision, we are mindful of the economic and policy arguments advanced by the parties and the amici. But such considerations are reserved to the General Assembly. This Court is bound by what the law is and not what the parties or the members of this Court think it should be. As such, we are bound to affirm the ruling of the Court of Appeals in Case No. S22G0527. And we must reverse in part and vacate in part the judgments of the Court of Appeals in Case Nos. S22G0617 and S22G0618 and remand for reconsideration consistent with this opinion. Judgment affirmed in Case No. S22G0527. Judgments reversed in part and vacated in part, and cases remanded with direction in Case Nos. S22G0617 and S22G0618. All the Justices concur, except McMillian and LaGrua, JJ., who concur specially in Division II. Boggs, C. J., not participating and Peterson, P. J., disqualified. McMillian, Justice, concurring specially. I concur fully in the majority’s conclusions in Divisions III and IV. And I agree that a proprietor’s duty to protect its invitees against third-party criminal acts is defined by the foreseeability of the criminal act at issue. See Martin v. Six Flags Over Georgia II, L.P., 301 Ga. 323, 328 (II) (801 SE2d 24) (2017); Sturbridge Partners, Ltd. v. Walker, 267 Ga. 785, 785-86 (482 SE2d 339) (1997). However, while I applaud the majority’s efforts to further clarify the law of premises liability in Division II, I do not agree with all that is said in that Division. In particular, I am concerned about the breadth and generalized nature of the majority’s analysis, which goes far beyond deciding the premises liability issues presented in these cases. I believe the cases can and should be resolved under current Georgia law, and when that law is properly applied, each of these cases presents a jury question on the issue of foreseeability. Therefore, I concur only in the results of the majority’s analysis in Division II (D). I agree with much of what the majority sets out in explaining when a duty arises to exercise ordinary care to protect against criminal acts perpetrated by third parties. Georgia law provides that an intervening criminal act by a third party generally insulates a proprietor from liability, and an exception arises only where the criminal act was reasonably foreseeable. See Sturbridge, 267 Ga. at 785-86; Tara Bridge Apartments, LP v. Benson, 365 Ga. App. 647, 649-50 (879 SE2d 531) (2022). Therefore, “[i]f the proprietor has reason to anticipate a criminal act, he or she then has a duty to exercise ordinary care to guard against injury from dangerous characters.” Lau’s Corp. v. Haskins, 261 Ga. 491, 492 (1) (405 SE2d 474) (1991) (citation and punctuation omitted). We considered the issue of foreseeability in Sturbridge, where the plaintiff filed a premises liability claim against her landlord and others after she was sexually assaulted in her apartment in the early morning hours. The plaintiff alleged that because three prior daytime burglaries of empty apartments had occurred and the landlord was aware of two of them, her assault was reasonably foreseeable. We determined based on the landlord’s knowledge of the prior burglaries that “it was reasonable to anticipate that an unauthorized entry might occur while an apartment was occupied and personal harm to a tenant could result,” thus creating a jury issue as to “whether or not Sturbridge had the duty to exercise ordinary care to safeguard its tenants against the foreseeable risks posed by the prior burglaries.” Sturbridge, 267 Ga. at 787.[19] Because Sturbridge concerned the landlord’s knowledge of prior criminal acts, we discussed the issue of foreseeability in that context. We concluded that, where the issue of foreseeability arises under such circumstances, “the incident causing the injury must be substantially similar in type to the previous criminal activities occurring on or near the premises so that a reasonable person would take ordinary precautions to protect his or her customers or tenants against the risk posed by that type of activity.” Sturbridge, 267 Ga. at 786. We noted that whether a prior incident made the litigated incident reasonably foreseeable required consideration of “the location, nature and extent of the prior criminal activities and their likeness, proximity or other relationship to the crime in question.” Id. But we explained that “substantially similar” does not mean that the two crimes need be identical; rather, “[w]hat is required is that the prior incident be sufficient to attract the landlord’s attention to the dangerous condition which resulted in the litigated incident.” Id. (citation and punctuation omitted). Thus, I believe that Sturbridge requires the existence of substantially similar prior crimes, but it defines such crimes as those that alert the proprietor to a dangerous condition that later results in the incident causing the plaintiff’s harm. See also Tyner v. Matt-Troncoso, 305 Ga. 480, 485 n.7 (826 SE2d 100) (2019) (“In those cases, reasonable foreseeability of the risk is essential to proving liability; plaintiffs must show that the landlord had a reason to anticipate or foresee the harmful acts of others based on prior experience with substantially similar types of acts that gave the landlord superior knowledge of the danger posed.”). The majority claims that “[p]roperly understood, . . . Sturbridge does not hold that a plaintiff must point to a past crime (substantially similar or otherwise) to establish reasonable foreseeability,” because it was a “given” in Sturbridge that there existed past crimes committed in the area and that the context in which the Sturbridge Court explained that “the incident causing the injury must be substantially similar in type to the previous criminal activities” was to clarify that substantial similarity was required. Maj. Op. at 29-32. But that reading of Sturbridge turns on its head the “given” assumed by that Court – that there must be some evidence of past crimes in order to establish foreseeability of a criminal attack – and reaches the opposite conclusion that no such evidence of past crimes is required at all. Indeed, this Court and multiple decisions of the Court of Appeals have read Sturbridge as establishing a bright-line rule that a plaintiff must, at a minimum, point to substantially similar crimes to establish a proprietor’s duty to protect against criminal attacks. See e.g., Tyner, 305 Ga. at 485 n.7; Maj. Op. at 28-29 (citing Court of Appeals cases). So what is the upshot of the majority’s new “totality of the circumstances test”? The majority explains: “While evidence of substantially similar prior crimes – crimes with a likeness, proximity, or other relationship to the criminal act at issue that give a proprietor reason to anticipate such an act occurring on the premises – may often be one of the most probative considerations in answering that question, it is not a required consideration, and other circumstances may be relevant too.” Maj. Op. at 34. However, it is unclear what other circumstances may be relevant. Although purporting to craft a totality-of-the-circumstances test that includes consideration of whether the premises was located in a high crime area, even the majority acknowledges in footnote 9 that the fact that a business is situated in a high crime area does not alone create a duty in a proprietor to protect invitees from any and all crimes that might occur. Rather, if a proprietor has knowledge of substantially similar crimes on or near his business premises, the fact that the business is also in a high crime area can be considered in the foreseeability analysis, which is entirely consistent with the Sturbridge standard. The majority also mentions that “evidence that the landowner had knowledge of a volatile situation brewing on the premises,” could also support a duty to protect against criminal attacks. Maj. Op. at 26 (quoting Martin, 301 Ga. at 331 (II) (A)). But it is unclear what a “volatile situation” may be, how a landowner can have knowledge about whether one is “brewing,” and how much time is required for a situation to be “brewing.” Because I believe that Sturbridge remains good law and requires, at a minimum, evidence of substantially similar crimes to establish foreseeability of a criminal attack, I would resolve the issue of foreseeability under Sturbridge and other comparable authority, without crafting a new standard in an attempt to provide guidance for factual situations not at issue here. We are not presented, for example, with a situation where the only evidence relative to foreseeability was that the proprietor’s business was in a high crime area or that a volatile situation existed, and thus we need not address whether the Sturbridge standard ought to be reconsidered in such situations. Applying the Sturbridge standard, I agree with the majority that the evidence presented in each of these cases is sufficient to raise a jury question on the issue of foreseeability. In Case No. S22G0527, the evidence showed that the CVS was considered to be in a high crime area and that the managers and employees considered the parking lot unsafe and took added precautions as a result. But the evidence also showed that within the six months prior to the crime, two armed robberies of employees had occurred, along with a “purse-snatching” of a customer in the parking lot, which was sufficient to raise a jury issue as to whether it was foreseeable that an armed confrontation with a customer could occur in the parking lot. And in Case No. S22G0617, given the evidence that the proprietor was aware of prior automobile break-ins in its parking lot and of armed suspects committing other crimes in the area, a jury must decide whether it was reasonable to anticipate that a customer could confront an armed person as he approached his car in the parking lot.[20] The majority’s attempt to craft a standard that would not require the existence of prior, substantially similar crimes before imposing liability has the potential to increase the liability of proprietors, landlords, and property owners for the criminal acts of third parties and will most certainly result in more cases going to trial with the concomitant burden of attorneys’ fees and costs and loss of time and other resources in litigation. In other words, the way that the majority has crafted the “reasonably foreseeable” exception would all but swallow the general rule that a proprietor has no duty to protect invitees from third-party criminal acts because essentially any circumstance would be sufficient to create a jury issue as to reasonable foreseeability and a proprietor’s duty. The bright-line rule in Sturbridge has been the law for over 25 years, and during that time period, the legislature has not seen fit to change that standard. To what extent and under what circumstances proprietors should be held liable for third-party criminal acts are decisions best left to the legislature, which can consider the policy and practical implications – especially in high crime areas – of increasing such liability and the cost of doing business. I am authorized to state that Justice LaGrua joins in this special concurrence. LaGrua, Justice, concurring. These cases present a challenging issue regarding the scope of a proprietor’s liability to invitees when the criminal conduct of a third party causes injuries to said invitees. I write separately because I am concerned about the impact these laws have on those who reside in such “high crime areas” and who could face the harsh and mounting reality that businesses—faced with an increased exposure to liability because of the very area in which they have chosen to do business—will cease operations or raise their prices to offset the costs of additional security measures. And I wonder how these forced business decisions will impact the residents who would lose ready access to resources they need for daily life because they are no longer available or affordable. I would urge our General Assembly to consider these issues as they institute laws imposing premises liability on businesses in this State. I am authorized to state that Justices McMillian and Colvin join in this concurrence. Pinson, Justice, concurring. I join the Court’s opinion in full. I write to make clear the limited scope of the Court’s decision in Division III about the verdict in this case. In granting review of this case, we asked a narrow question about the verdict: whether a rational factfinder apportioning fault could determine that an intentional tortfeasor whose actions directly caused the plaintiff’s injuries bears no fault for those injuries. In other words, we asked whether an apportionment verdict like the one in this case was inconsistent. After briefing and argument, it became clear that this case did not present even that narrow question as a general matter, because the jury in this case was instructed to apportion only negligence, not fault generally (and no one objected to that instruction). As we explain in Division III, although it is doubtful that a jury could rationally find a proprietor liable for injuries caused by a criminal attack without apportioning some fault to the assailant, a jury asked to apportion only negligence could have rationally concluded that the assailant was zero-percent negligent, because intentional conduct is not negligence. So we are bound to conclude that, under these particular circumstances, CVS failed to show that the verdict was inconsistent. Given the narrow question presented and our still narrower holding, we do not decide certain other questions that may warrant review in an appropriate case. First, we do not decide the question presented in its more general sense. Although the Court’s opinion expresses doubt that a jury could rationally find a proprietor liable for injuries caused by a criminal attack without apportioning some fault to the assailant—where the jury has been instructed to apportion fault and not just negligence—we have left that un- presented question for another day. Second, we do not decide whether, separate and apart from arguments about inconsistency, a jury’s verdict violates OCGA § 51-12-33 if it fails to apportion fault to a criminal assailant who directly inflicted the plaintiff’s injuries. And third, we do not decide whether a verdict that violates OCGA § 51-12-33 is for that reason void, or merely erroneous—a characterization that determines whether an argument that a verdict should be set aside for violating that statute may be waived if that objection is not made at trial. See Benchmark Builders, Inc. v. Schultz, 289 Ga. 329, 330 (1) (711 SE2d 639) (2011) (“a party does not waive an objection to a verdict that is void, as opposed to voidable, by failing to object to the verdict form or the verdict as rendered before the jury is released”); Anthony v. Gator Cochran Const., Inc., 288 Ga. 79, 80 (702 SE2d 139) (2010) (same). With this understanding of Division III, I join the Court’s opinion in full. I am authorized to state that Justice Bethel joins in this concurrence.
