Markle, Judge. After Cynthia Welch was injured and her husband Anthony was killed in a shooting in the parking lot of Pappadeaux Restaurant, she sued Pappas Restaurant Group, which owned the property, and Tactical Security Group, LLC, which provided the on-site security guards.[1] The trial court denied Pappas’s and Tactical’s motions for summary judgment, and we reversed. See Pappas Restaurants v. Welch, 362 Ga. App. 152 (867 SE2d 155) (2021). The Supreme Court of Georgia granted certiorari, reversed our opinion in part, vacated it in part, and remanded the case to this Court for further consideration. See Georgia CVS Pharmacy v. Carmichael, 316 Ga. 718, 736 (II) (D) (2), 743 (IV) (890 SE2d 209) (2023). Specifically, with regard to Pappas’s motion, our Supreme Court concluded that foreseeability is generally a question of duty and, considering the totality of the circumstances, was not so “plain and palpable” in this case as to permit summary judgment. Carmichael, 316 Ga. at 735-736 (II) (D) (2). As to Tactical’s motion, the Court concluded that a security company could be liable in tort for the negligent performance of its duties under the Restatement (Second) of Torts § 324A (“Section 324A”), and that the scope of the security company’s duty “may be informed by the contract” between Tactical and Pappas. Id. at 740 (IV), 743 (IV). We now reconsider the appeals with the benefit of our Supreme Court’s review, and we conclude that the trial court properly denied both motions for summary judgment because there remain issues of fact that must be decided by a jury. Accordingly, we affirm. To prevail at summary judgment under OCGA § 91156, the moving party must demonstrate that there is no genuine issue of material fact and that the undisputed facts, viewed in the light most favorable to the nonmoving party, warrant judgment as a matter of law. On appeal from the grant of summary judgment this Court conducts a de novo review of the evidence to determine whether there is a genuine issue of material fact and whether the undisputed facts, viewed in the light most favorable to the nonmoving party, warrant judgment as a matter of law. (Citation omitted.) LittleThomas v. Select Specialty Hosp.Augusta, 333 Ga. App. 362, 363 (773 SE2d 480) (2015). We previously set forth the relevant facts as follows: Pappas owns Pappadeaux and another restaurant on the same property on Windy Hill Road, with parking lots for each and a lower lot for overflow parking. The parking lots are welllit, and there are surveillance cameras throughout the area. To patrol the grounds, Pappas hired Tactical to provide unarmed, uniformed security guards to deter crime such as automobile breakins and loitering, and to assist with traffic issues. On Friday nights, two guards were assigned to patrol the lots, and a third guard was stationed in the fire lane in front of Pappadeaux to monitor traffic. The guards patrolled the lots on foot or in marked security cars with flashing lights. On Friday, October 7, 2016, Welch and her husband went to dinner at Pappadeaux and parked in the lower lot. Because the restaurants were extremely crowded that night, with customers waiting over an hour to be seated, there were many people in the parking lot area. Although there were three guards on site most of that evening, one guard left at 10 p.m. After that, one of Tactical’s guards patrolled the parking lot while the second guard remained stationed in the fire lane. Shortly after 10 p.m., as the Welches walked through the parking lot back to their car, a man stepped in front of them, demanded their belongings, and then shot both of them. Anthony was killed. The shooter and his accomplices were later captured and convicted of murder. Pappas Restaurants, Inc., 362 Ga. App. at 153. Welch sued Pappas and Tactical for premises liability, negligence, and wrongful death.[2] Both defendants moved for summary judgment, which the trial court denied. This interlocutory appeal followed. Case No. A21A1341 1. In this appeal, Pappas contends that the trial court erred in denying its summary judgment motion because the attack was not foreseeable and thus it had no duty to protect against it. It further argues that Welch failed to establish proximate cause because the evidence was wholly speculative. We conclude that the trial court properly denied summary judgment because there remain factual questions as to both the foreseeability of the crime and causation.[3] a. Duty. “As a general rule, in order to recover on a premises liability claim arising from thirdparty criminal conduct, a plaintiff must present evidence of a duty, a breach of that duty, causation, and damages.” Carmichael, 316 Ga. at 721 (II) (A). As to duty, it is well settled that a proprietor owes its invitees a duty “to exercise ordinary care in keeping the premises and approaches safe.” OCGA § 5131. But, “the landowner is not an insurer of an invitee’s safety. An intervening criminal act by a third party generally insulates a landowner from liability unless such criminal act was reasonably foreseeable.” (Citation omitted.) Rautenberg v. Pope, 351 Ga. App. 503, 505 (1) (831 SE2d 209) (2019). When we consider whether a criminal act was reasonably foreseeable so as to establish a duty, our Supreme Court has instructed that we are to apply a totality of the circumstances approach. Carmichael, 351 Ga. at 728-732 (II) (C). Here, the evidence showed that Pappas knew a substantial number of car break-ins and property crimes had occurred on its property and in the surrounding area. Welch’s expert opined that the prior criminal activity in the parking lot and nearby put Pappas on notice, especially in light of the deficiencies in Pappas’s security plans. And Tactical suggested to Pappas that it increase security coverage because visible guards act as a deterrent. Thus, when we consider the totality of this evidence, we conclude that the facts raise a jury question on the issue of foreseeability. Id. at 735-736 (II) (D) (2). b. Breach. But establishing that there is a jury question as to duty does not end the inquiry. As our Supreme Court explained, a finding that thirdparty criminal conduct was reasonably foreseeable and thereby gave rise to a duty to protect invitees from that harm does not itself establish the proprietor’s liability for the plaintiff’s injury. Instead, a factfinder must go on to address the next element of negligence: to determine whether the proprietor acted reasonably in the face of the particular foreseeable risk or whether the proprietor breached its duty to do so. So, foreseeability bears on this separate inquiry, too, but in a relative sense: for example, the factfinder must weigh the likelihood and severity of the foreseeable harm against the cost and feasibility of additional security measures in considering whether the duty owed was breached. Carmichael, 316 Ga. at 723 (II) (A). Notably, Pappas does not argue that its conduct did not breach the duty.[4] Thus, for purposes of this appeal we will assume that it does, and we then consider whether Welch can show that the breach was the proximate cause of Anthony’s death. c. Causation. In analyzing proximate case, “the relevant question is whether, assuming the proprietor had and breached a duty to protect against certain criminal conduct, the kind of harm that occurred was a foreseeable result, or a ‘probable or natural consequence of,’ that breach.” (Citation and punctuation omitted.) Carmichael, 316 Ga. at 734 (II) (D) (1). But “probable, in the rule as to causation, does not mean ‘more likely than not,’ but rather ‘not unlikely’; or, more definitely, such a chance of harm as would induce a prudent man not to run the risk; such a chance of harmful result that a prudent man would foresee an appreciable risk that some harm would happen.” (Citation and punctuation omitted.) Paradise Entertainment Group v. Favors, 363 Ga. App. 636, 639 (1) (a) (871 SE2d 916) (2022). The requirement of proximate cause constitutes a limit on legal liability; it is a policy decision that, for a variety of reasons, e.g., intervening act, the defendant’s conduct and the plaintiff’s injury are too remote for the law to countenance recovery. And, a general rule of proximate cause is that a wrongdoer is not responsible for a consequence which is merely possible, according to occasional experience, but only for a consequence which is probable, according to ordinary and usual experience. (Citations and punctuation omitted.) Goldstein, Garber & Salama v. J. B., 300 Ga. 840, 842 (1) (797 SE2d 87) (2017); see also Suresh & Durga v. Doe, 369 Ga. App. 787, 795-796 (1) (b) (iii) (894 SE2d 602) (2023). Evidence seeking to establish causation cannot be speculative or too uncertain. Tara Bridge Apartments v. Benson, 365 Ga. App. 647, 652 (a) (879 SE2d 531) (2022); see also Stadterman v. Southwood Realty Co., 361 Ga. App. 613, 615 (1) (865 SE2d 231) (2021) (“[A] mere possibility of such causation is not enough[.]“). With these standards in mind, we consider the evidence Welch presented to establish causation, including the testimony of various Pappas and Tactical employees, video surveillance of the attack, and expert testimony from John Villines. The video surveillance from the night of the shooting showed two officers located in the fire lane, when one should have been patrolling the lower lot. Video also showed Tactical guards talking with Pappas employees, giving customers a ride from the parking area, and smoking. Pappas’s head of security, Scott Heenan, testified that he made the decision to hire security, and there were two guards assigned to the Pappadeaux’s lot, one of whom remained in the fire lane, and one guard assigned to the Pappasito’s lot. The guards were there to provide a visible deterrent to crime by patrolling the parking area. Heenan’s testimony confirmed that Pappas was aware of, and took action to stop, property crimes such as break-ins of unattended cars, and that they had been successful in deterring property crimes in the parking lot. Heenan expected the guards to be patrolling during their shift, and not sitting together in cars for prolonged periods. Joann Altman, one of Pappas’s security managers, acknowledged that Pappas had a responsibility to oversee the security company and guards used at the property. According to Altman, Pappas gave Tactical post orders for the guards to follow and offered training programs that overlapped with those orders. The guards assigned to the lots were supposed to patrol and be visible. In e-mails sent about a year before the shooting, one of Tactical’s owners informed Altman that its guards and patrols had been a “great deterrent” and that there had “not been a single break in at the Windy Hill location” despite news reports of automobile break-ins with armed suspects in surrounding complexes. Altman responded that they should continue having a second guard on site, and added, “[l]ooks like things are really scary over there.” The week before the shooting occurred, Tactical advised Pappas of an increase in crime in the “area.” And, a few days before the incident, Tactical notified Altman that there had been 69 car break-ins in “the Atlanta area” in the past week, and that it was “a professional crew that [had] the police baffled.” Tactical’s owners suggested adding additional guards Monday through Thursday nights, but Altman deferred to Heenan, stating, “I know it can get crazy out there, but we have to balance this with our budget[.]” According to an e-mail from Altman on Oct. 3, 2016, Pappas expected the fire lane officer to work until ten p.m., but Tactical had the fire lane guard scheduled to work until later into the evening. Tactical security officer Jerry McRae, who was stationed in the fire lane the night of the shooting, explained that one officer would be stationed in the fire lane to prevent anyone from parking there, and the other two would patrol the upper and lower lots. McRae admitted that it would be problematic if the video showed that the officers did not patrol several times an hour. He also agreed that there was no need for two officers to be parked in the fire lane. Tactical’s owners, Jose Henares and Mark Hilderbrandt, testified that it was important to do a security survey and threat analysis when evaluating security needs, and based on these studies, Tactical would make suggestions as to the number of security guards to deploy. But it was ultimately up to Pappas to determine how many guards it wanted to have on site and where those guards would be located. Tactical explained that increasing the number and visibility of guards helped reduce the number of car break-ins and provided safety for the customers. One of Tactical’s former security officers, Patrick Cormier, testified that he was generally aware of car break-ins on the property, but had not been told of an increase in incidents in the weeks leading up to the shooting. Cormier opined that it would have been important to know this so that the guards could adjust accordingly. Cormier would expect the guards on duty to patrol at least three times an hour, and he noted that it was difficult to control people loitering because the restaurants were busy and people often had to wait. Cormier admitted that on the night of the shooting, one of the guards left at ten p.m.; the second guard did not patrol according to schedule; and the third guard on patrol was distracted by customers and transporting women in his security vehicle. He conceded that it would be a “problem” if two officers remained in the fire lane for extended periods during their shifts. Welch also submitted testimony from security expert John Villines, who opined that the security was deficient in numerous ways. According to Villines, Pappas (1) failed to assess areas of vulnerability; (2) was deficient in its record keeping and training, which led to uninformed decisions about security measures; (3) did not have a written security plan or post orders and/or failed to inform Tactical of such orders; (4) failed to properly use video surveillance; and (5) failed to supervise its security services. Villines further opined that Tactical failed to screen, train, and supervise its security officers. As to the specific attack, Villines asserted that Tactical failed to adequately patrol the lots that evening. According to Villines,[5] it would have been reasonable for Pappas to utilize a security consultant to establish a plan; create written policies and procedures; enter into a contract to supervise security personnel; and implement video surveillance. He further explained that Tactical should have taken reasonable measures to develop post orders, adequately screen, train, and supervise its security guards, and adequately patrol the parking areas. He opined that, had these steps been taken, it was “more likely than not” that the shooting would have been deterred. He explained that the failure to provide more security in the face of increasing criminal activity enabled Anthony’s killers to access the parking lot, loiter for several minutes undetected, commit the crime, and escape. He stated that the assailants were likely “deterrable,” and that the presence of attentive security officers probably would have prevented the crime. Although Pappas contends that this evidence is purely speculative as to whether increased security would have prevented the murder, we conclude that the evidence was sufficient to raise a factual question as to causation.[6] See Suresh & Durga, 369 Ga. App. at 795-796 (1) (b) (iii). There was testimony from Pappas and Tactical employees that security had reduced crime on the property, leading to the conclusion that Welch has offered more evidence than speculative expert testimony. Ga. CVS Pharmacy v. Carmichael, 362 Ga. App. 59, 67 (1) (c) (865 SE2d 559) (2021) (evidence that former guards had been a crime deterrent, along with expert opinion that adequate security would likely have prevented attack, was sufficient for jury to determine causation), affirmed by Carmichael, 316 Ga. at 734 (II) (D) (1). And that is not the only evidence the jury could consider. There was also testimony that only two officers were on duty that night, instead of three, and the video surveillance showed the officers stationed in the fire lane and distracted by customers. There was also evidence that Pappas was aware of an increase in crime in the area in the weeks before the murder, and that Tactical had recommended additional security. Thus, it is for the jury to weigh the evidence and determine if Pappas’s conduct was the proximate cause of Anthony’s murder. Suresh & Durga, 369 Ga. App. at 796 (1) (b) (iii); see also James v. Flash Foods, 267 Ga. App. 210, 213 (598 SE2d 919) (2004) (summary judgment improper where there was evidence of prior criminal activity, defendant failed to follow its security policies, and expert opined that defendant’s security measures were insufficient) (physical precedent only); FPI Atlanta, L.P. v. Seaton, 240 Ga. App. 880, 884 (2) (524 SE2d 524) (1999) (causation was question of fact for jury); compare Stadterman, 361 Ga. App. at 616 (1) (plaintiff failed to raised question as to causation where there was no evidence in the record to support plaintiff’s claim that presence of courtesy officer in apartment complex would have prevented shooting). Accordingly, we affirm the trial court’s denial of Pappas’s motion for summary judgment. Case No. A21A1342. 2. In its appeal, Tactical argues that it was entitled to summary judgment because its duty was limited by the terms of the contract, which was only to provide visible security; it acted with due care to perform its contractual duties; and any evidence that the crime would have been prevented had the guards’ conduct been different is speculation.[7] We disagree. As our Supreme Court explained, a security company can be liable under the Section 324A, and the duty of such security services can be based on the terms of the contract. Carmichael, 316 Ga. at 740 (IV). Under Section 324A, which we have adopted in Georgia, Huggins v. Aetna Casualty & Surety Co., 245 Ga. 248, 249 (264 SE2d 191) (1980), [o]ne who undertakes, gratuitously or for consideration, to render services to another which he should recognize as necessary for the protection of a third person or his things, is subject to liability to the third person for physical harm resulting from his failure to exercise reasonable care to protect his undertaking, if (a) his failure to exercise reasonable care increases the risk of such harm, or (b) he has undertaken to perform a duty owed by the other to the third person, or (c) the harm is suffered because of reliance of the other or the third person upon the undertaking. See also Glover v. Ga. Power Co., 347 Ga. App. 372, 376-377 (1) (819 SE2d 660) (2018); Fair v. OCGA § Underground, 340 Ga. App. 790, 796 (3) (798 SE2d 358) (2017). a. Application of Section 324A. Our case law has not consistently set out the manner in which to analyze a claim under Section 324A. We have implied that Section 324A relates to duty. See, e.g., Whitmire v. Ga. Power Co., 270 Ga. App. 586, 592 (2) (607 SE2d 213) (2004); Wright v. Osmose Wood Preserving, 206 Ga. App. 685, 687-688 (1) (426 SE2d 214) (1992) (physical precedent only). More recently, we considered if there was any evidence of the defendant’s negligence before considering whether any of the subsections applied. See Davidson v. Meticulously Clean Sweepers, 329 Ga. App. 640, 644-646 (2) (765 SE2d 783) (2014) (considering first whether the defendant was negligent, then applying Section 324A). This approach is consistent with the analysis set out in other states. See, e. g., Peredia v. HR Mobile Svcs. 25 Cal. App. 5th 680, 688 (I) (B) (2) (Cal. Ct. App. 2018) (in a negligent undertaking claim, first questions are whether there was a duty, i. e. an undertaking to provide services, and whether the defendant should have known its services were necessary for the protection of others and, only if those are present would the court consider the subsections of Section 324A). Applying that approach here, we first consider what duty Tactical owed to Pappas. In this regard, we may look to the terms of the contract to establish what services were required.[8] Carmichael, 316 Ga. at 740 (IV), 743 (IV). We then consider whether Tactical should have known its services were necessary to protect Pappas’s customers. Davidson, 329 Ga. App. at 644-645 (2). Tactical argues that its contractual obligation here was to act as a visible deterrent and not to prevent all criminal activity.[9] See Bing v. Zurich Srvs. Corp., 332 Ga. App. 171, 174 (1) (770 SE2d 14) (2015) (inspection company not liable under Section 324A because it undertook inspection only for insurance underwriting purpose and not for safety purpose, and there could be no liability for the failure to do something they had not voluntarily undertaken) (emphasis in original). Notably, there is no signed contract in the record, and although both parties agree one was in effect, they do not agree as to the terms of any such agreement.[10] This alone precludes summary judgment, as a jury must decide what the terms of the contract were. See Gill Plumbing Co. v. Jimenez, 310 Ga. App. 863, 871 (2) (b) (714 SE2d 342) (2011) (“if the terms of a contract are ambiguous, and the ambiguity cannot be resolved by the rules of contract construction, the ambiguity is a factual matter for resolution by the jury through consideration of parol evidence”). We further conclude that there remains a factual question regarding whether Tactical knew its services were “necessary for the protection of a third person or his things.” Restatement (Second) of Torts § 324A. Here, there was testimony that Tactical knew it was on site to deter crime and protect against break-ins and robberies, and one of the owners testified that part of the security guards’ role was to help Pappas provide safety for its customers. There was also testimony that Tactical knew crime was increasing in the area. Whether Tactical knew its guards were necessary for protection implicates questions of foreseeability, which we have already determined is not susceptible to summary judgment. See Wright, 206 Ga. App. at 687 (1) (the “common element” in cases reviewing Section 324A is foreseeability); compare Adler’s Package Shop v. Parker, 190 Ga. App. 68, 71 (1) (b) (378 SE2d 323) (1989) (finding no liability under Section 324A because there was no evidence security guards knew they were necessary to protect victim given that there were no prior similar crimes). Having concluded that these preliminary questions regarding the application of Section 324A are questions for the jury, we consider whether Welch can meet one of the three subsections in Section 324A because, if she cannot, summary judgment in Tactical’s favor would be proper. Davidson, 329 Ga. App. at 646 (2). As applicable to this case, these three subsections consider (a) whether Tactical’s failure to act with reasonable care increased the risk of harm; (b) Tactical agreed to perform a duty Pappas owed to its customers; or (c) harm resulted from Pappas’s or Welch’s reliance on Tactical’s undertaking to provide security. See Restatement (Second) of Torts § 324A. The parties did not argue, and the trial court did not consider, that subsection (a) applied. As to subsection (b), we have explained that this subsection would apply only if Tactical had completely undertaken Pappas’s duty. Goodhart v. Atlanta Gas Light Co., 349 Ga. App. 65, 75 (2) (b) (825 SE2d 465) (2019); see also Fair, 340 Ga. App. at 796 (3); Taylor v. AmericasMart Real Estate, 287 Ga. App. 555, 559 (1) (b) (651 SE2d 754) (2007); Catalano v. GWD Mgmt. Corp., No. CV403-167, 2005WL5519861, *14 (III) (B) (2) (S. D. Ga. 2005).[11] Here, there is conflicting evidence whether Pappas completely surrendered its security responsibility to Tactical. For example, Tactical would make security recommendations, but it was Pappas’s decision whether to implement them; on at least one occasion, Pappas hired armed security guards to assist unarmed security; Pappas decided to install lighting and cameras and determined their placement; and Pappas met with police in 2014 to discuss break-ins, but Tactical was not part of that meeting. But there was also testimony that Pappas expected Tactical to handle security and its guards. Thus, there remains a factual question as to whether Tactical had completely undertaken the security services from Pappas. With regard to subsection (c), a plaintiff must offer proof that either the injured party or the property owner actually relied on the undertaking. Goodhart, 349 Ga. App. at 76 (2) (b); Boyd v. Big Lots Stores, 347 Ga. App. 140, 146 (2) (817 SE2d 698) (2018) see also BP Exploration & Oil v. Jones, 252 Ga. App. 824, 831 (2) (c) (558 SE2d 398) (2001) (physical precedent only); Restatement (Second) Torts § 324A, comment. e. Here, Pappas’s representatives admitted that its premises should be reasonably safe and that customers could rely on it, and Pappas personnel testified that it relied on Tactical to provide those security services. Welch testified that she trusted the restaurant to provide security and a safe environment. See Catalano, No. CV403-167, 2005WL5519861, *14 (III) (B) (2). Given this testimony, we must conclude that whether Pappas or Welch relied on Tactical for purposes of Section 324A (c) remains a jury question. b. Causation. Finally, Tactical argues that it is pure speculation that increased security or patrols would have prevented the attack. For the reasons discussed in Division 1, we conclude that causation is also a question for the jury. The expert in this case opined that it was more likely than not that the crime would not have happened if Tactical guards had been more attentive and had they adequately patrolled the parking lot. Tactical and Pappas employees all testified that the guards were to be conducting roving patrols, but there was ample evidence that the guards were stationary in the fire lane for extended periods of time, and that they were distracted by various interactions with customers. There was also evidence that crimes in the parking lot decreased when additional security was added. Nevertheless, the evidence showed that one of Tactical’s owners suggested reducing the number of guards on site just a few days before Anthony’s murder. This evidence is not speculative and is sufficient to raise a question of fact as to causation. Thus, it is for the jury to determine this element of the claims against Tactical. See Carmichael, 362 Ga. App. at 67 (1) (c). For the foregoing reasons, we affirm the trial court’s denial of summary judgment to both Pappas and Tactical. Judgments affirmed. Barnes, P. J., and Gobeil, J., concur.
