In these interrelated appeals arising from a 2008 triple homicide at Doctors Hospital in Muscogee County, Plaintiffs Alan Keith Cavender, Marion Baker, and Carla Wright (collectively, “Plaintiffs”) brought three separate civil actions against Defendants Doctors Hospital, Inc. d/b/a Doctors Hospital, The Medical Center Hospital Authority, and Securitas Security Services, USA, Inc. (collectively, “Defendants”)1 for personal injury (Cavender) and for wrongful death (Baker and Wright).2 The Defendants each filed motions for summary judgment, and following extensive briefing and a hearing, the Superior Court of Muscogee County summarily denied the motions. The *470trial court granted the Defendants certificates for immediate review, we granted the Defendants’ applications for interlocutory appeal, and we have consolidated the appeals for decision. For the reasons that follow, we conclude that the trial court erred in denying the Defendants’ motions for summary judgment, and therefore reverse.

To prevail at summary judgment under OCGA § 9-11-56, the moving party must demonstrate that there is no genuine issue of material fact and that the undisputed facts, viewed in the light most favorable to the nonmoving party, warrant judgment as a matter of law. A defendant may do this by showing the court that the documents, affidavits, depositions and other evidence in the record reveal that there is no evidence sufficient to create a jury issue on at least one essential element of plaintiff’s case. If there is no evidence sufficient to create a genuine issue as to any essential element of plaintiff’s claim, that claim tumbles like a house of cards. All of the other disputes of fact are rendered immaterial. Further, the burden on the moving party may be discharged by pointing out by reference to the affidavits, depositions and other documents in the record that there is an absence of evidence to support the nonmoving party’s case. If the moving party discharges this burden, the non-moving party cannot rest on its pleadings, but rather must point to specific evidence giving rise to a triable issue.

La Quinta Inns v. Leech, 289 Ga. App. 812-813 (658 SE2d 637) (2008).

Viewed in a light most favorable to the Plaintiffs, the evidence revealed that, for several years, Securitas provided security services to Doctors Hospital pursuant to a security agreement. Securitas provided security guards on three different shifts, including one security guard during the day, to monitor Doctors Hospital. As a part of its service to Doctors Hospital, Securitas also provided annual security surveys to Doctors Hospital. The purpose of the surveys was to “assess the efficiency of the security” at Doctors Hospital. These surveys included areas where improved security may be warranted. In particular, Securitas noted that certain entryways should be secured to control ingress and egress, replacement of the closed-circuit TV monitoring system, and additional coverage of the premises by video cameras.

On February 29, 2008, the Hospital Authority purchased, and took ownership of, the Doctors Hospital campus. On the same date, the Hospital Authority entered into a management agreement with Doctors Hospital, Inc. to manage the day-to-day operations of the *471hospital. Well prior to the Hospital Authority’s acquisition of the hospital, the hospital was required by the Joint Commission on the Accreditation of Healthcare Organizations to maintain policies and procedures for, among other things, security. To satisfy its Joint Commission obligation, the prior ownership of Doctors Hospital purchased a “Security Management Policy and Procedure Manual” from Medical Consultants Network, Inc. in the 1990s. Policy 110.015 of the manual included a section defining 18 crimes, both violent and nonviolent, that hospital security “are likely to be called upon to prevent” and “most likely to encounter.” Crimes defined in the policy include assault, battery, manslaughter and murder.

On March 27, 2008, Charles Johnston visited Doctors Hospital carrying two concealed handguns beneath a light jacket. He proceeded to the fifth floor, which housed the hospital’s intensive care unit. He then left the hospital for some time and returned on two occasions that day, going to the fifth floor on both occasions. On his third attempt in the early afternoon hours, a nurse asked Johnston if he needed any assistance; he calmly replied that he did not. Johnston then saw Peter Wright enter a room, and Johnston followed him. Johnston asked Wright, “Do you remember me[,] [d]o you remember my mother [,]”3 and Johnston produced one of the concealed handguns and shot Wright at close range. Wright fell to the floor, and Johnston shot him a second time. Wright later died during surgery.

Alan Keith Cavender was on the fifth floor and saw the shooting. Les Harris, hearing the gunshots, ran up the stairwell from the fourth floor to the fifth floor to investigate. Harris asked Cavender to check the stairwell while he monitored the elevators. As the two ran down the hall, Johnston appeared; Johnston shot Harris in the chest, killing him instantly. Cavender attempted to provide CPR to Harris, and Johnston placed his handgun against the back of Cavender’s head and cocked the handgun. Cavender told Johnston to “[g]o ahead and shoot me [because] [y]ou just killed my [life] partner.” Instead, Johnston struck Cavender on the back of the head and fled down the stairwell.

Wayne Michaux, the lone Securitas security guard on duty at Doctors Hospital on the day of the shooting, was patrolling the parking lot when he received urgent “code blue,” “code nine,” and “shots fired” calls from Doctors Hospital on his radio. Michaux ran to *472the emergency room and ordered employees to shut down the ER to prevent anyone from entering or leaving. Someone shouted, “there he is,” and Michaux spotted Johnston. Although Michaux then called 911 to report the shootings, the call center had already received multiple calls concerning Johnston’s rampage. Johnston was unable to enter the ER, so he left the hospital and walked to the parking lot. Michaux, though unarmed, followed Johnston through the parking lot and warned visitors in the parking lot to take cover.

James David Baker was parked next to Johnston. As Johnston approached his vehicle, Baker began to exit his vehicle. Johnston shot Baker, and Baker fell back into his vehicle. Law enforcement authorities arrived in the parking lot, and Michaux directed them to Johnston. Johnston exchanged gunfire with the authorities and was himself shot during the incident before he was apprehended. Officers found three handguns on Johnston’s person. A medical team from Doctors Hospital reached Baker’s vehicle shortly after the shooting but was unable to save Baker’s life.

All Cases

1. In each appeal, the respective Defendants contend that the Plaintiffs failed to present sufficient evidence that Johnston’s attack against Cavender or Johnston’s murder of James Baker, Les Harris, and Peter Wright was foreseeable.4 For the following reasons, we agree.

It is well settled that the following four elements are necessary to support a cause of action for negligence under Georgia law:

(1) A legal duty to conform to a standard of conduct raised by the law for the protection of others against unreasonable risk of harm; (2) a breach of this standard; (3) a legally attributable causal connection between the conduct and the resulting injury; and, (4) some loss or damage flowing to the plaintiff’s legally protected interest as a result of the alleged breach of the legal duty.

Leech, 289 Ga. App. at 816 (1); Brown v. All-Tech Investment Group, 265 Ga. App. 889, 893 (1) (595 SE2d 517) (2004).

*473In this case, Johnston entered Doctors Hospital with concealed weapons. He proceeded to the fifth floor and targeted Wright, who Johnston believed deliberately caused a decline in his mother’s health when she was hospitalized in the Doctors Hospital ICU, resulting in her death. Johnston approached Wright and shot him. Wright fell to the floor and Johnston shot Wright a second time. After shooting Wright, Johnston encountered Cavender and Harris, who had come to the fifth floor to investigate the gunshots. Johnston then shot and killed Harris, struck Cavender5 in the back of the head, and fled the hospital. In the parking lot, Johnston shot and killed Baker as Baker tried to exit his vehicle, which was parked next to Johnston’s vehicle. Johnston then exchanged gunfire with law enforcement authorities before he himself was shot and subsequently subdued. In view of Johnston’s criminal attacks, the question becomes whether those criminal acts were reasonably foreseeable. See Brown, 265 Ga. App. at 894 (1), 900-901.

As a threshold matter, “a property owner is not an insurer of an invitee’s safety, and an intervening criminal act by a third party generally insulates a proprietor from liability unless such criminal act was reasonably foreseeable.” Ratliff v. McDonald, 326 Ga. App. 306, 312 (2) (a) (756 SE2d 569) (2014). See also Days Inn of America v. Matt, 265 Ga. 235, 236 (454 SE2d 507) (1995); Lau’s Corp. v. Haskins, 261 Ga. 491, 492 (1) (405 SE2d 474) (1991). “If the proprietor has reason to anticipate a criminal act, he or she then has a duty to exercise ordinary care to guard against injury from dangerous characters.” (Punctuation omitted.) Days Inn, 265 Ga. at 236. Put simply, “without foreseeability that a criminal act will occur, no duty on the part of the proprietor to exercise ordinary care to prevent that act arises.” Id.

“Foreseeable consequences are those which are probable, according to ordinary and usual experience, [or] those which, because they happen so frequently, may be expected to happen again.” (Punctuation omitted.) Brown, 265 Ga. App. at 894. See also Thomas v. Food Lion, 256 Ga. App. 880, 882 (1) (570 SE2d 18) (2002); Cope v. Enterprise Rent-A-Car, 250 Ga. App. 648, 651 (2) (551 SE2d 841) (2001) (the law judges foreseeability of consequences “according to *474the usual experience of mankind”). Of particular relevance to this case, “one is not bound to anticipate or foresee and provide against that which is unusual or that which is only remotely and slightly probable.” (Citations and punctuation omitted.) Strickland v. DeKalb Hosp. Auth., 197 Ga. App. 63, 68 (I) (2) (d) (397 SE2d 576) (1990). See also Brown, 265 Ga. App. at 894. Stated differently, the exercise of ordinary care “simply does not create a duty to anticipate unlikely, remote, or slightly possible events.” (Punctuation omitted.) McDaniel v. Lawless, 257 Ga. App. 187, 189 (570 SE2d 631) (2002). Thus, absent evidence that Johnston’s rampage was foreseeable, summary judgment in the Defendants’ favor would be appropriate. See id.

Foreseeability may be determined by analyzing whether the property owner has notice of substantially similar prior criminal acts. Sturbridge Partners v. Walker, 267 Ga. 785, 786 (482 SE2d 339) (1997); Ratliff, 326 Ga. App. 306, 312 (2) (a). In determining whether a given crime is “substantially similar,” a court must analyze the “location, nature and extent of the prior criminal activities and their likeness, proximity or other relationship to the crime in question.” Sturbridge, 267 Ga. at 786. While the primary criminal activity must be substantially similar, it need not be identical; what is required “is that the prior incident be sufficient to attract the [hospital’s] attention to the dangerous condition which resulted in the litigated incident.” (Punctuation omitted.) Id. “Without a showing of substantial similarity, the evidence is irrelevant as a matter of law and there is nothing upon which the court’s discretion can operate.” (Citations omitted.) Adler’s Package Shop v. Parker, 190 Ga. App. 68, 70 (1) (a) (378 SE2d 323) (1989). In addition, it is the Plaintiffs’ burden to establish that the property owner had knowledge of the previous substantially similar crimes on or near the premises upon which the plaintiffs rely to establish foreseeability. See Baker v. Simon Property Group, 273 Ga. App. 406, 407 (1) (614 SE2d 793) (2005) (carjacking and shooting in a mall parking lot not foreseeable to mall manager or security company); McClendon v. Citizens and Southern Nat. Bank, 155 Ga. App. 755, 756 (272 SE2d 592) (1980) (robbery in a bank parking lot not foreseeable to bank).

(a) Substantially Similar Crimes. In response to the Defendants’ motions for summary judgment, the Plaintiffs supplied a collection of police reports detailing incidents at Doctors Hospital and a neighboring property, The Medical Center.6 The records, which begin in *4752002 and continue through 2008, purport to show the nature of criminal activity at the hospitals in an effort to demonstrate that the Defendants were on notice that something like Johnston’s rampage was foreseeable.7 However, these reports are not persuasive.

Of primary importance, the reports are most notable for what they do not show. Of the 11 police reports from Doctors Hospital relied upon by the Plaintiffs, none involved multiple murders, a single murder, a shooting, a weapon, or, for that matter, a significant injury. Indeed, the majority of the reports detail nothing more than verbal threats. See Aldridge v. Tillman, 237 Ga. App. 600, 605 (2) (516 SE2d 303) (1999) (prior verbal threats of violence not substantially similar to assault with a knife); Ableman v. Taco Bell Corp., 231 Ga. App. 761, 763 (501 SE2d 26) (1998) (prior verbal threats of violence does not constitute knowledge that person would physically attack a third party). Likewise, of the 32 reports from The Medical Center upon which the Plaintiffs rely, none involved multiple murders, a single murder, a shooting, or a significant injury. Only two incidents at The Medical Center involved a weapon (late-night armed robberies in The Medical Center’s parking lot), although neither involved actual discharge of the weapon. Furthermore, these two incidents in the parking lot at a neighboring property occurred more than five years prior to Johnston’s rampage inside Doctors Hospital.

At best, then, the police reports provided by the Plaintiffs show two armed robberies at a neighboring property at least five years prior to Johnston’s rampage. Foreseeable consequences are “those which, because they happen so frequently, may be expected to happen again.” (Punctuation omitted; emphasis supplied.) Brown, 265 Ga. App. at 894. In Brown, we noted that assaults like Johnston’s are not legally foreseeable because they are so “unusual, contrary to ordinary experience, and rare that no reasonable jury could find the [defendants] should have guarded against them.” 265 Ga. App. at 896 (1). As a result, it simply cannot be said that Johnston’s rampage at Doctors Hospital was foreseeable because the prior incidents to which the Plaintiffs referred were not substantially similar to the assault which resulted in the Plaintiffs’ damages. See Baker, 273 Ga. App. at 408 (1) (prior property crimes in parking lot insufficient to create a factual issue whether defendants could anticipate a carjacking and shooting resulting in personal injury); Scott v. Housing Auth. of City of Glennville, 223 Ga. App. 216, 217 (477 SE2d 325) (1996). Therefore, *476we find that the trial court erroneously denied the Defendants’ motions for summary judgment on this basis. See Agnes Scott College v. Clark, 273 Ga. App. 619, 622 (1) (616 SE2d 468) (2005); Baker, 273 Ga. App. at 408 (1); Brown, 265 Ga. App. at 894, 896 (1).

Furthermore, the Plaintiffs’ attempt to show foreseeability through the testimony of Anthony Potter, a security expert with many years of experience in hospital security, is unavailing. Potter opined, based upon a review of Doctors Hospital’s procedures, the 2008 Securitas security survey, deposition summaries and “numerous publications on the issue,” that Johnston’s rampage was foreseeable due to an “increase in the number of shooting incidents at healthcare facilities,” the “increase in the number of violent confrontations between patients and/or family members and healthcare providers,” and that there was no “visible deterrent” to such actions at Doctors Hospital.

Potter’s opinions are of the same character as the tendered experts’ testimony in Brown. In Brown, the experts “discussed generalized concepts of violent reactions to financial disaster and workplace violence.” 265 Ga. App. at 895. The experts’ testimony relied upon two prior shootings in the financial services industry which occurred years prior, a death threat issued by a day trader to company management, and financial advisor suicides following the stock market crash of 1929. Id. Here, in much the same vein, Potter relied upon a generalized increase in healthcare violence without specific reference to such violence. See Agnes Scott, 273 Ga. App. at 622-623 (1) (reliance on generalized information like crime statistics does not create issue of fact concerning foreseeability). Furthermore, it does not appear that Potter analyzed the lack of substantially similar violence at Doctors Hospital and its environs. Sturbridge, 267 Ga. at 786; Ratliff, 326 Ga. App. 306, 312 (2) (a); Brown, 265 Ga. App. at 894 (1) . Compare Brookview Holdings v. Suarez, 285 Ga. App. 90, 96-97 (2) (645 SE2d 559) (2007) (expert testimony based upon “study of the area surrounding [location of crime], the record of crime in that area, and their experience with crimes of [that] nature”). Therefore, we find that Potter’s opinions illustrate “that even arguably similar acts of violence were so unusual, contrary to ordinary experience, and rare that no reasonable jury could find [that Doctors Hospital] should have guarded against them.”8 Brown, 265 Ga. App. at 896.

*477(b) Defendants’ Knowledge. In addition to demonstrating substantially similar crimes on or near Doctors Hospital’s premises, the Plaintiffs bore the burden to establish that the property owner had knowledge of the previous substantially similar crimes to establish foreseeability. See Baker, 273 Ga. App. at 407 (1); McClendon, 155 Ga. App. at 756. In this regard, the Plaintiffs again failed. The record is devoid of any evidence that the Defendants knew of the criminal activity cited by the Plaintiffs at Doctors Hospital or its neighbor.9 Compare Shoney’s, Inc. v. Hudson, 218 Ga. App. 171, 173 (2) (460 SE2d 809) (1995) (knowledge shown, in part, by management conversations concerning danger to customers in parking lot). Absent any such proof, the Plaintiffs cannot prevail. See Baker, 273 Ga. App. at 407 (1); McClendon, 155 Ga. App. at 756. Nor can the Plaintiffs rest upon the police reports as a means to establish the Defendants’ knowledge of the activities contained in those reports. See Wojcik v. Windmill Lake Apts., 284 Ga. App. 766, 769 (645 SE2d 1) (2007); Scott, 223 Ga. App. at 217 (statement that defendant had knowledge of prior incidents was based upon assumption that defendant gained such knowledge because the incidents were investigated by police; “such an inference ... is not authorized”) (citing SunTrust Banks v. Killebrew, 266 Ga. 109 (464 SE2d 207) (1995)). In sum, the trial court erred in denying the Defendants’ motions for summary judgment due to the lack of foreseeability of Johnston’s rampage.

Case Nos. A14A1788, A14A1790, and A14A1798 (Medical Center Hospital Authority)

2. In its two enumerations of error, the Hospital Authority contends that there were no genuine issues of material fact that: (a) Johnston’s actions against James Baker, Les Harris, and Peter Wright were not foreseeable; and (b) Johnston’s intervening criminal actions formed the proximate cause of the Plaintiffs’ injuries. These issues have been addressed in Division 1, supra, and we have concluded that the trial court erroneously denied the Hospital Authority’s motions for summary judgment.

*4783. In view of our holdings in Divisions 1 and 2, supra, we need not address the Hospital Authority’s argument concerning Cavender’s superior knowledge of Johnston’s threat, or even whether the argument is properly before this Court.

Case Nos. A14A1789, A14A1792, and A14A1794 (Securitas)

4. In addition to its arguments concerning foreseeability and proximate cause, Securitas contends that it owed no legal duty to prevent Johnston’s actions.10 We agree.

In personal injury cases, an injured party may not recover as a third-party beneficiary for failure to perform a duty imposed by a contract unless it is apparent from the language of the agreement that the contracting parties intended to confer a direct benefit upon the plaintiff to protect him from physical injury.

(Citations and punctuation omitted.) Brown, 265 Ga. App. at 897 (2) (a) (i) (citing Anderson v. Atlanta Committee for the Olympic Games, 273 Ga. 113, 117 (4) (537 SE2d 345) (2000)). Furthermore,

[ajlthough the third-party beneficiary need not be specifically named in the contract, the contracting parties’ intention to benefit the third party must be shown on the face of the contract. The mere fact that [the third party] would benefit from performance of the agreement is not alone sufficient.

(Citations and punctuation omitted.) Id. And as we have stated before,

[w]e recognize that whenever a premises owner contracts with a private security company the parties may expect the security services provided to benefit invitees who visit the property. As we have held, however, an injured invitee may not recover against the security company for negligent performance if the contract is silent as to the parties’ intent to confer that benefit.

*479Id. (citing Anderson, 273 Ga. at 117-118 (4); Armor Elevator Co. v. Hinton, 213 Ga. App. 27, 30 (2) (443 SE2d 670) (1994)). See also CDP Event Svcs. v. Atcheson, 289 Ga. App. 183, 185 (1) (656 SE2d 537) (2008) (same).

Here, the security agreement governing Securitas’ relationship with Doctors Hospital specifically disavowed any intent to confer a direct benefit on Doctors Hospital’s employees or customers (“The services provided under this Agreement are solely for the benefit of [Doctors Hospital;] neither this Agreement nor any services rendered hereunder shall be deemed to confer any rights on any other party as a third party beneficiary.”). Consequently, even when construed in the Plaintiffs’ favor, the evidence does not support a finding that the Plaintiffs were third-party beneficiaries of Securitas’ security agreement with Doctors Hospital. See Brown, 265 Ga. App. at 897 (2) (a) (i). See also Anderson, 273 Ga. at 117-118 (4); Armor Elevator, 213 Ga. App. at 30 (2).

5. Next, Securitas alleges that the Plaintiffs failed to present any admissible evidence establishing a breach of any duty allegedly owed by Securitas. As noted supra, Securitas’ security agreement mandated that Securitas supply one unarmed guard to monitor Doctors Hospital during daytime hours. Michaux was present on the date of Johnston’s rampage and was patrolling the Doctors Hospital property to satisfy Securitas’ contractual obligation. Moreover, Michaux’s conduct reveals that there was no breach of Securitas’ duty.

The evidence demonstrates that Michaux did not learn of the rampage until he received urgent calls from Doctors Hospital. When he learned of the shootings, he immediately proceeded to the emergency room, called 911, and ordered employees to lock down the emergency room. When Johnston was unsuccessful in gaining entry to the emergency room due to Michaux’s actions, Johnston left, and Michaux followed him. In the parking lot, Michaux warned visitors to take cover. When law enforcement authorities arrived, Michaux directed them to Johnston. Michaux was not permitted to confront or attempt to arrest Johnston; rather, he was required to report any activity to law enforcement authorities, which he did. For his actions, Michaux received awards from Securitas and the Muscogee County Sheriff. In short, even when viewed in favor of the Plaintiffs, as this Court must, Michaux went to great lengths to fulfill Securitas’ contractual responsibility to monitor Doctors Hospital. Accordingly, it follows that the trial court erred in denying Securitas’ motion for summary judgment because there was no breach of any duty allegedly owed by Securitas.

*480 Case No. A14A1791 (Doctors Hospital)

6. In its second enumeration of error,11 Doctors Hospital argues that its policy concerning hospital security cannot alone create an issue of fact concerning foreseeability. We agree. Although the Plaintiffs submitted authorities from other jurisdictions to support the argument that a party may adopt the statement of another,12 those authorities are unnecessary to our resolution of this case. Georgia law suggests that there are two primary methods to establish foreseeability.13 Our courts have held that “[ejvidence of a prior substantially similar act is one way to establish notice and foreseeability, and in most cases it will be the only possible way to do so.” Wallace v. Boys Club of Albany, 211 Ga. App. 534, 536, n. 2 (439 SE2d 746) (1993). See also Sturbridge, 267 Ga. at 786; Brown, 265 Ga. App. at 894 (1). However, we have also noted that “a danger could be so obvious that an issue for jury determination could exist regarding notice and/or foreseeability despite the absence of a prior similar incident on those premises.” Id. Compare Shoney’s, 218 Ga. App. at 173 (2) (foreseeability shown, in part, by prior armed robberies and by management conversations concerning danger to customers in parking lot). In this case, as discussed in greater detail in Division 1, supra, neither factor is present. As a result, it was error for the trial court to deny Doctors Hospital’s motion for summary judgment on this ground.

7. In its final enumeration of error, Doctors Hospital claims that the trial court erroneously denied its motion for summary judgment as to punitive damages because Baker failed to present any evidence of malicious, wilful or wanton misconduct. However, because of the unforeseeability of Johnston’s rampage, there was no duty by Doctors Hospital to guard against such a violent rampage. And without entitlement to compensatory damages, punitive damages may not be awarded. See Southern Gen. Ins. Co. v. Holt, 262 Ga. 267, 270 (2) (416 SE2d 274) (1992); Gwinnett Health System v. Delu, 264 Ga. App. 863, 869 (3) (592 SE2d 497) (2003); Sharp v. Greer, Klosik & Daugherty, 256 Ga. App. 370, 373 (6) (568 SE2d 503) (2002). As a result, we conclude that the trial court erred in denying Doctors Hospital’s motion for summary judgment on punitive damages.

Judgments reversed and cases remanded with direction.

concurring specially.

I write separately to withhold my full concurrence from footnote 9 of Division 1 (b), in which the majority addresses the plaintiffs’ attempt to impute the Medical Center’s knowledge to Doctors Hospital. This footnote might be read to establish an overbroad precedent regarding imputation of knowledge between interrelated entities. I would not reach that issue. Because I do not fully concur in it, the footnote does not establish precedent. Court of Appeals Rule 33 (a). I concur fully in the remainder of the opinion.

I write also, however, to disassociate myself from the majority’s unfortunate decision to publish in footnote 5 of Division 1 the Hospital Authority’s allegation that one of the plaintiffs, who witnessed the murder of his life partner, is lying about having been himself the victim of an assault. That plaintiff has asked us to strike and ignore that allegation because it is “wholly unnecessary, inflammatory, and improperly (particularly on appeal from a summary judgment decision) seek[s] to impugn [his] credibility and reputation.” Just so. We ought to have ignored it. The allegation would have been highly relevant at trial; but unless we are reversed on certiorari, there will be no trial. We do, from time to time appropriately note that facts we must assume to be true are disputed — particularly where a party is accused of misconduct. But the reference here is gratuitous.