Short answer: In Texas, a business can be held liable when an innocent customer or bystander is hurt or killed by a violent crime on its property, but only if the crime was foreseeable and the business failed to take reasonable steps to prevent it. Proving foreseeability turns on a five-factor test the Texas Supreme Court laid out in Timberwalk Apartments, Partners, Inc. v. Cain, 972 S.W.2d 749 (Tex. 1998). And in almost every serious case, you cannot prove it without a qualified security expert who maps the crime history around the property and measures the company’s security against industry standards. We build these cases for victims and their families across Texas, and below, we walk through exactly how it is done.
What “negligent security” actually means in Texas
Negligent security is a type of premises liability claim. The idea is simple. A property owner who invites the public onto its premises owes those visitors a duty of ordinary care. When the danger comes from a third party’s crime, that duty has a catch.
The general rule in Texas is that a person owes no duty to protect another from the criminal acts of a third party. The exception swallows a lot of cases: someone who controls premises does have a duty to use ordinary care to protect invitees from third-party crime if the owner knows or has reason to know of an unreasonable and foreseeable risk of harm. That rule and its exception come straight from Timberwalk, 972 S.W.2d at 756.
So the whole case usually rises or falls on one word: foreseeable. A business is not the insurer of your safety. It is responsible when it should have seen the danger coming and did nothing reasonable about it.
The kind of case we handle
The scenario below is illustrative, built from the patterns we see in real retail-violence cases. The names are invented, but every fact in it tracks something we have encountered in this work.
Picture a national discount-retail chain. Call the company “ValueMart.” One of its stores sits on a busy commercial corridor in a high-crime part of a Texas city. Shoplifting at this store is constant. Employees later testify that twenty or more shoplifters hit the store on a single shift, that the back-door alarm goes off five or six times in four hours, and that physical fights with shoplifters happen several times a month.
Now layer in the company’s own policies, which contradict each other. One written policy tells employees never to touch, detain, block the exit of, or chase a shoplifter, and bans all weapons on company property. A different corporate document tells those same employees they are personally responsible for protecting company assets and preventing theft. Managers’ bonuses are tied to keeping “shrink,” the company’s word for lost merchandise, low. Employees testify they understood that if they let merchandise walk out the door, their pay or their job was at risk.
One afternoon, a man shoplifts from the store and walks toward the exit. An armed employee confronts him, a struggle breaks out, and a second employee locks the vestibule door to trap the shoplifter inside. The shoplifter drops the merchandise and leaves. As he walks away across the parking lot, the armed employee follows him onto the sidewalk and opens fire.
Standing in that parking lot is “Marcus Bell,” a customer who had nothing to do with the theft. He was walking back to his car when the employee started shooting at the fleeing shoplifter’s back. A round meant for the shoplifter strikes Bell, and he dies on the pavement. The employees turn and walk back into the store without checking on him.
This is a wrongful-death negligent security case, and the client is Bell’s family, not the shoplifter. That distinction matters, and it is one we press hard. Our client is a true innocent: a customer the store invited onto its property, killed by gunfire the store’s own employee unleashed in a parking-lot crossfire the company’s policies and choices made possible. The shooter is criminally responsible. The company that armed the situation, trained no one, and ignored the danger is civilly responsible to the bystander it got killed. Here is how we build that case.
Step one: prove the violence was foreseeable
Foreseeability is the gateway. No foreseeability, no duty, and the case ends on summary judgment. Timberwalk gives courts five factors to weigh together, and no single factor controls. Id. at 757–59.
Proximity. How close to the property did prior crimes happen? Courts look at the property itself and the area immediately around it. A standard radius is one mile, though closer is stronger.
Recency. How recently did those crimes occur? Crime from last month carries more weight than crime from a decade ago.
Frequency. How often? A steady drumbeat of violent crime signals a known danger. A one-off does not.
Similarity. Were the prior crimes similar to the one that hurt your client? They need not be identical. Timberwalk, 972 S.W.2d at 757. Robberies and aggravated assaults near a store make a shooting at that store more foreseeable.
Publicity. Could the owner have learned about the danger? Police reports, prior incidents on site, media coverage, and tenant or employee complaints all count.
The factors interact. The more similar the prior crimes, the less frequency you need, and vice versa. Id. The court weighs the whole picture.
In a fact pattern like Bell’s, the foreseeability evidence is overwhelming. Our security expert pulls the police calls for service within one mile of the store for the two years before the shooting and finds hundreds of violent-crime calls, including dozens of robberies, hundreds of aggravated assaults, and several murders. That is proximity, recency, and frequency in one data set. The robberies and assaults supply similarity to a shooting. Media coverage of the city’s violent-crime spike supplies publicity. A defendant cannot credibly argue “we had no idea” when the data shows several violent-crime calls per week on its doorstep.
One technical point that matters more than people expect: burglaries count. Defendants love to argue that property crimes like burglary are irrelevant to whether a violent crime was foreseeable. The Fifth Circuit rejected that categorical exclusion in Jenkins v. C.R.E.S. Mgmt., L.L.C., 811 F.3d 753 (5th Cir. 2016), holding that residential burglaries the owner knew about, combined with other violent crime, raised a fact question on foreseeability. The logic is blunt: if a burglar will enter, so will someone willing to commit violence. Including burglaries can be the difference between surviving summary judgment and losing.
Step one, alternate route: the danger unfolding in real time
Foreseeability does not always require a long crime history. Texas recognizes a second path. When the conduct immediately preceding an attack puts the owner on notice, a duty can arise on the spot. In Del Lago Partners, Inc. v. Smith, 307 S.W.3d 762 (Tex. 2010), a bar watched a confrontation escalate over about ninety minutes before it exploded into a brawl that seriously injured a patron. The Texas Supreme Court upheld liability because the danger became apparent in real time and the owner had a chance to stop it.
Our hypothetical fits this path too. The struggle, the drawn weapon, and the locked door all happened in front of store management. The danger was not theoretical. It was happening on the sales floor and spilling into the parking lot while supervisors watched, and an uninvolved customer was standing right in the path of it. That is Del Lago foreseeability layered on top of Timberwalk foreseeability.
Step two: prove the company’s security fell below the standard of care
Foreseeability gets you in the door. Now you have to show the business breached its duty by failing to do what a reasonable business would have done. This is where the case stops being about crime statistics and starts being about the company’s choices.
In a case like this, the breaches are everywhere, and we document each one:
- No security guard at a store the company itself flagged as high-risk. The company rates its stores 1 through 4 for risk based on shrink and area crime, and this store carries the highest rating. A corporate witness admits the company declines to staff guards at the riskiest stores because those stores are the least profitable and a guard would erase the margin. That testimony is gold. It shows the company knew the risk, had an obvious fix, and rejected the fix to protect profit.
- No training. The shooter testifies he received no training on loss prevention, shoplifters, or weapons. Other employees say the same. A written policy nobody is taught and nobody signs is not a safety program. It is paperwork for the lawsuit.
- Contradictory policies that pushed employees into danger. The “never confront” policy collided with the “protect company assets or lose your job” message. A regional manager concedes that even the company’s own confront-or-apprehend language is confusing. Employees were left to improvise during violent encounters they were implicitly told to win.
- Tolerating armed employees. A manager learned weeks earlier that the shooter carried a gun at work, in plain violation of the weapons ban, and did nothing. Other employees openly carried too. The company had the authority to send the armed employee home or fire him and chose not to.
- No change after prior shootings. The company had employees shoot shoplifters at other stores and still changed no policy. That is conscious indifference, not an accident.
Each of these is a deviation from accepted retail-security practice. Together they show a company that understood the danger and managed it for profit rather than for safety.
Why you cannot win this case without an expert
Here is the part clients underestimate. A negligent security case is not a slip-and-fall. You are asking a jury to find that an absent security guard or a missing training program caused a death. That is not common knowledge. Texas courts expect expert testimony to establish both foreseeability and the standard of care, and to connect the security failures to the harm.
A qualified security expert does four things no lawyer can do alone.
Builds the crime grid. The expert obtains police calls for service and offense reports through public-records requests, then maps every crime by type, date, time, and distance from the property. This is the raw material for the Timberwalk analysis. Calls for service matter as much as formal reports because they capture incidents the company responded to but never officially logged. These records also age out of police storage on retention schedules, so the crime history for the critical twelve to thirty-six months before an incident can disappear if you wait. Build it early.
Applies a recognized methodology. Reputable security experts use a published, peer-reviewed framework, such as the forensic methodology of the International Association of Professional Security Consultants, and tie it to the Timberwalk factors. Methodology matters because the defense will move to exclude the expert under the standard for expert reliability that traces to Daubert v. Merrell Dow Pharmaceuticals, Inc., 509 U.S. 579 (1993), and its progeny, General Electric Co. v. Joiner, 522 U.S. 136 (1997), and Kumho Tire Co. v. Carmichael, 526 U.S. 137 (1999). An expert who follows a transparent, accepted method survives that challenge. An expert who relies on gut instinct does not.
Measures the company against industry standards. The expert benchmarks the company’s actual security against published guidance, ASIS International standards, NFPA 730 premises-security guidance, Crime Prevention Through Environmental Design principles, and the company’s own written policies. That last source is often the most damaging. When a company violates its own rules, the jury does not need a treatise to see it.
Explains causation in plain terms. The defense will argue the criminal was the sole cause and nothing would have stopped a determined killer. Our expert’s answer is that the law does not require proof that better security made the crime impossible, only that it made this crime less likely. A guard at a high-risk store, real training, and enforcement of the weapons ban have documented deterrent effects. The expert quantifies that effect and ties it to the specific failures. And where the person killed is an uninvolved bystander, the causation story is even cleaner: a properly run store does not have an untrained, armed employee firing across a public parking lot at a fleeing shoplifter in the first place.
How the defense fights back, and how the crime grid answers it
Defendants in these cases run a predictable playbook. Knowing it lets you build the record to beat it before they raise it.
They argue the criminal was the sole proximate cause. The crime grid and the standard-of-care analysis answer that the company’s choices created the conditions and increased the risk.
They argue they had no notice of any danger. The calls for service, prior on-site incidents, employee complaints, and media coverage answer that directly. This is why you pull the data and lock in testimony early.
They move to exclude your expert as unreliable. A published methodology, properly applied and disclosed, defeats that motion.
They try to narrow the relevant crime history to make foreseeability vanish. Texas courts do narrow the field to genuinely relevant crimes, a process that traces to Trammell Crow Central Texas, Ltd. v. Gutierrez, 267 S.W.3d 9 (Tex. 2008). But narrowing is not the same as gerrymandering. A defense expert who counts crimes at a daycare and a dental office while ignoring the robberies in the store’s own parking lot has built a flawed analysis a good plaintiff’s expert will expose.
What this means if you or a family member was hurt
If you were attacked, robbed, or shot on a business’s property, or a loved one was killed, you may have a negligent security claim against the business, not just the criminal. This is just as true when an innocent bystander is hurt by violence the business set in motion, such as a customer caught in a crossfire that a store’s own untrained, armed employee started. The questions that decide your case are whether the violence was foreseeable and whether the business did what a reasonable business would have done to prevent it.
Two things matter immediately. First, the evidence has a shelf life. Surveillance video gets overwritten, witnesses scatter, and police records get purged on retention schedules. The sooner a lawyer and a security expert start pulling crime data and preserving footage, the stronger your case. Second, this is expert-driven litigation against well-funded corporate defendants who fight hard. You want a firm that has built these cases before, knows which experts survive a reliability challenge, and knows how to turn a company’s own policies and profit decisions into the heart of the case.
That is the work we do. At The Law Offices of Colby Lewis, we represent people and families harmed by violent crime that a business should have prevented, and we handle these cases across Texas, with offices in Houston, San Antonio, Corpus Christi, McAllen, and Brownsville. We know how to build the crime grid, retain the right security expert, and hold a corporation accountable for the choices that got someone killed. If a business’s failure to provide reasonable security cost you or your family, contact us for a free, confidential consultation.
This article is for general information and is not legal advice. Reading it does not create an attorney-client relationship. Every case is different; talk to a lawyer about your specific facts. The “ValueMart” scenario and the people in it are a composite hypothetical and do not depict any actual person, company, or case.
