OPINION
{1} This case arises out of a shooting that took place at a Mustang convenience store and gas station in which three people were killed and one person was injured. Plaintiffs filed a premises liability case against the owner and operator of the business (Defendant) alleging wrongful death and personal injury. The district court concluded that Defendant had no duty to prevent the episode, and granted summary judgment. We affirm.
BACKGROUND
{2} The fatal incident was the product of an ongoing drug trafficking dispute. The escalating hostilities came to head when Eric Tollardo entered Jason Perea’s apartment, put a gun to Perea’s head, and then departed, threatening that he was going to return. After a brief period of reflection, Perea armed himself with two loaded Gloek pistols and went looking for Tollardo. Perea drove around Taos for two or three hours, searching for Tollardo without success. Perea decided to abandon the search and was heading home when, by chance, he spotted Tollardo’s car in Defendant’s parking lot. Perea came to a rapid stop, jumping the curb and colliding with a pole. He then climbed out of his vehicle and advanced on Tollardo’s ear with a loaded gun in each hand. Believing that one of the occupants had fired a shot at him, Perea “just lost it” and opened fire. Perea shot through the open windows of Tollardo’s car until he ran out of bullets, killing three of the occupants and injuring a fourth occupant in the process. Perea then fled the scene.
{3} Plaintiffs filed the instant lawsuit in their various capacities as personal representatives of the estates of two of the decedents and as parents and next friends of the surviving occupant. Plaintiffs’ claims are grounded on their assertion that Defendant negligently failed to provide security on its premises.
{4} Defendant moved for summary judgment, contending that Plaintiffs could not *522establish either that Defendant had a duty to protect the victims from the attack, or that Defendant’s conduct was a proximate cause of their injuries. The district court agreed with Defendant’s argument on the question of duty, and granted the motion on that basis. This appeal followed.
DISCUSSION
{5} It is axiomatic that a negligence action requires that there be a duty owed from the defendant to the plaintiff; that based on a standard of reasonable care under the circumstances, the defendant breached that duty; and that the breach was a cause in fact and proximate cause of the plaintiffs damages. See Herrera v. Quality Pontiac, 2003-NMSC-018, ¶ 6, 134 N.M. 43, 73 P.3d 181. Since the absence of any of these elements is fatal to a negligence claim, we first examine whether Defendant owed a duty to Plaintiffs.
1. Duty
{6} “Whether a duty exists is a question of law for the courts to decide.” Id. (internal quotation marks and citation omitted). We therefore apply de novo review. See, e.g., Blake v. Pub. Serv. Co. of N.M., 2004-NMCA-002, ¶ 5, 134 N.M. 789, 82 P.3d 960 (reviewing de novo an award of summary judgment, based on a purely legal determination on the threshold issue of duty).
{7} “As a general rule, a person does not have a duty to protect another from harm caused by the criminal acts of third persons[.]” Ciup v. Chevron U.S.A., Inc., 1996-NMSC-062, ¶ 5, 122 N.M. 537, 928 P.2d 263. One exception to the general rule is that a duty may arise out of a special relationship. Id.; Rummel v. Edgemont Realty Partners, Ltd., 116 N.M. 23, 26, 859 P.2d 491, 494 (Ct.App.1993) (stating that, absent a special relationship, there is no duty to protect others from harm caused by criminal acts of third persons). See generally Restatement (Second) of Torts § 314A (1965). One such special relationship exists between businesses and their patrons. See Reichert v. Atler, 117 N.M. 623, 624, 875 P.2d 379, 380 (1994) (recognizing the duty of business establishments to protect customers against the criminal conduct of third parties); Rummel, 116 N.M. at 26, 859 P.2d at 494 (same). In this case the occupants of Tollardo’s car were customers of Defendant, who were hanging out in the parking lot and talking with other customers. Therefore, Defendant had a duty to protect business patrons such as the victims from harm caused by third-party criminal conduct. However, this duty extends only to foreseeable conduct and resultant harm. See UJI 13-1320 NMRA (stating in part that the duty of an owner or operator to protect a visitor “arises from a foreseeable risk that a third person will injure a visitor”); Reichert, 117 N.M. at 626, 875 P.2d at 382 (recognizing that the “duty of the owner or operator of a place of business to prevent the harmful conduct of a third party” extends to foreseeable acts and foreseeable harm).
{8} The New Mexico Supreme Court has observed, “[f]oreseeability is a critical and essential component of New Mexico’s duty analysis because no one is bound to guard against or take measures to avert that which he or she would not reasonably anticipate as likely to happen.” Herrera, 2003-NMSC-018, ¶20 (alteration omitted) (internal quotation marks and citation omitted). Therefore, we assess foreseeability by reference to “what one might objectively and reasonably expect, not merely what might conceivably occur.” Johnstone v. City of Albuquerque, 2006-NMCA-119, ¶ 8, 140 N.M. 596, 145 P.3d 76 (internal quotation marks and citation omitted). In evaluating foreseeability, we consider both the status of the plaintiff and the type of harm involved. See Chavez v. Desert Eagle Distrib. Co., 2007-NMCA-018, ¶ 16, 141 N.M. 116, 151 P.3d 77 (“The initial step in a common law duty analysis is to determine whether a particular plaintiff and a particular harm are foreseeable.”).
{9} Although Plaintiffs urge us to approach the foreseeability issue in a more generalized or abstract fashion, we do not proceed without reference to the specific circumstances actually presented. See, e.g., Chavez, 2007-NMCA-018, ¶¶ 17-24 (approaching the foreseeability issue by reference to the specific allegedly negligent conduct of the business proprietor, and by *523reference to the specific criminal activity that allegedly ensued); Herrera, 2003-NMSC-018, ¶¶ 7, 19-25 (same). See generally Madrid v. Lincoln County Med. Ctr., 121 N.M. 133, 139, 909 P.2d 14, 20 (Ct. App.1995) (observing that the existence of a duty depends on “whether a particular plaintiff, a particular event, and a particular injury are foreseeable,” affd, 1996-NMSC-049, 122 N.M. 269, 923 P.2d 1154. We therefore frame the critical question in this ease to be: whether the proprietor of a convenience store and gas station who fails to employ security measures should foresee that a targeted homicidal attack on its patrons is likely to result.
{10} Plaintiffs contend that the attack in this case was foreseeable due to the character and history of Defendant’s service station, which Plaintiffs describe as “a magnet for crime and the criminal element.” In support of this characterization Plaintiffs rely on a police incident log and the depositions of two former employees. Because the employee depositions and the incident log provide so little specific information about actual events, we hesitate to draw inferences from these materials. However, viewing the depositions and the log in the most fashionable light, they indicate prior reports of theft of gasoline and alcohol, physical altercations involving loiterers, domestic violence, harassment, traffic accidents, vandalism, trespassing, suspicious persons, and wild and stray animals at the service station. Reports of commercial robberies and incidents involving narcotics also appear.
{11} The history of reported criminal activity at Defendant’s service station may have rendered future events of a similar character foreseeable. If this case involved injuries suffered in the course of a criminal incident for which there was some previous similarity, such as shoplifting, loitering, or commercial robbery, the event and the resultant injuries might have been sufficiently foreseeable to give rise to a duty. However, the victims in this case were not injured in the course of a similar subsequent event. To the contrary, there is no evidence of anything remotely similar to the deliberate, targeted shootings in this case. We acknowledge that crime is a distressingly common feature of modern life. We further acknowledge that certain types of criminal misconduct may occur with sufficient frequency that business proprietors should anticipate them. However, we do not believe the type of crime which is at issue in this case, specifically, a sudden, deliberate and targeted shooting, is sufficiently commonplace that business proprietors should be categorically required to foresee such occurrences. See Restatement (Second) of Torts § 314A emt. e (observing that the duty in any case is circumscribed by foreseeable risks, and as such, a defendant “is not required to take precautions against a sudden attack from a third person which he has no reason to anticipate”).
{12} Plaintiffs have not pointed us to any case in which a court concluded that a business operator had a duty to prevent a sudden, deliberately targeted assassination of customers on its premises. In our research we have failed to find such a case, and to the extent there is authority, it holds that there is no such duty. See generally Wiener v. Southcoast Childcare Ctrs., Inc., 32 Cal.4th 1138, 12 Cal.Rptr.3d 615, 624, 88 P.3d 517 (2004) (holding that the day care center and lessor had no duty to prevent a driver from deliberately driving his car through a chain link fence and striking children in a playground because the “brutal criminal act” was unforeseeable); Toscano Lopez v. McDonald’s Corp., 193 Cal.App.3d 495, 238 Cal. Rptr. 436, 445 (1987) (holding that there was no duty to prevent a random, mass murderous assault upon customers in a McDonald’s located in a high crime area because such an event was not foreseeable).
{13} We first examine whether existing case law supports a conclusion that Defendant owed a duty to Tollardo, the person that Perea specifically targeted for assassination. In Jones v. Williams, 160 Mich.App. 681, 408 N.W.2d 426 (1987) (per curiam), a customer was shot in a parking lot adjacent to a restaurant after buying takeout food from the restaurant. Id. at 427. The record established that the shooter specifically targeted the customer. Id. at 428. Affirming the summary judgment granted to the restaurant, the court concluded that the restaurant *524did not owe a duty to protect the customer from “an unforeseeable assassination attempt.” Id. “Even the presence of guards could not prevent assassination attempts.” Id. at 429. In Faheen ex rel. Hebron v. City Parking Corp., 734 S.W.2d 270 (Mo.Ct.App. 1987), the victim was assassinated in a car bombing that took place in the parking garage of the apartment complex where he lived. Id. at 271. Prior to the bombing, crimes were committed on the premises of the apartment complex or in close proximity, which consisted of arson, robbery, burglary, stealing, and various misdemeanors. Id. The court said that “a homicide or injury caused by a car bombing is significantly different from the reported crimes,” and concluded that the property owner had no duty to protect against the assassination. Id. at 274 “[The deceased] was the victim of an assassination]. There is nothing in [the] plaintiffs’ petition that would put a reasonable man on notice that he should take precautions to protect his invitees against such a misdeed.” Id. In Guerrero v. Memorial Medical Center, 938 S.W.2d 789 (Tex.App. 1997), the victim died after her husband went to her workplace and shot her. Id. at 790. The court concluded that the crime was not foreseeable because no evidence was presented that the employer knew, or had a reason to know, that the husband had been physically abusing the victim and was about to murder her. Id. at 795. Summary judgment in favor of the employer was therefore affirmed. Id.; see also Gragg v. Wichita State Univ., 261 Kan. 1037, 934 P.2d 121, 135 (1997) (holding it was not foreseeable by the sponsor of Fourth of July fireworks display that a gang member intended to shoot anyone at the fireworks display).
{14} We also examine whether existing case law supports a conclusion that Defendant owed a duty to the victims who were with Tollardo when Perea attacked Tollardo. In Hillcrest Foods, Inc. v. Kiritsy, 227 Ga. App. 554, 489 S.E.2d 547 (1997), a witness testified that a man drove by the Waffle House where his wife was working and fired three or four shots into the Waffle House in an attempt to kill her. Id. at 549. Two of the bullets struck the victim who was a patron in the Waffle House, and he was paralyzed from the waist down. Id. The plaintiff presented evidence that several prior crimes against persons had occurred on the premises prior to the drive-by shooting. Id. However, the drive-by shooting itself was not a foreseeable act. Id. at 551. Because its reasoning is particularly applicable to the facts before us in this case, we quote:
It was an act of terrorism that could have occurred anywhere that the intended victim happened to be. [The defendant] had no basis to foresee such event, and there was no effective action which it could reasonably have taken to prevent said act under the circumstances.... The shooting was a transitory act that could have been carried out at any time and place that the intended victim happened to be.
Id. In Thai v. Stang, 214 Cal.App.3d 1264, 263 Cal.Rptr. 202 (1989), the victim was shot twice when he and a companion were standing outside the entrance to a roller skating rink. Id. at 203. The victim’s companion, who was a rival gang leader, was the intended target, when a car drove by, spraying the entrance with bullets fired from an automatic rifle. Id. Summary judgment was granted to the premises owner and operator of the skating rink on the basis that it had no duty to prevent the shooting because the drive-by shooting was unforeseeable, even though pri- or to the shooting, there had been automobile break-ins, fist-fights between teenagers, and a burglary on the premises. Id. at 203-04. The California Court of Appeal affirmed, noting in particular that given the random nature of drive-by shootings, the landowner could not have prevented the shooting in that ease. Id. at 206-07.
{15} Plaintiffs further contend that the affidavit of their expert creates a factual issue for the jury to decide. Although we acknowledge that expert testimony may be considered in this context, see, e.g., Herrera, 2003-NMSC-018, ¶¶ 3, 22, 24, the ultimate issue remains a question of law upon which expert testimony is in no sense determinative. See Romero v. City of Santa Fe, 2006-NMCA-055, ¶ 26, 139 N.M. 440, 134 P.3d 131 (observing that questions of law are “not subject to conclusive proof by expert testimony”). Moreover, the opinion of Plaintiffs’ *525expert is based on the prior reports of criminal activity. As stated above, fundamentally dissimilar prior incidents do not render the type of crime which occurred in this case reasonably foreseeable.
2. Proximate Cause
{16} The parties also dispute whether Defendant’s alleged negligence in failing to provide security could be regarded as a proximate cause of Plaintiffs’ injuries. As previously stated, the district court did not rely on any analysis of proximate cause to support the award of summary judgment. Because our assessment of the duty issue supplies a sufficient independent basis for affirmance, it is not necessary for us to undertake a separate analysis of the element of proximate causation at this time.
3. Discovery
{17} Finally, Plaintiffs contend that the award of summary judgment was improper because they should have been afforded a greater opportunity to engage in discovery. It is generally inadvisable to grant summary judgment before discovery has been completed. Sun Country Sav. Bank v. McDowell, 108 N.M. 528, 534, 775 P.2d 730, 736 (1989). However, this is not universally the case.
{18} Our Rules of Civil Procedure provide that a party faced with a motion for summary judgment may ask the district court to stay its determination so that the non-movant can conduct discovery needed to rebut the motion. See Rule 1-056(F) NMRA. If such a stay is sought, the party must submit an affidavit explaining why additional time and discovery are needed. Id. In this regard, vague assertions are insufficient; rather, the party “must specifically demonstrate how postponement of a ruling on the motion will enable him, by discovery or other means, to rebut the movant’s showing of the absence of a genuine issue of fact.” Butler v. Deutsche Morgan Grenfell, Inc., 2006-NMCA-084, ¶ 38, 140 N.M. 111, 140 P.3d 532 (internal quotation marks and citation omitted).
{19} In this case, Plaintiffs never made any specific allegations regarding what they hoped to find in discovery. Under such circumstances, the district court was at liberty to proceed with the award of summary judgment, notwithstanding Plaintiffs’ cursory assertions about the need for further discovery. See id. ¶¶ 38-39 (arriving at a similar conclusion under similar circumstances).
CONCLUSION
{20} For the reasons stated, we conclude that Defendant had no duty to prevent the deliberate, targeted shooting at issue in this case.
{21} IT IS SO ORDERED.
WE CONCUR: CYNTHIA A. FRY, Chief Judge and TIMOTHY L. GARCIA, Judge.