POLEN, J.

The appellant, Onondieu Demelus ("Demelus"), appeals the trial court's order granting summary judgment for King Motor Company of Fort Lauderdale ("King Motor"). This appeal addresses whether it was legally foreseeable that a vehicle would be stolen from King Motor's premises and cause injury to a third party. We conclude that the manner of theft was not legally foreseeable and affirm.

King Motor is an automobile dealership that, at the time of the relevant facts, was located on East Sunrise Boulevard in Fort Lauderdale. Eight automobile franchises were located on King Motor's premises. The property consisted of eleven acres and housed five showrooms and four buildings for vehicle repair and maintenance. At any given time, there were several hundred vehicles on the premises.

To secure its premises, King Motor employed an evening security guard who patrolled the well-lit property. Metal posts surrounded the perimeter of the property, such that ingress and egress of a vehicle was possible only through the designated entranceways. At night, the entranceways were gated, chained, and locked, and blocker vehicles were placed in front of each of these gates. The vehicles on the property were locked, and the keys to the vehicles were stored inside locked buildings. King Motor had a policy to ensure the security of its keys, and there is no evidence that King Motor's key security policy was violated on the night of the theft. The showroom from which the keys were stolen had hurricane-proof windows. The building did not have an alarm system or video surveillance cameras, which King Motor contends is typical of most U.S. dealerships.

King Motor experienced thirty-six break-ins and thefts of vehicles during the six-year period prior to May 5, 2006, the date of the theft and accident. These thefts may be described as a combination of employee thefts, customer thefts during business hours, or unexplained thefts without evidence of a break-in. The police incident reports do not state that any of the prior incidents involved a criminal breaking into a locked showroom and stealing the keys to vehicles, breaking out of the premises through a locked gate, or ramming blocker vehicles to exit the premises.

On May 5, 2006, Demelus was injured in an automobile accident involving one of three vehicles that were stolen from King Motor's property by a juvenile gang. The locked showroom had its hurricane-proof windows smashed to allow entry. Glass windows were also broken to gain access to the locked interior offices. The cubicles were ransacked, locked drawers were opened, and doors were kicked in. The room where the keys were kept was broken into, as was the box that held the keys. There was no evidence that the key to the stolen vehicle involved in the accident was not stored in a locked, secure area prior to the theft. After the thieves gained access to the vehicles with the keys and began driving, the thieves either rammed or moved the blocker vehicle that obstructed the gate to the premises. The thieves also rammed open the chained, locked gate. Thereafter, one of the stolen vehicles was involved in an accident with Demelus several blocks away.

In the underlying action, Demelus sued King Motor for damages he sustained in the automobile accident involving the vehicle stolen from King Motor. Demelus filed an affidavit by a purported security expert, who made conclusory statements of law that King Motor's security practices were negligent, that King Motor's negligence caused Demelus's injury, and that Demelus's injury was preventable if King Motor had done more to prevent the theft. King Motor moved for summary judgment and claimed that the theft of the vehicle was unforeseeable. The trial court granted summary judgment for King Motor. We affirm.

The central question raised by this appeal is whether, given the unique facts of the case, the theft that led to Demelus's injury was foreseeable. Foreseeability as it relates to duty in negligence cases is a question of law. Aircraft Logistics, Inc. v. H.E. Sutton Forwarding Co., 1 So.3d 309, 311 (Fla. 3d DCA 2009). Because the trial court resolved the case on summary judgment, our review is de novo. Fla. Bar v. Greene, 926 So.2d 1195, 1200 (Fla. 2006); Johnson v. Boca Raton Cmty. Hosp., Inc., 985 So.2d 593, 595 (Fla. 4th DCA 2008).

"Where a defendant's conduct creates a foreseeable zone of risk, the law generally will recognize a duty placed upon defendant either to lessen the risk or see that sufficient precautions are taken to protect others from the harm that the risk poses." McCain v. Fla, Power Corp., 593 So.2d 500, 503 (Fla. 1992); see also United States v. Stevens, 994 So.2d 1062, 1067 (Fla. 2008). Duty, however, is not limitless. To impose a duty, it is not enough that a risk merely exists or that a particular risk is foreseeable; rather, the defendant's conduct must create or control the risk before liability may be imposed. See Aguila v. Hilton, Inc., 878 So.2d 392, 395, 396-97 (Fla. 1st DCA 2004).

Demelus relies primarily on the theory of negligent access to a vehicle, as established in Vining v. Avis Rent-A-Car Systems, Inc., 354 So.2d 54 (Fla. 1977), and applied recently in Hewitt v. Avis Rent-A-Car System, Inc., 912 So.2d 682 (Fla. 1st DCA 2005). We find these cases distinguishable and, therefore, not controlling. Demelus also relies on a theory of premises liability, which we find to be without merit because Demelus's injury did not occur on King Motor's premises.

In Vining, a rental car company left its rental car unattended in an airport parking lot with the keys in the ignition, the door open, and the car lights flashing. 354 So.2d at 55. The car was situated in a manner such that it could be easily driven onto the public roads without obstruction. Id. The vehicle was stolen, and the thief collided with the plaintiffs car, injuring the plaintiff. Id. The Florida Supreme Court endorsed the view of the New Jersey Superior Court and stated that:

[T]he key to duty, negligence and proximate cause when keys are left in an unlocked motor vehicle is the foreseeability to a reasonable man of an unreasonable danger presented to other motorists. If the danger is foreseeable, then a duty arises toward the members of the public using the highways, its breach is negligence, and the injury is the proximate result of the breach, or so a jury should be permitted to find.

Id., (quotations omitted).

The supreme court invoked the dangerous instrumentality doctrine when stating that "[t]he owner of a dangerous instrumentality must exercise due care" to ensure that a "danger of injury to the general public using the highways" does not occur. Id. at 56; see also Aurbach v. Gallina, 753 So.2d 60, 62 (Fla. 2000) (stating that an automobile in operation is a dangerous instrumentality). Additionally, the supreme court grounded its finding of a duty based on section 316.097, Florida Statutes (1975), which stated that "no person driving or in charge of any motor vehicle . . . shall permit it to stand unattended without first stopping the engine, locking the ignition, and removing the key. . . ." Vining, 354 So.2d at 56.

In Hewitt, during an eighteen-month period, no fewer than thirty-seven motor vehicles Avis owned or controlled were removed from Avis's rental lot by Avis employees and "rented" in "side deals" or otherwise entrusted to acquaintances of the Avis employees. 912 So.2d at 683. Avis managerial employees were aware that vehicles were missing from the lot under circumstances that should have placed them on notice that they had been stolen. Id. The plaintiff alleged that despite this knowledge, Avis failed to establish and/or enforce safeguards to prevent the theft, use, entrustment and/or removal of its vehicles from the premises. Id. at 683-84. The stolen vehicle at issue was involved in an accident, and Avis keys were found in the ignition. Id. at 684.

The trial court in Hewitt granted summary judgment and stated that Avis had no duty to prevent its cars from being stolen. Id. Reversing, the First District Court of Appeal stated that a duty to secure a vehicle could be found independently of section 316.097. Hewitt, 912 So.2d at 684, 685. However, rather than finding that a duty existed as a matter of law, the First District chose to leave to the jury the question of whether Avis's conduct created a foreseeable zone of risk, and therefore a duty. Id. at 686; cf. Aircraft Logistics, 1 So.3d at 311 (stating that foreseeability as it relates to duty is a question of law). The Hewitt court cited the following "special circumstances" to justify its decision to leave the question of foreseeability to the fact finder:

[T]he high number of thefts at Avis's downtown facility during the short span of time preceding the accident; the general access its employees had to the vehicles' keys; the absence of any safeguards by management against theft; management's failure to take prompt action despite its awareness that its employees were involved in criminal activity; its failure to promptly report vehicle thefts to law enforcement; and the knowledge that Avis had, or should have had, of the harm that often occurs from the careless operation by thieves of stolen vehicles. . . .

912 So.2d at 686.

Vining and Hewitt are not controlling because in these cases the keys to the vehicles were made readily available by the defendant's own conduct, a situation that is not present in this appeal. Specifically, in Vining, the keys were left in the ignition, and in Hewitt, the employees entrusted the vehicles to acquaintances and made "side deals," which the court viewed as factually analogous to leaving the keys in the vehicle. In other words, a duty arose in these cases because the defendants' affirmative conduct created a foreseeable zone of risk; namely, that the vehicles might be stolen and subsequently used to injure a third party. In this appeal, King Motor did not create a risk; rather, King Motor's nighttime security practices guarded against the risk that its vehicles would be stolen. Indeed, unlike in Vining and Hewitt, King Motor was not complicit in the theft. King Motor did not make its keys readily available to the thieves who caused Demelus's injury; instead, the keys were stored in a locked office in a locked building. The thieves were able to obtain access to the keys only by breaking into the locked showroom and locked offices within the showroom. The thieves were then able to obtain access to the public roads only by ramming open the chained, locked gate and by moving blocker vehicles that were intended to obstruct the vehicular egress from the property.

Furthermore, the "special circumstances" that existed in Hewitt simply are not present here. Although King Motor previously experienced vehicle theft, it was not nearly as rampant as in Hewitt. In Hewitt, Avis experienced thirty-seven thefts within one-and-a-half years, whereas King Motor experienced thirty-six thefts over a six-year period. More importantly, none of the prior vehicle thefts occurred in the same manner as the thefts in this incident — by breaking into the showroom and its offices and by stealing keys to the vehicles. Unlike in Hewitt, King Motor employees did not have "general access" to the vehicles, as there were specific key security policies in place. Furthermore, there were multiple safeguards against nighttime theft, including having a security guard, locking the showrooms and offices where the keys were kept, locking and chaining the gates to the property and obstructing vehicular egress through the placement of blocker vehicles. Unlike in Hewitt, the record does not suggest undue delay in reporting the thefts, nor were King Motor's employees involved in the theft the night of the accident that injured Demelus. Therefore, we find Demelus's reliance on the negligent access to a vehicle theory to be unpersuasive.

Having concluded that the negligent access to a vehicle theory does not impose a duty on King Motor because of the lack of foreseeability, we next turn to the broader principles of negligence law, as established in McCain and its progeny. Since McCain, the Florida Supreme Court has significantly expanded the concept of duty in Florida negligence law and made foreseeability the sole determinant of whether a duty exists. See Stevens, 994 So.2d at 1067 ("[T]he `foreseeable zone of risk' test discussed in McCain is the test to be applied under Florida law to determine whether a duty exists under our negligence law."). Indeed, the supreme court has stated that the "imposition of a duty is nothing more than, a threshold requirement that if satisfied, merely opens the `courthouse doors.'" Whitt v. Silverman, 788 So.2d 210, 221 (Fla. 2001) (citation omitted).

Stevens is highly relevant to the determination of this appeal and must be distinguished. Stevens came to the Florida Supreme Court on a certified question. Like this case, Stevens addresses a party's duty under Florida negligence law when there is intervening criminal activity and allegations of negligent security practices. Although Stevens involves allegedly negligent security practices regarding ultra-hazardous materials, the case was decided on general principles of Florida negligence law, rather than strict liability for ultra-hazardous materials. See id. at 1071 (Wells, J., dissenting) (arguing that Stevens should have been decided under strict liability principles relating to ultra-hazardous activities).

In Stevens, a decedent's personal representative brought a wrongful death complaint against both the U.S. government and a private research laboratory after the decedent received anthrax in the mail, inhaled the anthrax, and died. 994 So.2d at 1064. The complaint alleged that the government possessed, was handling, and storing samples of anthrax at a research laboratory. Id. The government allegedly was aware that anthrax samples were missing. Id. The complaint alleged that despite this knowledge, the government failed to provide adequate security for the handling or shipping of the anthrax, and that as a result, the anthrax was "improperly intercepted" (i.e., stolen) either in transit or from another research facility to which the samples were sent. Id. The complaint alleged that the lab breached its duty of care to the decedent by failing to implement adequate security procedures at its facility. Id.

In moving to dismiss the complaint, the government argued that "it could not be liable for any third party criminal activity allegedly occasioned by negligent security practices because it owed no duty of protection to [the decedent], a stranger, and did not have a duty or ability to control the unidentified third party tortfeasor or tortfeasors responsible for intercepting and mailing the anthrax." Id. at 1065. The plaintiff argued "that the complaint did not allege a claim of failure to control or prevent the mailing of the anthrax by a third party criminal, but, rather, a claim of duty of care Whenever a human endeavor creates a generalized and foreseeable risk of harming others.'" Id. The federal district court denied the government's motion, and found that the plaintiffs claim fell under McCain `s "foreseeable zone of risk" theory. Id.

Addressing the issue on a certified question from the U.S. Eleventh Circuit Court of Appeals, the Florida Supreme Court agreed with the federal district court and stated that "negligence liability may be imposed on the basis of affirmative acts which create an unreasonable risk of harm by creating a foreseeable opportunity for third party criminal conduct, even though there is no `special relationship' between the parties that independently imposes a duty to warn or guard against that misconduct." Id. at 1068. Significantly, the court did not reject the plaintiffs argument that the government's failure to adopt reasonable security measures was not a mere failure to act, but was actually an affirmative act. See Stevens, 994 So.2d at 1069 n. 4. The supreme court stated that the plaintiffs complaint is sufficient to establish a duty of care "to open the court-house doors" and considered relevant the facts that the government knew or should have known of the risk of bioterrorism given its history of missing laboratory specimens, that a reasonable laboratory operator would understand that the public would be exposed to an unreasonable risk of harm unless it implemented adequate security procedures to guard against the risk, and that the third party's death was a foreseeable consequence of the failure to use reasonable care in adopting and implementing security measures to guard its biohazardous materials. Id. at 1069. Thus, Stevens is similar to this appeal in the sense that in both cases, the defendant is being accused of negligent security practices, which allegedly allowed third-party criminal conduct to occur, and that this criminal conduct caused the plaintiff to suffer an injury. We conclude that this case does not control, and the distinguishable factors merit discussion.

We consider Stevens to be distinguishable for three reasons. First, King Motor's security practices did not create a risk of harm, let alone an unreasonable risk of harm. Second, to the extent that King Motor's security practices were deficient, such a deficiency does not constitute an affirmative act under the facts of the case. Third, King Motor's acts did not create a foreseeable opportunity for third-party criminal conduct.

At the most basic level, Stevens involved allegedly negligent security practices regarding ultra-hazardous materials, while this appeal involves allegedly negligent security practices regarding the operation of an auto dealership. We consider it much more likely that negligent security practices involving ultra-hazardous materials create a risk than negligent security practices of an automobile dealership. Allegedly negligent security practices involving anthrax create a risk because anthrax, when inhaled, is deadly. The government knew of this risk in Stevens, and therefore, it was foreseeable that harm would result from negligent security in guarding the anthrax samples. Unlike anthrax samples, automobiles are ubiquitous in our society. A locked, parked vehicle with the engine off is not a dangerous instrumentality. The risk of harm involving an automobile exists only when the automobile is turned on and driven. See Aurbach, 753 So.2d at 62 (stating that a vehicle in operation is a dangerous instrumentality). Thus, King Motor's conduct did nothing to create a risk of harm, such as making the keys to the vehicles readily available, like in Vining and Hewitt. Instead, King Motor sought to prevent its cars from being used. The operation of an automobile dealership in which the vehicles are locked and kept behind a locked, chained gate, with the keys to the vehicles kept in a locked building, does not create a risk of harm as a matter of law.

To the extent that King Motor's security practices were deficient, the deficiency does not constitute an affirmative act. In Stevens, the court did not reject the plaintiffs argument that the government's failure to adopt reasonable security measures was an affirmative act, and not a mere failure to act. Id., at 1069 n. 4. In allowing the plaintiff to characterize the government's behavior this way, it can be said that the government's affirmative act of failing to adopt reasonable security measures created a foreseeable risk of bioterrorism. See id. at 1068 ("[A]cts of commission . . . historically generate a broader umbrella of tort liability than acts of comission "). When ultra-hazardous materials are involved, this characterization is understandable. However, to the extent that King Motor's security practices were deficient, its security practices are better understood as an omission, or a failure to act, rather than as an affirmative act, or commission. See id. at 1069 n. 4 ("[B]y `misfeasance' the defendant has created a new risk of harm to the plaintiff, while by `nonfeasance' he has at least made his situation no worse. . . .") (quoting Prosser and Keeton on the Law of Torts § 56, at 373-75 (W. Page Keeton et al. eds., 5th ed. 1984)). Because the risk of being injured in an automobile accident already existed when Demelus chose to travel on the public roads, the fact that King Motor kept its cars secured on its premises makes Demelus's risk of injury no worse. Because King Motor kept its vehicles secured, it did not create a risk of third-party criminal conduct. For King Motor to have created a risk of third-party criminal conduct, it would have had to, for example, affirmatively make its vehicles available to the thieves. Cf. Vining, 354 So.2d 54; Hewitt, 912 So.2d 682. Moreover, the mere assertion by Demelus's expert that King Motor could have enacted more stringent security measures, regardless of their economic feasibility or practices of similar auto dealerships, does not create a material issue of fact to preclude summary judgment.

It is prudent to note that this particular form of theft was unforeseeable to King Motor, given its prior history of vehicle theft. Questions of foreseeability are fact-dependent. Because King Motor had not experienced similar thefts in the past, the vehicle theft at issue in this appeal was unforeseeable as a matter of law. Furthermore, King Motor's conduct did not create a risk. Although the supreme court has characterized the imposition of a duty as a mere threshold, we hold that the facts of this case do not cross this threshold. Therefore, we agree with the trial court's grant of summary judgment for King Motor.

Affirmed.

MAY and GERBER, JJ., concur.