delivered the opinion of the court:
This case arises from the shooting of the plaintiff, Mark Hill, in the lobby of 1158 N. Cleveland, Chicago, Illinois, a building which is part of defendant Chicago Housing Authority’s (hereinafter CHA’s) Cabrini Green Housing Project. Plaintiff brought a single-count complaint against CHA and defendant Triad Security alleging negligence by the defendants. (Although Triad Security is now known as Guardian Security Services, Inc., this opinion shall refer to this defendant as Triad, which refers to its designation in the caption and in the notice of appeal.) The trial court granted CHA’s motion for summary judgment and Triad’s motion to dismiss, and plaintiff appeals. For the reasons set forth below, we affirm.
Facts
On March 18, 1986, at approximately 12:30 a.m., plaintiff was shot by an unknown assailant when he walked into the lobby of the building at 1158 N. Cleveland in Chicago. Plaintiff’s mother lived in that building.
On September 28, 1987, plaintiff filed a one-count complaint against defendants. In that complaint, plaintiff alleged that the CHA had a duty to exercise reasonable care and diligence to keep the building at 1158 N. Cleveland in a reasonably safe condition and to take necessary precautions to prevent loitering in the common areas of the building. Plaintiff further alleged that, in furtherance of that duty, CHA had retained the services of Triad to protect and patrol the building.
The complaint alleged that the defendants were negligent in allowing dangerous persons to loiter in the common areas and hallways, and in failing to have security personnel patrol those areas to prevent such loitering and assaults on the plaintiff and others who were rightfully using the common areas. Plaintiff also alleged that the assault was the direct and proximate result of the defendants’ negligence.
CHA answered the complaint, admitting that it had a duty to maintain its property in a reasonably safe condition and that it had retained the services of Triad to protect the property. CHA denied the specific allegations of negligence.
Triad filed a motion to dismiss pursuant to section 2—619 (Ill. Rev. Stat. 1987, ch. 110, par. 2—619). In support of its motion, Triad *926submitted the affidavits of George Sasek, its acting operations manager, and Winston Moore, director of security for the CHA. According to Sasek, the oral agreement between CHA and Triad required Triad to provide security services on a day-to-day basis as requested by the CHA. These services were limited to the protection of CHA property without any agreement to protect residents or guests of the buildings. At the time of the assault, no Triad personnel were located at 1158 N. Cleveland since none were assigned by the CHA to that unit at that time.
Triad contended that the complaint should be dismissed since it had no duty to provide security to the premises at the time in question and also that its duty was limited to the protection of property.
On May 3, 1988, CHA filed a motion for summary judgment (Ill. Rev. Stat. 1987, ch. 110, par. 2—1005), supported by the affidavits of Sasek and Moore. CHA contended it had no duty to protect plaintiff, that it had no duty to provide security for the tenants of its housing units, and that it did not contract with Triad to provide such security. In addition, under section 4—102 of the Local Governmental and Governmental Employees Tort Immunity Act (Ill. Rev. Stat. 1987, ch. 85, par. 4—102) (hereinafter the Tort Immunity Act), a municipal body is not liable for failure to provide adequate police protection or to prevent the commission of crimes.
On February 7, 1989, Triad filed an amended motion to dismiss. This motion was substantially the same as Triad’s original motion to dismiss, but was supported by the affidavit of Kenneth Kotz, president of Triad, rather than that of Sasek.
On March 9, 1989, plaintiff filed an amended complaint. This complaint added an allegation that the defendants were negligent in failing to provide adequate lighting in the common areas and hallways so as to ensure that tenants and others lawfully on the premises could see persons loitering in the area. CHA filed an answer to the amended complaint, again denying plaintiff’s allegations. Triad adopted its amended motion to dismiss the original complaint as its motion to dismiss the amended complaint, and CHA adopted its original motion for summary judgment as its motion for summary judgment as to plaintiff’s amended complaint.
CHA also filed three affirmative defenses. The first alleged that plaintiff’s injuries were caused by plaintiff’s own negligence. The second affirmative defense was based upon section 3—102 of the Tort Immunity Act (Ill. Rev. Stat. 1987, ch. 85, par. 3—102), which provided that defendant could not be held liable for injuries arising out of *927defects on its premises absent actual or constructive notice of such defects. CHA contended that it had no such notice.
As its third defense, CHA argued that under section 4—102 of the Tort Immunity Act, it was not liable for failure to prevent the commission of the crime here, and that this immunity was not waived by hiring the codefendant Triad. By agreed order entered June 8, 1989, the third affirmative defense was stricken. Although CHA was granted time to file an amended defense, the record does not indicate that it did so.
In opposition to the defendants’ motions, plaintiff filed the affidavits of Jerry Weldon and Dwyne Sanford, former security guards employed by Triad and stationed at Cabrini Green. According to the affi-ants, their jobs were to patrol the complex, prevent loitering, report lights which were out in the common areas, and to report vandalism in order to keep the premises safe for the residents. Weldon and Sanford also stated that guards were to be stationed at Cabrini Green 24 hours a day.
Plaintiff also filed several depositions with the court. In his deposition, Winston Moore, director of security for CHA, stated that the CHA itself employs no security personnel, but engages private security contractors to provide security for the property. Triad had been a security contractor for the CHA since 1982, operating under an oral agreement. Under the agreement, Triad was to provide security services for the CHA on a day-to-day basis whenever requested by the CHA. The agreement was made between Moore and Jim Melanowski and Kenneth Koch, the owners of Triad.
Another deposition filed by plaintiff was that of Lt. Eddie King of the public housing authority unit of the Chicago police department. Lt. King estimated that in the two years prior to plaintiff’s shooting, there had been 10 shootings and three or four stabbings at Cabrini Green. It was the policy of the police department to inform the CHA about shootings, serious stabbings and unexplained deaths on its property.
Plaintiff also filed his own deposition in which he testified about the shooting. At about 12:30 a.m. on March 18, 1986, he was returning home after taking his girl friend home. As he approached 1158 N. Cleveland, he saw three individuals entering the building. Rather than enter the building directly, he first walked around it three times. Plaintiff explained that he did this because the building was dark, the lights in the lobby having been vandalized by the gangs. Plaintiff stated that it was his habit to not enter the lobby immediately when *928he saw unknown individuals enter before, but to wait and give them enough time to get upstairs before he would enter.
When he did enter the lobby, someone jumped out from behind a door, yelled, pulled a gun and started shooting. After being shot, plaintiff ran out the back of the building. His assailant did not follow.
Plaintiff also testified that one of his friends had been shot and killed in the same building. Plaintiff could not remember when that shooting occurred nor did he name the alleged victim. Plaintiff also stated that a female Jehovah’s Witness whose name he did not know had been assaulted in a dark hallway of the building.
When questioned by his attorney, plaintiff stated that the lights in the lobby of 1158 N. Cleveland had been out for two or three weeks prior to the shooting, and that a week before, he had complained to the building janitor. The lights were not repaired or replaced.
The deposition of Kenneth Kotz, president of Triad, was also filed by the plaintiff. Kotz testified that his company provided security services to the CHA under an oral agreement. Under that agreement, Triad was to provide protection for the property of the CHA and had no responsibility to provide security for the residents. Their duties were to make vacant apartment checks, patrol the grounds and look to see if vandalism had been committed.
According to Triad’s records, it had guards assigned to Cabrini Green on the 4-to-12 shift on March 17, 1986, but no guards were located at 1158 N. Cleveland when the plaintiff was assaulted.
James Malinowski, co-owner of Triad, was also deposed by the plaintiff. He testified that from 1982 to some time after the plaintiff was shot, his company provided security services for the CHA under an oral agreement. The CHA would call Triad to request a specific number of guards and would specify which CHA properties they were to cover.
The final deposition presented by plaintiff was that of George Sa-sek, assistant operations manager for Triad. He stated that he had no personal knowledge of what the oral agreement was between Triad and the CHA at the time of plaintiff’s shooting. Questioned about his statement in his affidavit that Triad had no guards present at 1158 N. Cleveland at the time of the shooting, Sasek believed that he had referred to roll call sheets in making that statement.
The defendants replied to the plaintiff’s arguments. CHA, in addition to disagreeing with plaintiff’s legal position, urged the court to disregard the affidavits of guards Weldon and Sanford which plaintiff filed in opposition to the summary judgment motion. CHA argued that plaintiff had been given ample time to depose two of Triad’s *929guards, and that the failure to do so deprived CHA of the opportunity to cross-examine those guards.
Triad also urged that the affidavits of the guards should be disregarded since they failed to meet the requirements of Supreme Court Rule 191 (134 Ill. 2d R. 191), because they failed to set forth facts which indicated that either affiant had any personal knowledge of the agreement between Triad and the CHA. At oral arguments on defendants’ motions, Triad again argued that the affidavits were insufficient under Rule 191.
Following argument on the motions, the court entered an order on January 30, 1990, granting CHA’s motion for summary judgment and Triad’s motion to dismiss. Plaintiff filed a timely notice of appeal.
Opinion
Plaintiff contends that it was error to grant defendants’ motions since he presented sufficient evidence regarding the duties of each defendant to create an issue of material fact as to the duties of each defendant and whether those duties were properly discharged. We shall address CHA’s summary judgment motion first.
A motion for summary judgment should be granted when the pleadings, depositions and affidavits show that there is no genuine issue as to any material fact and that the moving party is entitled to a judgment as a matter of law. (Ill. Rev. Stat. 1989, ch. 110, par. 2—1005(c).) In an action for negligence, the plaintiff must allege sufficient facts to establish the existence of a duty owed by the defendant to a plaintiff, a breach of that duty, and an injury proximately resulting therefrom. (Vesey v. Chicago Housing Authority (1991), 145 Ill. 2d 404, 411, 583 N.E.2d 538; Rowe v. State Bank (1988), 125 Ill. 2d 203, 215, 531 N.E.2d 1358.) Whether the defendant owes a duty to the plaintiff is a question of law, to be determined by the court. (Vesey, 145 Ill. 2d 404, 583 N.E.2d 538; Rowe, 125 Ill. 2d 203, 531 N.E.2d 1358.) In the absence of facts from which the court could infer the existence of a duty, there can be no recovery and summary judgment for the defendant is proper. (Vesey, 145 Ill. 2d 404, 583 N.E.2d 538; Rowe, 125 Ill. 2d 203, 531 N.E.2d 1358.) We thus must determine whether under the facts of this case the CHA owed plaintiff any duty. As discussed below, we conclude that it did not.
The parties agree that, as a general rule, a landlord owes its tenants no duty to protect them from criminal acts by others. (Pippin v. Chicago Housing Authority (1979), 78 Ill. 2d 204, 399 N.E.2d 596.) There are, however, exceptions to this rule. One exception exists when a landlord voluntarily undertakes to provide security services, in *930which event he assumes a duty not to be negligent in the performance of that undertaking. (Rowe, 125 Ill. 2d 203, 531 N.E.2d 1358; Phillips v. Chicago Housing Authority (1982), 89 Ill. 2d 122, 431 N.E.2d 1038; Cross v. Wells Fargo Alarm Services (1980), 82 Ill. 2d 313, 412 N.E.2d 472; Pippin, 78 Ill. 2d 204, 399 N.E.2d 596.) The extent of any liability is strictly limited by the scope of the undertaking. (Rowe, 125 Ill. 2d 203, 531 N.E.2d 1358; Phillips, 89 Ill. 2d 122, 431 N.E.2d 1038; Cross, 82 Ill. 2d 313, 412 N.E.2d 472; Pippin, 78 Ill. 2d 204, 399 N.E.2d 596.) When a landlord hires a security firm to provide security services, he may be liable for negligent hiring. (Pippin, 78 Ill. 2d 204, 399 N.E.2d 596.) When the landlord undertakes security measures himself, he has a duty of reasonable care in that undertaking. Phillips, 89 Ill. 2d at 127.
Plaintiff contends that there was evidence to establish an issue of fact as to the extent of the CHA’s undertaking to provide security. By virtue of the fact that the CHA retained control and direction over Triad’s services, telling it how many guards it needed and when and where those guards were to be sent, plaintiff argues that the CHA in effect was providing the security itself. He also contends that the CHA’s undertaking included the protection of residents of the CHA from criminal attacks, pointing to statements by Triad president Kotz that in protecting the property from fire and vandalism, it was protecting the residents. Plaintiff also relies on the affidavits of Triad guards Weldon and Sanford that they were to keep the premises safe for the residents, and that guards were to be at Cabrini Green 24 hours a day.
The CHA urges that there are no facts from which it can be inferred that the CHA itself undertook to provide protection for its tenants from criminal attacks by third parties, or that it hired Triad to protect people as opposed to property. According to the CHA, the only competent evidence of its undertaking is the affidavits of Moore and Kotz, both of whom testified that the oral agreement between CHA and Triad was only to protect the property. As a result of its not undertaking to protect people, CHA had no duty to protect the plaintiff, and summary judgment was properly granted. We agree.
The affidavits presented by the CHA establish that it undertook only the protection of property. Thus, since its duty is limited by the extent of that undertaking, it owed the plaintiff no duty to protect him from the criminal act by which he was injured.
As the party moving for summary judgment, the CHA has met its burden of presenting facts which, if uncontradicted, would entitle it to a judgment as a matter of law. (Purtill v. Hess (1986), 111 Ill. 2d 229, *931241, 489 N.E.2d 867.) It was therefore incumbent upon plaintiff to present facts, by counteraffidavit, to contradict the CHA’s submissions. Plaintiff attempted to do this through the affidavits of Triad guards Weldon and Sanford.
Triad argued in its reply brief in the trial court, and again at oral arguments on the motions, there was no way for the guards to have personal knowledge of the agreement between the CHA and Triad, and thus the affidavits were insufficient under Supreme Court Rule 191. (134 Ill. 2d R. 191.) We agree. Our review of the substance of the affidavits indicates that their allegations are inadequate to contradict the material facts regarding the scope of the agreement as established by defendants’ submissions.
Neither affidavit addressed the actual terms of the agreement, nor did the affiants claim to have any knowledge of the actual agreement. Instead, they listed what they understood to be their responsibilities as guards, and what they believed to be their purpose: “to help keep the premises safe for the residents and other persons lawfully on the premises.” They did not, however, set forth any facts which form the basis for these statements. (See Extel Corp. v. Cermetek Microelectronics, Inc. (1989), 183 Ill. App. 3d 688, 689, 539 N.E.2d 320 (affidavit based on affiant’s “understanding” of agreement insufficient to raise issue of material fact); Cohen v. Washington Manufacturing Co. (1979), 80 Ill. App. 3d 1, 398 N.E.2d 1202.) Neither affiant purported to have personal knowledge of the agreement by virtue of having been present when the agreement between the CHA and Triad was reached. (See Kukla Press, Inc. v. Family Media, Inc. (1985), 133 Ill. App. 3d 939, 479 N.E.2d 1116 (where affiant was not present at meeting when agreement was reached, he lacked personal knowledge of statements made at that meeting). See generally 4 R. Michael, Illinois Practice §39.2 (1989).) Although the guards stated that they had personal knowledge that “there were to be guards stationed at Cabrini Green performing the aforesaid duties 24 hours a day,” the affidavits do not indicate that the agreement between the CHA and Triad was the source of this knowledge. Nor, in fact, do the affidavits indicate that guards were to be stationed at the building at 1158 N. Cleveland at the time when plaintiff was shot.
Thus, the only competent evidence before the court as to the extent of defendants’ agreement for security at Cabrini Green was the affidavits of Moore and Kotz. According to those affidavits, CHA’s undertaking was limited to hiring Triad for the protection of CHA property. The affidavits submitted by plaintiff were insufficient to raise a genuine issue of material fact as to the scope of the agreement *932between the CHA and Triad. Since under the voluntary undertaking exception any duty is limited to the scope of the undertaking, the CHA was under no duty to protect the plaintiff from criminal assaults by third parties.
Moreover, even were we to conclude that the CHA undertook to protect the plaintiff from criminal attacks and thus owed him a duty, the CHA would be immune from any liability by virtue of the Local Government and Governmental Employees Tort Immunity Act. (Ill. Rev. Stat. 1985, ch. 85, par. 4—102.) That act provides:
“Neither a local public entity nor a public employee is liable for failure to establish a police department or otherwise provide police protection service or, if police protection service is provided, for failure to provide adequate police protection service, failure to prevent the commission of crimes, and failure to apprehend criminals.” Ill. Rev. Stat. 1985, ch. 85, par. 4—102.
Plaintiff, however, urges that the trial court could not consider the statute since it constitutes an affirmative defense which was stricken by agreement of the parties and not repleaded by the CHA. We disagree. An affirmative defense may be raised in a motion for summary judgment even though not raised in an answer. (Florsheim v. Travelers Indemnity Co. (1979), 75 Ill. App. 3d 298, 393 N.E.2d 1223.) The statute was included in the CHA’s motion for summary judgment, and the plaintiff’s only response was that the statute did not become effective until after the incident at issue. In fact, however, the statute was effective at the time of plaintiff’s shooting. It was an amendment providing that the public entity’s immunity is not waived by the hiring of a private security service which became effective several months after the shooting. Although there is a dearth of cases construing whether this amended provision is a clarification of the preexisting provision, that interpretation would seem the most reasonable. Unlike the purchase of insurance, which will result in the waiver of immunity (Ill. Rev. Stat. 1987, ch. 85, par. 9—103), the retention of private security guards leaves the public entity exposed to the same financial risk in attempting to cope with the identical problem as would be present by its own provision of police protection. This construction is consistent with the approach taken by the appellate court in Pippin v. Chicago Housing Authority (1978), 58 Ill. App. 3d 1029, 374 N.E.2d 1055, aff'd (1979), 78 Ill. 2d 204, 399 N.E.2d 596, which held that the retention of a private security agency waived immunity only because insurance was provided, thereby invoking the provisions of section 9—103.
*933Moreover, in addition to raising the statute in its summary judgment motion, the CHA argued it before the trial court without objection by the plaintiff. As a result, we find that it is the plaintiff who has waived his argument.
Plaintiff further contends that an issue of fact exists as to his right to recover by virtue of a second exception to the general rule regarding a landlord’s liability for criminal assaults on his tenants by third parties, which may occur when a landlord is negligent in maintaining the property, and the condition of the premises facilitates the criminal acts. (Rowe, 125 Ill. 2d at 224, 531 N.E.2d 1358; Cross, 82 Ill. 2d 313, 412 N.E.2d 472; Petrauskas v. Wexenthaller Realty Management, Inc. (1989), 186 Ill. App. 3d 820, 542 N.E.2d 902; Duncavage v. Allen (1986), 147 Ill. App. 3d 88, 497 N.E.2d 433; Stribling v. Chicago Housing Authority (1975), 34 Ill. App. 3d 551, 340 N.E.2d 47.) “While a landlord is not an insurer and cannot be held liable for harm done by every criminal intruder (Trice v. Chicago Housing Authority (1973), 14 Ill. App. 3d 97, 100, 302 N.E.2d 207), prior incidents similar to the one complained of and which are connected with the physical condition of the premises may impose a duty of reasonable case [sic].” (Duncavage, 147 Ill. App. 3d at 97-98, citing Stribling, 34 Ill. App. 3d 551, 340 N.E.2d 47.) To be held liable, the landlord’s negligence must facilitate the criminal activities of the third party, and the criminal activities must be reasonably foreseeable. (Rowe, 125 Ill. 2d 203, 531 N.E.2d 1358.) Although the injury to plaintiff need not be identical to the prior criminal incidents in order for it to be considered foreseeable, plaintiff’s injury must have resulted from the same risk as was present in the prior incidents. Petrauskas, 186 Ill. App. 3d at 827.
Plaintiff contends that the CHA was aware of other shootings and assaults which had occurred in Cabrini Green. Lt. King testified that there were 10 shootings and three or four stabbings in the project in the two years prior to the incident here, and that the CHA was informed of those incidents. There is no indication, however, that any of those shootings had any connection with the physical condition of the building in which plaintiff was shot or that they were the result of a lack of lighting in the lobby. (See Petrauskas, 186 Ill. App. 3d at 827 (prior fatal shooting across the street held to be insufficient to establish connection with building where shooting at issue. occurred).) The only allegations of prior incidents connected with the building were the incidents plaintiff mentioned in his deposition. He stated that a friend had been shot in the building and that a female Jehovah’s Witness has been grabbed in a dark hallway.
*934Such vague allegations of prior criminal events against unnamed victims and at unspecified times do not raise an issue as to foreseeability. (Figueroa v. Evangelical Covenant Church (7th Cir. 1989), 879 F.2d 1427, 1439.) The allegations made here fall far short of those in Stribling (34 Ill. App. 3d 551, 340 N.E.2d 47) and Duncavage (147 Ill. App. 3d 88, 497 N.E.2d 433), where the courts found the criminal attacks to be foreseeable. In Stribling, plaintiffs apartment was burglarized by persons who broke through a wall between plaintiff’s apartment and a vacant apartment next to it. Plaintiff notified the landlord of the burglary, but the vacant apartment was not made secure. Two subsequent burglaries occurred in the same fashion as the first. In finding the landlord liable for the second and third burglaries, the court stated “after defendants had notice of the original burglary and the means used in effecting the burglary, the fact that another burglary could happen in the same fashion became eminently foreseeable.” (Stribling, 34 Ill. App. 3d at 556.) In Duncavage, plaintiff was murdered when an intruder came into a rear yard adjacent to her apartment and hid in high weeds in the darkness of an unlighted area. He then used a ladder, which the landlord stored in the yard adjacent to plaintiff’s apartment, to gain access through an unlockable window. Plaintiff alleged that the defendant knew of a previous illegal entry into the same apartment, concealed by the same unlighted yard and high weeds, and by means of the same ladder. Duncavage, 147 Ill. App. 3d at 96.
Plaintiff also directs our attention to the case of Smith v. Chicago Housing Authority (1976), 36 Ill. App. 3d 967, 344 N.E.2d 536, another case involving a shooting in the lobby of a CHA building, in arguing that the attack on plaintiff was foreseeable. The court there, however, found that plaintiff’s injury had no connection to the condition of the premises, and therefore that case cannot be said to represent a prior criminal incident which resulted from the same risk as did plaintiff’s injury here and as required by Petrauskas.
As to defendant Triad, we likewise find that the trial court was correct in granting its motion. Although the CHA’s motion was one for summary judgment and Triad’s was a motion to dismiss under section 2—619, the issue as to both defendants is the same, namely whether there exists a question of material fact. Ralston v. Casanova (1984), 129 Ill. App. 3d 1050, 473 N.E.2d 444 (section 2—619 motion is essentially a summary judgment procedure and issue is whether there is a question of material fact).
One who agrees to perform services for another assumes a duty of reasonable care in the performance of those services. (B.C. v. J.C. *935Penney Co. (1990), 205 Ill. App. 3d 5, 13, 562 N.E.2d 533, citing Restatement (Second) of Torts §324A (1965).) The duty owed is limited by the extent of the undertaking and the agreement of the parties. (B.C., 205 Ill. App. 3d 5, 562 N.E.2d 533; Cross, 82 Ill. 2d at 318; Pippin, 78 Ill. 2d 204, 399 N.E.2d 596.) “[A]n action sounding in tort[ ] will lie where a security agency contractually agrees to protect persons lawfully on the premises of a housing authority and the agency fails to exercise reasonable care in its obligation. (78 Ill. 2d 204, 212.) The duty owed to the plaintiff is measured by the terms of the contractual obligation.” Cross, 82 Ill. 2d at 320 (Clark, J., specially concurring), discussing Pippin.
As discussed above in regard to the scope of the CHA’s undertaking, the only competent evidence regarding the agreement between the CHA and Triad was the affidavits presented by the defendants. Those affidavits establish that under the agreement, Triad’s only duty was to protect CHA property and then only at such times and places as requested by the CHA. (Compare Pippin, 78 Ill. 2d 204, 399 N.E.2d 596 (security agency which contracted with CHA to provide protection for persons on CHA property assumed duty of reasonable care in performing its contractual obligation).) There is no question that there were no Triad guards assigned to Cabrini Green at the time of the plaintiff’s shooting, and plaintiff has presented no evidence that Triad had any duty to provide guards at that time. (See Cross, 82 Ill. 2d 313, 412 N.E.2d 472 (security agency which contracted to provide services from 9 a.m. to 1 a.m. not liable for injury which occurred at 1:15 a.m.).) As a result, Triad could not be liable for any injuries suffered by the plaintiff.
Accordingly, for all the above reasons, the judgment of the circuit court of Cook County is affirmed.
Affirmed.
McNULTY, P.J., and MURRAY, J., concur.