
29 Cal.Rptr.3d 127 (2005)
129 Cal.App.4th 1107
Jane ROE, Plaintiff and Appellant,
v.
McDONALD'S CORPORATION et al., Defendants and Respondents.
Nos. G032638, G032661.
Court of Appeal, Fourth District, Division Three.
May 27, 2005.
*128 Hollins  Schechter, Kathleen M.K. Carter, Santa Ana, Jill A. Thomas and Jeffrey R. Gillette, for Plaintiff and Appellant.
Kinkle, Rodiger & Spriggs, David P. Lenhardt and Derian Eidson, Santa Ana, for Defendants and Respondents Man-Cal., Inc., South Coast Plaza and McDonald's Corporation.
Nielsen, Haley & Abbott, Mary N. Abbott, Los Angeles, and James C. Nielsen, San Francisco, for Defendant and Respondent Lincoln Security Services, Inc.

OPINION
BEDSWORTH, J.
Jane Roe sued McDonald's Corporation, South Coast Plaza, Man-Cal, Inc., and Lincoln Security Services, Inc., after she was allegedly sexually assaulted in the restroom of the McDonald's restaurant located in South Coast Plaza. Shortly before the assault, Roe had seen her alleged assailant just outside the restaurant, staring at her and making sexually suggestive facial expressions. However, the man was gone by the time she reported his conduct to both a security guard standing behind her in line and to the McDonald's cashier who took her order. Roe alleged defendants were negligent in the design of the restaurant, which placed the restroom in a remote location readily accessible to the outside, and because they failed to take steps to apprehend the man (and otherwise protect her against the assault) after she had reported his strange behavior.
The trial court granted summary judgments in favor of all defendants, concluding Roe had failed to raise a triable issue of fact concerning either her assertion defendants had acted negligently, or her assertion that their alleged negligence had been a cause of her assault. We conclude the trial court was correct.
In support of her contention the restaurant's purported negligent design was a cause of her injuries, Roe offered only the *129 speculative and conclusory assertions of a "security" expert, to the effect that the premises could have been designed and maintained in a manner that would have made them safer. The trial court sustained defendants' objections to that declaration. On appeal, Roe waived any contention that the court erred in doing so. Without that evidence, Roe herself concedes causation cannot be established.
Roe's only other contention is that defendants were on notice of the fact she was in danger, because she had informed both the security guard in line behind her at the McDonald's and the McDonald's cashier who waited on her, that a "strange man" standing just outside the restaurant had been staring at her and making sexually suggestive facial expressions. Although the man was committing no crimes, and had apparently departed by the time of her report, Roe nonetheless maintains defendants should have understood the man was a threat to her, and were obligated to take specific measures to ensure he did not subsequently assault her. We cannot agree. Nobody but Roe saw the man, and defendants were not required to adopt her subjective conclusions about his intentions The objective facts she related amounted to "a very creepy guy was just outside looking at me; he's gone now." In our view, such a report did not put defendants on notice of danger to their patrons. The judgments are affirmed.

* * *
According to Roe,[1] on August 22, 2002, she was shopping at South Coast Plaza with her 11-year-old son, and a female friend. Roe and her son shopped separately from her friend for a short while, but agreed to meet in front of the McDonald's restaurant in the mall at 2:00 p.m. When Roe and her son arrived in front of the McDonald's, her friend was not yet there, so they sat on a bench to wait.
While sitting on the bench, Roe noticed a man standing in front of the McDonald's. She described him as being in his 20's or early 30's, and wearing a wig. He was staring at her, licking his lips in what she characterized as a sexual manner, wiggling his eyebrows and "taking his eyeglasses on and off in a suggestive manner."
By the time Roe's friend arrived, the man was gone. After Roe got in line at the McDonald's, she spotted the man again. He was standing near the entrance to the McDonald's, and again he was licking his lips and staring at her. Roe turned to the man standing in line behind her, who was wearing a South Coast Plaza security uniform. After the man confirmed he was a mall security officer, she reported the conduct of the suspiciously acting man. She told the officer what he had been doing and characterized him as looking like a "sex maniac." The security guard responded by saying "okay, okay." Although Roe pointed in the strange man's direction after describing his conduct, the man had apparently once again departed. The security guard never saw him.
Roe remained in the McDonald's line and ordered food. When she placed her order, she also informed the cashier of her experience with the strange man. There is no evidence the cashier saw the man either.
*130 Having reported the strange man's conduct to two different people, Roe assumed that "appropriate action" would be taken. She and her son and friend went to a table and sat down. A few minutes later, Roe got up and went to the restroom. As soon as she entered the stall in the bathroom, the man who had been watching her outside pushed his way in. He threatened and sexually assaulted Roe. There was no evidence of any prior similar crimes, either at that McDonald's specifically, or in the South Coast Plaza mall.
Roe filed this lawsuit, alleging that South Coast Plaza, Man-Cal, Inc. (the McDonald's franchisee) and McDonald's had negligently designed and maintained the premises, creating an unreasonable risk of injury to patrons, and that all defendants, including Lincoln Security, had failed to reasonably respond to her reports of the suspicious man prior to her assault.
Each of the defendants moved for summary judgment, arguing: (1) Roe had failed to demonstrate that any of them had acted negligently, either in the design or maintenance of the premises[2] or in their response to her reports about the suspicious man; and (2) she could not demonstrate a causal link between any of their alleged acts or omissions and her injuries.
Roe opposed the motions, relying largely on the declaration of a "private security" expert, Donald Reierson. Based upon his review of documents and evidence in the case, Reierson offered some surprisingly far-ranging opinions, including some that bore no relationship to his claimed expertise. For example, he opined that McDonald's, the franchisor of the restaurant, actually maintained "complete control over the design, layout and construction of its franchisee's restaurants," and that its franchisees "follow strict guidelines in the day-to-day operations of their businesses."
With respect to the premises liability claim, Reierson also opined that the McDonald's restaurant at South Coast Plaza was "negligently designed" and could have been "easily" designed in such a way as to provide better security for patrons. He did not explain how that might have been done, nor did he make any effort to compare the design of this restaurant to others in the industry. He complained that the restrooms where Roe was assaulted were "isolated" from the restaurant, and too close to an outside door. Again, he failed to explain what standards, if any, he was applying to reach those conclusions. Reierson also suggested that the restaurant could have improved its restroom security with closed-circuit cameras and better training of service personnel. But again, he failed to identify any standards for usage of security cameras, and failed to specify any inadequacy in the prior training of service personnel. Reierson then offered his conclusion the assault on Roe "probably would not have occurred" if the remedial measures he suggested had been implemented prior to that time.
Reierson also concluded that the response of both the security guard and the cashier to Roe's report of the strange man was "wholly inadequate." He stated that in response to such a report, "immediate action was required. Security or police should have been summoned. While a proper investigation would have required standing by plaintiff, and if necessary, physically removing the individual from the premises ... even a more limited investigation ... would have substantially reduced, if not eliminated the risk of *131 any later confrontation...." Again, however, Reierson failed to include any basis for his opinion, such as standards and practices in the law enforcement, security or restaurant industry.
Each of the defendants objected to Reierson's declaration, arguing it lacked foundation and was rife with speculative and conjecture. The trial court sustained the objections, ruling Reierson's opinions as to causation were "insufficient" and "conjecture and speculation and not supported by a factual basis."
The court then granted summary judgments in favor of each defendant. Roe filed two separate appeals from those judgments,[3] which we have consolidated.

I
On appeal, Roe continues to rely on the declaration of her "security expert," Donald Reierson, to demonstrate triable issues of fact concerning the issues of negligence and causation. However, as noted above, the trial court sustained respondents' objections to the declaration, concluding it was speculative and based upon conjecture. Although Roe asserts the court ruled "erroneously" on that issue, and acknowledges the effect of that ruling was to "remove[ ] appellant's causation evidence," she also seems to believe that ruling is irrelevant on appeal, because "this Court will review all of this evidence de novo."
However, as explained by our Supreme Court in Johnson v. City of Loma Linda (2000) 24 Cal.4th 61, 65-66, 99 Cal.Rptr.2d 316, 5 P.3d 874, "[w]e review the trial court's decision de novo, considering all the evidence set forth in the moving and opposition papers except that to which objections were made and sustained." (Italics added.) "`Where a plaintiff does not challenge the superior court's ruling sustaining a moving defendant's objections to evidence offered in opposition to the summary judgment motion, `any issues concerning the correctness of the trial court's evidentiary rulings have been waived. [Citations.] We therefore consider all such evidence to have been "properly excluded." [Citation.]' (Lopez v. Baca (2002) 98 Cal.App.4th 1008, 1014-1015 [120 Cal.Rptr.2d 281].)" (Alexander v. Codemasters Group Limited (2002) 104 Cal.App.4th 129, 140, 127 Cal. Rptr.2d 145, fn. omitted.)
The reason for this rule is that "[t]rial courts have a duty to rule on evidentiary objections." (City of Long Beach v. Farmers & Merchants Bank (2000) 81 Cal. App.4th 780, 784, 97 Cal.Rptr.2d 140.) "[R]uling on such evidentiary objections can involve a number of considerations more suited to the trial court than the appellate courts, including an exercise of discretion in establishing the record to be reviewed de novo." (Sambrano v. City of San Diego (2001) 94 Cal.App.4th 225, 236, 114 Cal.Rptr.2d 151.)
Consequently, it was Roe's burden on appeal to affirmatively challenge the trial court's evidentiary ruling, and demonstrate the court's error. She failed to do so. Her brief on appeal fails to identify the court's evidentiary ruling as a distinct assignment of error, and there is no separate argument heading or analysis of the issue. That alone is grounds to deem the argument waived. (Golden Day Schools, Inc. v. Department of Education (1999) 69 Cal.App.4th 681, 695, fn. 9, 81 Cal.Rptr.2d 758 ["because [plaintiff's] argument is not preceded by an appropriate heading, it is *132 deemed waived"]; see also Lester v. Lennane (2000) 84 Cal.App.4th 536, 586, 101 Cal.Rptr.2d 86 fn. 28 ["Lennane does not mention the judge's alleged bias against wealth in any argument heading in his briefs. Therefore, to the extent he purports to make a separate argument that the judge displayed such a bias, the point is waived."].)
Moreover, "[a]n issue merely raised by a party without any argument or authority is deemed to be without foundation and requires no discussion. (People v. Dougherty (1982) 138 Cal.App.3d 278, 282 [188 Cal.Rptr. 123].)" (Golden Day Schools, Inc. v. Department of Education, supra, 69 Cal.App.4th 681, 695, fn. 9, 81 Cal.Rptr.2d 758.)
Instead of affirmatively tackling the court's evidentiary rulings, Roe simply weaves the content of Reierson's declaration throughout her brief, as if no objections had been sustained below. In fact, we found only two sentences in the brief where Roe even acknowledges any criticism about the sufficiency of the declaration. First, in the midst of the argument titled "Appellant was not required to prove causation with absolute certainty," she includes a single sentence followed by a citation: "That appellant's security expert, Mr. Riererson's [sic] testimony was comprised partly of opinion does not render it speculative. (Juchert v. California Water Service Company (1940) 16 Cal.2d 500, 507, 106 P.2d 886.)" The case cited, Juchert, does not discuss the sufficiency of expert testimony.
Later, in an argument titled "Appellant Presented Sufficient Evidence to Show a Triable Issue of Fact Existed as to Whether or not McDonald's Corp. Maintained Control Over the McDonald's Restaurant," she asserts that Reierson's opinion that the restaurant's layout posed an unreasonable risk of danger to its patrons "was not speculative but was based upon proper foundation." She then reveals that foundation to be simply the string of conclusory statements from Reierson's declaration: "that (1) the restrooms were isolated from the rest of the establishment (which could have been easily have be [sic] remedied by appropriate consideration of the security of patrons at the time of design); (2) the proximity of the outside door to the restrooms prohibited control over restroom users (which could have been easily have be [sic] remedied by the security considerations predictable by any security professional); (3) no after design steps were taken to improve security (which could have easily have be [sic] remedied by CTV cameras with signs at entry, or an emergency call device); and (4) training of service personnel was inadequate (which could have been easily remedied by implementing training protocol for all restaurant personnel)."[4]
Roe offers no citations to any authority, and no analysis explaining why Reierson's list of conclusory assertions should have been considered a sufficient basis for his *133 ultimate conclusion that alterations to the design and maintenance of the premises "probably" would have made a difference in this case. Instead, Roe has merely parroted the declaration's content, and asserted that its conclusions should be considered by this court as support for her claims. That is insufficient effort to merit review of the trial court's order.
We therefore adopt the trial court's determination that Reierson's declaration is speculative, and based upon conjecture. That means we cannot consider it as support for her claims the allegedly inadequate design and maintenance of the premises where she was assaulted constituted a cause of that attack. Because Reierson's declaration constituted Roe's only evidence on that issue, the court properly adjudicated that claim against her.
Even if the declaration were considered, it is woefully inadequate to establish either that the design and maintenance of the premises was actually below any applicable standard of care, or that any changes which theoretically could have been made would have made a difference in this case.
With respect to the standard of care, Reierson's declaration does nothing more that state, in conclusory fashion, that the premises could have been configured in such a way as to provide greater security in the restroom area, and that cameras and better trained employees would also made things safer. He does not describe the premises in detail, nor does he discuss the level of training actually given to employees. He does not mention what the standards of practice are in the industry, nor compare these premises and employees to those of any other restaurant.
In essence, then, Reierson merely offers the opinion that the premises might have been made safer than they were. But that, of course is true of virtually every premises. Such an observation does not establish that the condition of the premises was below the standards that a customer should reasonably expect under the circumstances.
As to causation, the declaration states only that if the premises had been altered in the manner he suggests, "the assault probably would not have occurred." He does not, however, explain how any of those changes would have made a difference in this case. The problem, of course, is that no one knows how (or exactly when) Roe's assailant got into the restroom, where he might have been lurking prior to that time, or whether, for example, he even used the nearby outside entrance that concerned Reierson.
In Saelzler v. Advanced Group 400 (2001) 25 Cal.4th 763, 107 Cal.Rptr.2d 617, 23 P.3d 1143, the Supreme Court stated that where the identity of the assailant, as well as the specific circumstances of the assault, are unknown, causation cannot be established by merely offering an expert's opinion that additional security measures should have been taken. It is plaintiff's burden "to prove it was `more probable than not' that additional security precautions would have prevented the attack." (Id. at p. 776, 107 Cal.Rptr.2d 617, 23 P.3d 1143.) The Supreme Court recognized the obvious danger in allowing causation to be inferred from the very fact that additional security measures might (or even should) have been taken: "[Such a rule] seemingly would prevent summary judgment on the causation issue in every case in which the defendant failed to adopt increased security measures of some kind. Nola M. observes that `it would be grossly unfair to permit a lay jury, after the fact, to determine in any case that security measures were "inadequate," particularly in light of the fact that the decision would always be *134 rendered in a case where the security had, in fact, proved inadequate....' (Nola M. [v. University of Southern California (1993)] 16 Cal.App.4th [421,] 429 [20 Cal. Rptr.2d 97].) Similarly, in Sharon P. [v. Arman, Ltd. (1999)] 21 Cal.4th [1181,] 1194 [91 Cal.Rptr.2d 35, 989 P.2d 121], we quoted with approval a legal commentator's observation that if we simply relied on hindsight, the mere fact that a crime has occurred could always support the conclusion that the premises were inherently dangerous." (Saelzler v. Advanced Group 400, supra, 25 Cal.4th at p. 778, 107 Cal. Rptr.2d 617, 23 P.3d 1143.)
Thus, the court concluded: "Where, as here, there is evidence that the assault could have occurred even in the absence of the landlord's negligence, proof of causation cannot be based on mere speculation, conjecture and inferences drawn from other inferences to reach a conclusion unsupported by any real evidence, or on an expert's opinion based on inferences, speculation and conjecture." (Saelzler v. Advanced Group 400, supra, 25 Cal.4th at p. 775, 107 Cal.Rptr.2d 617, 23 P.3d 1143; see also Thompson v. Sacramento City Unified School Dist. (2003) 107 Cal. App.4th 1352, 1373, 132 Cal.Rptr.2d 748, ["while expert criticism of the defendant's security measures may establish abstract negligence, an expert's speculative and conjectural conclusion that different measures might have prevented an injury cannot be relied upon to establish causation"].)
Roe attempts to distinguish those "abstract negligence" cases by arguing "this case involves specific notice of a particular individual, not generalized reliance on prior occurrences indicative of a dangerous condition, with liability arising from Respondents' lack of a response to an identified threat." But the distinction makes no sense in the context of the premises liability claim. Respondents could not be expected to alter the design or maintenance of their premises in the few minutes between when Roe saw the strange man and when he assaulted her.

II
Roe's second basis for liability fares no better. She argues, in essence, that because she specifically notified defendants about the strange man making sexually suggestive faces at her, they had a duty to take special action to protect her against the alleged danger he represented, even in the absence of prior criminal conduct on the premises.[5] She cites Trujillo v. G.A. Enterprises, Inc. (1995) 36 Cal. App.4th 1105, 43 Cal.Rptr.2d 36, and Rosh v. Cave Imaging Systems, Inc. (1994) 26 Cal.App.4th 1225, 32 Cal.Rptr.2d 136, in support of her contention. Both cases, however, are distinguishable.
In Trujillo, a group of teenagers followed the plaintiff into a McDonald's. A security guard entered right after them. The teenagers confronted Trujillo, one of the boys accusing him of "jumping" his cousin. Trujillo denied it, and a girl in the group attempted to strike him. The security guard then grabbed the girl and took her outside, leaving Trujillo inside with the rest of the angry group. They proceeded to beat him before the security guard returned. Although the trial court granted summary judgment in favor of defendants, the Court of Appeal reversed, finding a triable issue of fact as to whether the security guard had acted reasonably to *135 extricate Trujillo from a "threatening situation." (Trujillo v. G.A. Enterprises, Inc., supra, 36 Cal.App.4th at p. 1109, 43 Cal. Rptr.2d 36.)
In this case, by contrast, no attack was launched on Roe in the security guard's presence. Nor did defendants have any reason to believe that Roe had become, as she now claims, the subject of a "known threat" by a "known potential sexual predator ... on the loose in the ... mall." Nobody other than Roe even saw the alleged assailant. Thus, defendants' only notice of the "threatening behavior" was through Roe's own description, i.e., a man wearing a wig had been staring at her while wiggling his eyebrows and licking his lips, but had then departed.
Whatever Roe herself may have intuitively felt about the man's appearance and intentions, or been convinced of in the cold clear light of hindsight, are not objective facts. Neither the Lincoln Security guard nor the McDonald's cashier could be expected to adopt Roe's fearful conclusions about a man they had not even seen. Viewed objectively, the fact he wore a wig suggests nothing sinister. Some people, including men, wear them for reasons unrelated to criminal conduct. And the man's behavior, while possibly intended to be disturbing, might also seem merely juvenile, depending upon other circumstances.
The circumstances described by Roe, viewed objectively, did not obligate either Lincoln Security, or McDonald's, to conclude that the man described by Roe constituted a particular threat to her or any-one else. He had committed no crimes, made no threats, and (most importantly) had apparently departed.
In Rosh, the other case relied upon by Roe, the defendant was the security company regularly employed to patrol and secure the premises of plaintiff's employer. Its employees were instructed generally on the danger posed by terminated employees, and had been warned several times not to allow a particular former employee to enter the premises. Despite the guards' repeated assurance that they would "take care of it," the former employee was allowed to enter several times. After his third or fourth unauthorized entry, he shot the plaintiff on the premises. According to Roe, Rosh is "on point" because in both that case and this, the security company had been informed of a specific threat and "ignored the danger."
But again, the "danger" in this case was a subjective conclusion drawn by Roe about a man no one else saw, and who was apparently no longer present. While Roe suggests such a report obligated defendants to do something, either to apprehend the man or to secure Roe's own safety, we disagree.[6] In the absence of a more definite threat, or some other criminal activity, Defendants could not be expected to undertake significant efforts such as conducting a search for the suspicious man, providing a personal security escort for Roe, or beginning an immediate process of securing all the women's restrooms or other potentially secluded areas.
As our Supreme Court explained in Ann M. v. Pacific Plaza Shopping Center *136 (1993) 6 Cal.4th 666, 679, 25 Cal.Rptr.2d 137, 863 P.2d 207, the duty to take particular security measures is determined by "a balancing of `foreseeability' of the criminal acts against the `burdensomeness, vagueness, and efficacy' of the proposed security measures. [Citation.]" Here, there was little, if any objective evidence that foretold the assault on Roe. There is a huge leap between making eyes at a woman (even creepy "sex maniac" eyes) and physically assaulting her in a restroom. In fact, Roe offered no evidence at all of any correlation between those two behaviors. On the other hand, it would be a significant burden for defendants to undertake any of the security efforts mentioned above, and we cannot conclude they should be expected to do so each time one mall patron acted inappropriately from afar toward another  especially if the offending patron then apparently departed the scene.
At most, in the wake of Roe's report, defendants might have been expected to keep an eye out for the strange man, and in the event he appeared, to observe him for further suspicious behavior. But because there is no evidence that any of defendants' representatives had an opportunity to do so in the short time period before Roe encountered the man in the restroom, any failure of defendants to conduct such observation could not be considered a cause of her assault.
The judgment is affirmed. Respondents are to recover their costs on appeal.
WE CONCUR: RYLAARSDAM, Acting P.J., and MOORE, J.
NOTES
[1]  This case was decided on a summary judgment motion, so respondents cannot prevail by challenging the veracity of Roe's story. At this point, a dispute of fact can only help her, not them. Consequently, respondents' repeated suggestions that Roe may have fabricated the entire incident are not pertinent. A summary judgment simply cannot be defended with a credibility argument. For purposes of analyzing whether Roe's claims should have been allowed to go to trial, we must presume Roe is telling the truth.
[2]  McDonald's contended that as a franchisor, it neither owned nor operated the restaurant where Roe's alleged attack took place.
[3]  Roe filed one notice of appeal from the judgments entered in favor of McDonald's Man-Cal and South Coast Plaza on May 30, 2003, and a separate notice of appeal from the judgment subsequently entered in favor of Lincoln Security on June 5, 2003.
[4]  How would Reierson, as an expert in security, know that the placement of the restrooms could have been "easily" remedied when the restaurant was designed? How exactly could a security professional have "easily" remedied the purported problem with the proximity to the outside door? Again, this appears to be a design issue, and there was no evidence to support the conclusion that an "easy" fix was available. How would the installation of "CTV" cameras at the entrance of the restroom have prevented an attack? Is the assumption that a security guard would be watching the monitor at all times? Why not just post someone at the door of every restroom? How would improved training of employees have stopped an attack that happened within minutes of Roe reporting the recent presence of a strange man?
[5]  This theory of liability was also supported in part by Reierson's declaration, and the court likewise sustained Lincoln's objection to it. However, the facts bearing upon whether defendants had any duty to act in response to Roe's report are found elsewhere in the record, so we consider the contention separately.
[6]  On this point, Roe had also obtained an opinion from Reierson, to the effect that defendants were required to take "immediate" action in response to Roe's report of the strange man. He stated that police "should have been summoned" and that a proper investigation "would have required standing by plaintiff." But even if the trial court had not already sustained Lincoln's objection, we note that as with Reierson's other opinions, he provided no foundation for those conclusions. He does not, for example, offer any hints as to the standards employed in the security industry to determine what level of response is appropriate in a given set of circumstances.
