The part where the employee has self-selected themselves as a risk. Lots of the major companies have capability to identify when an employee is downloading tons of data and files, but for the less sophisticated ones, you pretty much just have to look out for motive, and an employee giving notice is probably disgruntled...which is at least a little bit of motive.