One of the things I look at when doing tech DD on companies is whether or not there is exfiltration detection in place. The typical answer is 'what?'. Rarely does the counterparty know what it even is and even more rare that they have it set up.