If you have lots of location data say in Houston, and then suddenly in a refinery that's not in their normal day-to-day location data you could assume it's a contractor being called into investigate an on-site problem. or if you detect increased activity from devices that don't have a history on-site. Not 100%, but then they're not going for 100% either.