Is he on the corporate network on his work vpn? If so, this is recorded. You have to go via corporate proxies and use corporate dns. That’s easily trackable. I

Is he on the corporate network on his work vpn? If so, this is recorded. You have to go via corporate proxies and use corporate dns. That’s easily trackable. If he’s installed something like mullvad on his work laptop and he’s able to tunnel out from the corporate network, he’s probably safe from the content but has broken policy on unauthorized software, the intent of which can be malicious. They won’t care in general. But if they want to get rid of him they’ll have the info ready.