What Exam Controllers Are Getting Wrong About Online Exam Security in the AI Era

Last year I sat in on a review meeting at a mid-sized university. A candidate had scored in the top two percent on an online entrance test, then struggled to answer basic questions in the follow-up interview. Nobody could prove anything. The webcam recording showed someone at a desk, looking at a screen, for ninety minutes. That was all the evidence they had.

Stories like this come up a lot now. Online exams aren't going away. They're cheaper, faster, and fairer to candidates who live far from a test centre. But many institutions are still running them with controls designed for a world where the biggest risk was a sheet of notes taped under the desk.

Here are six gaps I see most often, and what the institutions handling this well are doing differently.

1. Treating identity as a one-time check

Most online exams verify identity once, at the start. The candidate holds an ID up to the camera, someone (or something) confirms the match, and the exam begins.

The problem is that a lot can change after that first check. Swapping seats with someone else partway through isn't hard if no one checks again. Institutions that take this seriously run presence checks throughout the session, not just at login, and they tie the face on camera back to the registration record, not just to whatever ID card was shown that day.

2. Planning for yesterday's cheating methods

Ask an exam team what cheating looks like and you'll often hear "phones" and "notes." Both still matter. But the list has grown. Candidates now have access to AI chat assistants in a second tab, browser extensions that read questions and suggest answers, overlay apps that sit invisibly on top of the exam window, virtual machines, and remote-access tools that let someone else take over the screen.

You don't need to become a security expert to deal with this. You do need to ask your proctoring provider, in writing, which of these they can detect, on which operating systems, and under what browser conditions. A vague answer is useful information in itself.

3. Assuming an AI flag means someone cheated

This one worries me the most, because it hurts honest students.

Automated monitoring is good at noticing things. A candidate looks away. A second voice is picked up. The browser loses focus for three seconds. But noticing isn't the same as deciding. People glance at a door that slams. Siblings walk into rooms. Home Wi-Fi drops. If every flag is treated as misconduct, you end up penalising candidates for having ordinary lives, and your appeals inbox fills up fast.

The stronger model is human-in-the-loop review. Software flags the incident, a trained reviewer looks at the clip and the context, and the institution makes the final call. It's slower than auto-disqualifying people, but it's the only approach that holds up when a student's family hires a lawyer.

4. Keeping evidence that can't answer an appeal

When a result gets challenged, someone has to explain what happened. "The system flagged it" isn't an explanation.

What you want is a per-candidate integrity record: timestamps, the specific snapshots or clips tied to each flag, what the reviewer concluded, and why. That record protects the candidate as much as the institution. If the decision was fair, the evidence shows it. If it wasn't, you'll find out before it escalates.

5. Scaling invigilation by adding more people

During peak admissions or semester exams, the instinct is to hire more invigilators. One person can realistically watch a handful of live webcam feeds with any attention. At a few thousand candidates, that model breaks, and the quality of monitoring drops exactly when the stakes are highest.

This is where software earns its place. Combining AI proctoring and identity verification lets the system watch every session at once and send only the sessions that need attention to human reviewers. A small, well-trained team can then focus on a manageable queue instead of staring at a wall of video.

6. Leaving privacy and accessibility until the end

Remote proctoring collects sensitive data: faces, ID documents, room footage, sometimes screen recordings. Institutions that rush deployment often find out later that they haven't settled retention periods, access controls, or consent wording, especially when candidates sit exams from several countries with different privacy laws.

Accessibility gets skipped in the same way. Candidates with disabilities, older devices, or unreliable internet need a clear alternative route that doesn't treat them as suspicious by default. Building that in before launch is far easier than patching it after a complaint.

A quick pre-exam checklist

If you're running an online exam cycle in the next few months, these questions are a good place to start:

• Is identity checked during the exam as well as at the start?
• Do we know, specifically, which AI-era threats our setup can and can't detect?
• Does a trained person review every flag before any action is taken?
• Can we produce a clear evidence record for any candidate within a day?
• Can our process handle peak volume without the quality of monitoring dropping?
• Have we signed off on data retention, consent, and accessibility arrangements?

If more than two of those get a "not sure," it's worth fixing before the next exam window rather than after the next dispute.

The bigger picture

Online assessment was always going to need a trust layer. Generative AI just brought that need forward by a few years. The institutions handling it well aren't the ones with the most aggressive monitoring. They're the ones that can show, for any candidate, who sat the exam, what happened during it, who reviewed it, and why the decision was made.

That's what students, parents, accreditation bodies and employers increasingly expect. And it's achievable without turning exams into surveillance exercises.

AI Proctoring and Identity Verification: Secure Exams AI Proctoring and Identity Verification help secure online exams with identity checks, AI monitoring, and human review…