A few years ago, the concern about AI in online assessments was theoretical. Today it is not. GPT-powered browser plugins can prefill answers to multiple choice exam questions the moment they appear on screen, regardless of the topic or difficulty level. The learner does not need to read the question. They do not need to understand it. The answer is already there.

Integrity Advocate has been tracking this development closely. The response is ExposeAI, a new detection capability built directly into Integrity Advocate's monitoring suite.

How GPT-Powered LMS Plugins Work

Learning Management System plugins powered by generative AI have proliferated rapidly. Among the tools currently in use are Github Copilot, AnswersAI, ConchAI, Jasper, ChatSonic, Coursology, Hyperwrite, Quillbot, and Monica, among dozens of others that continue to emerge.

These tools share several characteristics that make them particularly difficult to address through standard LMS countermeasures:

• They are inexpensive or free to obtain
• They require no technical expertise to install or activate
• Once installed, they operate automatically and continuously
• They are designed to conceal their presence and adapt to detection attempts
• New variants emerge faster than most platforms can respond

As a result, organizations relying on their LMS provider to develop effective countermeasures are unlikely to find one. LMS companies have no current solutions to this threat, and the nature of these plugins makes them unlikely to be eradicated through platform-level defenses alone.

The integrity of online assessments and certifications depends on a different approach.

Why This Matters for Assessment Integrity

The implications extend beyond academic dishonesty. For organizations issuing certifications that carry regulatory or legal weight, an assessment completed with AI assistance is not a valid measure of knowledge or competency. The certification it produces is as hollow as one issued without any training at all.

The same worker who received a fraudulent safety certification from a provider that did not deliver training could receive an equally fraudulent certification from an organization that delivered the training but could not prevent AI tools from completing the assessment on the learner's behalf. The outcome is the same: a credential that does not reflect what the person actually knows.

Introducing ExposeAI

ExposeAI is Integrity Advocate's purpose-built response to AI-assisted assessment fraud. It can be incorporated into Integrity Advocate's existing monitoring suite without any technical effort from clients, and works across the full range of devices and browsers that Integrity Advocate supports, from mobile to desktop.

ExposeAI is designed to detect the presence and use of GPT-powered plugins during an assessment session, giving organizations the visibility they need to maintain the integrity of their certification and training programs in an environment where AI tools are becoming standard equipment for learners looking to shortcut the process.

This is part of Integrity Advocate's broader commitment to staying ahead of the threats that matter most to the programs it serves. Human review remains at the core of every session. ExposeAI adds a layer of detection specifically designed for the AI-assisted cheating methods that automated systems alone cannot reliably identify.

The Broader Picture

AI cheating tools are not a passing trend. They are becoming cheaper, more capable, and more widely available. Organizations that do not have a response to this threat are issuing certifications they cannot stand behind.

Integrity Advocate's approach combines human review with purpose-built AI detection, so the results your program issues reflect what learners actually know, not what an algorithm answered for them.

{{post-cta}}

Compliance means different things, but the pressure feels the same

Workplace compliance, like most everything in life, isn’t one-size-fits-all.

• In workplace safety, it’s proving every frontline worker completed the required training before setting foot on site.
• In healthcare, it’s confirming that clinical staff are credentialed, re-certified and fully documented.
• In corporate settings, it’s ensuring onboarding, DEI, or cybersecurity training happens on time.
• And in certifying bodies or professional associations, it’s about safeguarding the value of credentials issued under your name.

Different industries, different standards, but one shared reality: compliance is high-stakes, high-pressure and increasingly complex. 

The systems meant to help people in your position—sometimes your LMS, your proctoring tools, or your verification workflows—often make it harder, like having to write the same message to a support team, again. 

When your tools can’t keep up, compliance becomes a bottleneck. 

• Training deadlines get missed.
• Credentialing gaps go unnoticed.
• Audits get harder to pass.
• Support tickets pile up, wasting time your team doesn’t have.

The worst part? Everyone’s still doing the work—just with more stress, more confusion and less confidence in the system.

For teams already stretched thin, this isn’t sustainable. That’s why operational efficiency should be a compliance requirement all its own.

Why complexity keeps creeping in

Most compliance leaders aren’t struggling because they’re unprepared. They’re struggling because the systems supporting them weren’t designed with real-world complexity in mind.

Some platforms require installs that don’t play nicely with zero-trust environments. Others force mobile learners into desktop workflows. Many still bolt privacy on as an afterthought—resulting in data storage liabilities and confused users who just want to take their training and move on.

If staying compliant in an industry means hours of manual oversight, chasing participation records across tools and playing IT middleman every time someone can’t log in…that’s a system built for burnout—literally. 59% of compliance officers report feeling burned out, with 51% experiencing high levels of job stress. These roles sit at the intersection of risk, regulation and responsibility, with limited resources and even less room for error.

Whether you're managing safety recertifications across hundreds of sites, preparing for an audit or overseeing mandated training across departments, compliance matters.

Yet all too often, the people responsible for keeping things compliant are left stitching together workarounds, handling preventable support requests and double-checking tools that were supposed to make life easier.

A day in the life of a Compliance Program Manager

Your team just launched a last-minute rollout of mandatory safety training across three regions, with an end-of-week deadline.

In most organizations, that scenario means:

• Dozens of workers struggling to access the platform on shared or outdated devices
• IT pulled into install issues, permissions gaps or browser quirks
• Participation records scattered across learning systems, inboxes and spreadsheets
• Monday spent fielding emails from operations leads who just want to know who's cleared and who hasn’t

The most frustrating part is that your team executed everything correctly. Delays often stem not from planning errors but from system inefficiencies.

This is the hidden cost of convoluted compliance infrastructure: The more energy expended on troubleshooting, the less available for strategy.

For everyone, the stakes are high. According to IBM’s 2024 Cost of a Data Breach Report, the global average cost of a data breach reached $4.9 million, the highest on record and a 10% increase over last year. In fact, breaches involving data stored across multiple environments (like hybrid systems or cloud-based tools) cost even more, underscoring how fragmented platforms can turn compliance gaps into financial liabilities.

Whether you're coordinating OSHA-required safety training, prepping for a site audit, or managing re-certification in a BYOD environment, compliance is a responsibility that can ripple through your entire operation. That’s when things fall through the cracks.

What’s at stake—and how to stay ahead

When compliance systems fall short, the consequences add up fast:

• Escalating Penalties: In 2023, OSHA issued over 250 citations with initial penalties exceeding $100,000, driven by more violations categorized as “willful or repeated,” which carry fines up to $161,323 per violation.
• Audit Failures Due to Poor Documentation: Poor documentation and incomplete audit records are a leading cause of failed audits, with missing or disorganized evidence often undermining credibility and slowing down compliance reviews.
• Erosion of Stakeholder Trust: A single missed requirement in a safety-critical environment can undermine confidence among stakeholders, including employees, regulators and the public.

If you want to keep your team ahead of the curve, use this checklist to quickly gut-check your current infrastructure:

• Can users access the platform with installing apps or plug-ins?
• Are identity and participation clearly verified, with audit-ready records?
• Does the system support mobile use and data minimization by design?
• Will your team need to step in when users need support?
• Can you pull a clear report the moment leadership or regulators ask?

If any of these answers are unclear, it’s a compliance risk.

Let’s make our Compliance Training Manager’s day better

Same rollout. Same deadline. But this time, the system does its job—so you can do yours.

• The training link works the first time, on every device. No installations, no permissions errors, no browser gymnastics.
• Identity is verified in seconds, without collecting more personal information than necessary.
• Participation is monitored from start to finish, with real humans reviewing cases so you’re not left second-guessing the results.

When your operations lead asks who’s completed training? You have the report ready before they finish the sentence.

Just ask Smart Serve Ontario. When a provincial mandate triggered a 20x surge in training volume, they needed a solution that could handle scale without sacrificing oversight. With Integrity Advocate’s no-install, mobile-first platform, they supported thousands of learners in real time while keeping the program compliant.

When a system works, the people behind it can too. 

That’s why we believe operational efficiency should be the baseline for every compliance program.

Through intentional platform design, expert partnership and a passion for empowering people, Integrity Advocate helps compliance leaders spend less time fixing and more time leading.

No installs.

No confusion.

Just streamlined compliance you (and everyone else) can count on.

Ready to streamline your compliance workflows? Let’s make it easier—together.

{{post-cta}}

The US Department of Education's Privacy Technical Assistance Center published a presentation titled Security Threats: Education Systems in the Crosshairs, in which security advisor Mike Tassey documented how data breaches, hacks, and privacy incidents have affected organizations across virtually every sector, from NASA and Citigroup to local school systems.

The warning is directly relevant to any organization using online proctoring. The data that proctoring services collect, including names, government-issued ID, biometric images, and session recordings, is exactly the kind of information that makes education systems a target.

The Threat Landscape Has Changed

Cyber-theft has become fully commoditized. There is an active black market for personal data, and an underground economy where over two million pieces of malware are built and sold every year. This malware is designed to gather precisely the kind of information proctoring platforms collect: Social Security numbers, addresses, birth dates, and identity credentials.

Tassey specifically noted that children's identities are particularly valued by data thieves because they are, in his words, fresh. A child's identity may go undetected for years before the theft is discovered, making it a high-value target for long-term fraud.

The alarming part is how malware typically gets onto devices. It is not usually through pirated software or poor security settings. It enters through plugins and browser extensions that users install themselves, often for legitimate purposes. The installation is the vector.

Why Proctoring Plugins Create Specific Risk

Most online proctoring services require users to install browser extensions or plugins to enable monitoring. Each of these installations represents an opportunity for malware to enter the device, either during the initial installation or through a subsequent update, without the user's knowledge or permission.

Tassey's research notes that on average there are one to five bugs for every 1,000 lines of code. For organizations that have not completed independent code reviews of the proctoring software they deploy, those bugs represent an unexamined attack surface. Malware can be introduced into code updates without detection, meaning a plugin that was clean at installation may not remain so.

At minimum, organizations should be instructing learners to disable or uninstall proctoring plugins and extensions immediately after use. The risk does not end when the exam does.

What a Code Review Should Cover

Organizations that require learners to install proctoring software should conduct, or require their vendor to provide evidence of, a code review that addresses:

• Potential malware embedded in the plugin or extension code
• Errors or vulnerabilities that could be exploited by third parties
• Whether the software receives automatic updates, and what review process governs those updates
• What data the software transmits, to where, and under what conditions

If a vendor cannot provide clear answers to these questions, the software should not be deployed on learner devices.

The Case for No-Installation Proctoring

The most effective way to eliminate installation-based security risk is to remove the installation requirement entirely. Integrity Advocate's platform is browser-based and requires no plugin, extension, or application installation in most cases. There is nothing to install, nothing running in the background after the session ends, and no update mechanism that could introduce malware without the user's knowledge.

For use cases that do require a lockdown browser, Integrity Advocate's solution uses fully open source code, does not accept automatic updates after installation, and does not transmit data beyond what is required for the session. The code is publicly available for inspection.

The US Department of Education's guidance on protecting student privacy points to the same principle: the safest data handling approach minimizes what is collected, minimizes how long it is retained, and minimizes the software footprint on learner devices.

{{post-cta}}