The US Department of Education's Privacy Technical Assistance Center published a presentation titled Security Threats: Education Systems in the Crosshairs, in which security advisor Mike Tassey documented how data breaches, hacks, and privacy incidents have affected organizations across virtually every sector, from NASA and Citigroup to local school systems.

The warning is directly relevant to any organization using online proctoring. The data that proctoring services collect, including names, government-issued ID, biometric images, and session recordings, is exactly the kind of information that makes education systems a target.

The Threat Landscape Has Changed

Cyber-theft has become fully commoditized. There is an active black market for personal data, and an underground economy where over two million pieces of malware are built and sold every year. This malware is designed to gather precisely the kind of information proctoring platforms collect: Social Security numbers, addresses, birth dates, and identity credentials.

Tassey specifically noted that children's identities are particularly valued by data thieves because they are, in his words, fresh. A child's identity may go undetected for years before the theft is discovered, making it a high-value target for long-term fraud.

The alarming part is how malware typically gets onto devices. It is not usually through pirated software or poor security settings. It enters through plugins and browser extensions that users install themselves, often for legitimate purposes. The installation is the vector.

Why Proctoring Plugins Create Specific Risk

Most online proctoring services require users to install browser extensions or plugins to enable monitoring. Each of these installations represents an opportunity for malware to enter the device, either during the initial installation or through a subsequent update, without the user's knowledge or permission.

Tassey's research notes that on average there are one to five bugs for every 1,000 lines of code. For organizations that have not completed independent code reviews of the proctoring software they deploy, those bugs represent an unexamined attack surface. Malware can be introduced into code updates without detection, meaning a plugin that was clean at installation may not remain so.

At minimum, organizations should be instructing learners to disable or uninstall proctoring plugins and extensions immediately after use. The risk does not end when the exam does.

What a Code Review Should Cover

Organizations that require learners to install proctoring software should conduct, or require their vendor to provide evidence of, a code review that addresses:

• Potential malware embedded in the plugin or extension code
• Errors or vulnerabilities that could be exploited by third parties
• Whether the software receives automatic updates, and what review process governs those updates
• What data the software transmits, to where, and under what conditions

If a vendor cannot provide clear answers to these questions, the software should not be deployed on learner devices.

The Case for No-Installation Proctoring

The most effective way to eliminate installation-based security risk is to remove the installation requirement entirely. Integrity Advocate's platform is browser-based and requires no plugin, extension, or application installation in most cases. There is nothing to install, nothing running in the background after the session ends, and no update mechanism that could introduce malware without the user's knowledge.

For use cases that do require a lockdown browser, Integrity Advocate's solution uses fully open source code, does not accept automatic updates after installation, and does not transmit data beyond what is required for the session. The code is publicly available for inspection.

The US Department of Education's guidance on protecting student privacy points to the same principle: the safest data handling approach minimizes what is collected, minimizes how long it is retained, and minimizes the software footprint on learner devices.

{{post-cta}}

Professional training doesn't only happen during business hours.

For late-night learners, global teams and high-stakes rollouts, the ability to verify identity, track participation and prove compliance—anytime, anywhere—is essential.

That kind of access sounds simple, but in practice, it’s anything but. According to a report by Imprivata and the Ponemon Institute, just 28% of IT leaders believe their organization can adequately secure mobile devices and access to sensitive data. Meanwhile, productivity losses from downtime on shared devices add up to over 872 hours lost per week, while an average $5.45 million lost annually to missing devices alone.

What’s the takeaway in all this? In mobile-first environments, training infrastructure that can’t scale (or worse, that introduces security or usability roadblocks) quickly becomes a liability. Whether it’s healthcare, retail, or manufacturing, organizations are discovering that flexibility without oversight is just another form of risk. 

This is where scalable proctoring infrastructure becomes indispensable. The right tools ensure the right person completed their assessment, stayed engaged and left behind a clear, auditable record. All without adding friction, requiring installs or generating costly IT overhead.

Built to keep pace with your workforce

When training is essential to doing the job, whether for safety compliance, regulatory credentials or global certifications, systems have to perform under pressure. And in enterprise environments, that pressure isn’t occasional. It’s constant.

Organizations today are rolling out training to workforces that span shifts, regions and roles. That means late-night modules, onboarding from the field and recertifications happening across time zones. When those sessions hit a technical snag, the impact ripples.

• One failed login can delay an entire shift.
• One broken identity check can stall a recertification deadline.
• One missing audit trail can escalate into a compliance liability.

Since many of these programs run on shared devices or in BYOD environments, complexity compounds fast. In mission-critical industries like healthcare and manufacturing, delays don’t just impact productivity, they raise safety risks. In manufacturing, unplanned downtime can cost an average of $260,000 per hour, with equipment failure responsible for nearly 70% of these incidents. These failures can often stem from human error, such as when employees skip steps or misuse machinery due to poor training or rushed onboarding.

That’s where reliable, verifiable training becomes essential. When organizations can prove not just that training was assigned, but that it was completed, understood and monitored, they reduce the likelihood of mistakes that lead to breakdowns. When those assessments are delivered without delay—across shifts, regions, and devices—they help keep production lines moving and compliance risk in check.

When training tools fail to keep pace, it’s not just learners who lose time. It’s the entire system.

What breaks when your training system can’t scale

It’s not always obvious when a platform isn’t built for high volume, then it gets pressure-tested—and the cracks start to show. Here’s what can go wrong when your training infrastructure falls short:

• Help desks get overwhelmed. Minor friction points turn into major support backlogs when hundreds (or thousands) of users run into the same issue at once.
  
• Learners abandon or delay training. If systems are slow, confusing or inconsistent across devices, users will disengage, especially in mobile or after-hours environments.
  
• Compliance teams lose visibility. Without clear, verifiable records of participation and identity, oversight becomes fragmented and audit risk increases.
  
• Delays derail productivity. In critical operations, even short disruptions can stall onboarding, extend downtime or delay recertifications.
  
• Reputation takes a hit. When learners, regulators or partners experience unreliable systems, it reflects on the credibility of your credentials or compliance program.

Consider a medical training provider issuing certifications for frontline healthcare roles. If their assessment platform fails to detect impersonation or AI-generated responses during a critical exam, what’s going to happen? The risk isn’t limited to the individual who cheated. It undermines the perceived value of every credential issued through that system.

So aren’t most assessment security tools built for scalability? Well..many can handle volume on paper. But far fewer are designed to maintain reliability, oversight and integrity when tested in the real world—under pressure, across time zones, and on a range of personal devices.

What real-world scale actually looks like

Picture this: A national safety organization announces a recertification deadline that affects thousands of frontline workers. In a single week, training volume spikes to more than 20 times the usual load.

Learners log in from job sites, personal phones and public Wi-Fi. Some are in rural areas with limited bandwidth. Others are squeezing assessments in between overnight shifts. On top of it all, every single session has to be secure, compliant and verifiable—because the stakes are high, and regulators are watching.

These are the conditions modern training systems need to meet to ensure admin and support teams don’t burn out. And so the integrity of every credential holds up under pressure.

Online proctoring built for the pressure

At Integrity Advocate, scalability isn’t a feature, it’s a standard. Our platform supports organizations where training never stops, learners are always on the move and there’s no room for downtime.

• We've supported rollouts with 20x traffic spikes—without service disruption
• Our support rate remains under 0.58%, even at scale
• We’ve done it all with no installs, no downloads and no added risk

Whether you're certifying workers across shifts, regions or regulatory jurisdictions, we help you deliver training that holds up under pressure—because in compliance-driven environments, it’s not just about training more people. It’s about protecting what that training stands for.

Scaling secure training online takes more than software, it takes a partner you can count on. So count us in.

{{post-cta}}

We talk to a lot of programs right now that are dealing with the same thing. AI tools have changed what cheating looks like, and most proctoring systems were built for a problem that’s no longer the only one on the table. The gap is showing up in appeals, in complaints, and in outcomes that are getting harder and harder to defend.

What’s actually happening out there

The classic image of cheating a second phone, a friend on the other side of the room, notes taped to a monitor is still real. But it’s not the conversation we’re having with most programs anymore. The harder stuff is subtler.

AI writing tools can produce a natural, well-reasoned answer in seconds. Paraphrasing tools can disguise lifted content well enough to pass similarity checks. And the behavioral signals that used to flag something suspicious eye movements, typing pace, browser switching don’t tell you much when the assistance is happening invisibly, in another tab or on another device entirely.

The problem isn’t that AI cheating is impossible to catch. It’s that catching it requires a level of context and judgment that an algorithm alone doesn’t have.

An algorithm can tell you something looked unusual. It can’t tell you what actually happened or whether it matters. That part still requires a person.

‍

Why a flag without a human isn't enough anymore

Automated proctoring was designed to catch visible, definable behaviors tab switching, phone use, an unauthorized person on screen. For those cases, it works. But AI-assisted cheating often leaves no visible trace at all.

So when an automated system flags something in this environment, what it's actually telling you is: something here didn't fit the expected pattern. That's a starting point, not a conclusion. The problem is when programs treat it like one.

A wrongful finding based on an automated flag isn't just uncomfortable it can seriously damage a student's record or a professional's career. And when that decision gets challenged, "the system flagged it" isn't a defensible answer. You need a record of what actually happened and a human judgment behind the decision.

{{post-stat-highlight}}

What it actually takes to be defensible

Defensibility isn't really about technology. It's about being able to look anyone in the eye a student, a candidate, a regulator, a board member and explain clearly why a decision was made and what it was based on.

In this environment, that takes three things:

• Human review on every flag, before any decision goes out. Not as an appeal process. Before the outcome is issued.
• Reviewers who are looking at AI-use patterns specifically, not just traditional integrity signals, and who understand the difference between something suspicious and something definitively wrong.
• A complete session record identity verification, monitoring log, what was flagged, what the reviewer saw, what was decided ready to export the moment someone asks.

What actually changes with human review

One question to sit with

If an outcome from one of your proctored exams was challenged today by a student, a candidate, an employer, an accreditor what could you actually put in front of them? An automated flag, or a complete human-reviewed record of what happened and why?

For programs where the result genuinely matters, that's not a rhetorical question. It's the one worth answering before you need to.

We built Integrity Advocate around exactly this human review on every flagged session, a complete audit trail for every outcome, and the kind of defensibility that holds up when someone actually pushes back.

{{post-cta}}