How to detect cheating in exams using analytics

Analytics detects cheating in exams by comparing what one candidate did against what thousands of honest candidates did on the same questions. Response times, answer patterns, score shape, and on-screen behavior each leave a trace, and a trace far enough outside the normal range becomes evidence worth reviewing.

That second half is where most guides stop short. They describe a camera watching a candidate's eyes and call it analytics. Camera work matters, but it is the weaker signal. The stronger one is psychometric: statistics that read the shape of a response set and show that a score of 95 was produced in a way an honest 95 never is.

Cheating is common enough that the real question is not whether it reaches your hiring process. More than 60 percent of university students admit to cheating in some form, a figure the International Center for Academic Integrity has tracked across decades of survey work. Hiring raises the stakes, because the prize is a job rather than a grade.

TL;DR

• Analytics does not catch cheating by watching a face. It catches it by finding response patterns that are hard to produce honestly.
• Seven signal families are in play, and four of them carry most of the weight: response time, score shape, answer similarity across candidates, and interaction telemetry such as tab switches and copy-paste.
• A high score is not suspicious on its own. A high score produced in the wrong order, at the wrong speed, is.
• Real detection rates are low. One licensure study flagged 2 candidates out of 1,172, so treat a flag as rare and worth a careful human look.
• A flag is evidence, not a verdict. Auto-rejecting on flags alone is unfair to candidates and hard to defend later.
• None of it works unless the exam was built to produce signal: a real item pool, randomized delivery, and per-question timing captured from the start.

How do you detect cheating during online exams?

You detect cheating during online exams by collecting seven kinds of signal on every attempt, then looking for combinations that rarely occur together honestly. No single signal proves anything on its own. A fast answer is just a fast answer. A fast answer on the hardest question in the pool, from a candidate who missed three easy ones, is a pattern.

Here is how the signal families compare, and how much each is worth on its own.

Read the table as a portfolio, not a menu. Teams that pick one row and buy a tool for it get the worst of both worlds: enough surveillance to upset honest candidates, not enough evidence to act on anyone.

What counts as cheating during testing?

Cheating during testing is any help the assessment rules did not allow. That definition sounds obvious and it is where most disputes actually start, because candidates and employers draw the line in different places and almost nobody writes it down before the assessment opens.

In practice the behaviors split into five groups:

• Outside knowledge: Looking up an answer, reading notes, or searching mid-question. The most common and the easiest to catch, because it needs a tab switch or a window change.
• Outside people: A friend in the room, a shared screen, or a messaging thread running alongside the test.
• Impersonation: Somebody else sits the assessment. Rare, high impact, and the one case where identity verification is the only signal that works.
• Pre-knowledge: The candidate already has the questions, usually from a leaked item set or a practice site that scraped it.
• Unauthorized AI: An answer generator produces prose or code the candidate could not produce. Now the fastest-growing group, and the one most assessment rules still do not mention explicitly.

Write your rules against those five groups, publish them on the assessment intro screen, and the detection conversation gets much simpler. A candidate who agreed to a stated rule and broke it is a different conversation from a candidate who guessed at the rules.

Using behavioral analytics to identify cheating patterns

Behavioral analytics identifies cheating patterns by grouping candidates on how they interacted with the test, then checking whether any group also scored in a way that interaction cannot explain. The method is cheap, needs no camera, and runs on data the assessment platform already logs.

A 2025 study of 52 students in a proctored exam, published as Detecting AI-Assisted Cheating in Online Exams through Behavior Analytics, tracked only three things: text selection inside question areas, right-clicks, and loss of focus on the exam page. Clustering on those three signals alone split the group into six clusters. About 33 percent of participants showed suspicious behavior, spread across four of the clusters, and those students scored 30 to 40 points higher on average than students who did not.

Three signals. One third of the cohort separated out. That is the part worth sitting with, because the three signals are not exotic: every assessment platform that renders questions in a browser can record all of them, and most record them and never look.

The score gap is what turns behavior into evidence. Focus loss by itself means a candidate checked a notification. Focus loss plus a 30-point lift over peers who stayed on the page means something else. The pattern only becomes readable when behavioral data and score data sit in the same report, which is exactly where most hiring stacks break: proctoring lives in one tool and scoring in another, and nobody joins them.

Video adds a different set of patterns. A 2021 detection pipeline built from exam video alone, described in Cheating Detection Pipeline for Online Interviews and Exams, chained face detection, face recognition, object detection and face tracking to flag three specific conditions: a second person in frame, an electronic device in use, and the candidate absent from the seat. Narrow, but those three are the conditions a reviewer can actually confirm by watching ten seconds of footage.

How do response-time anomalies expose pre-knowledge?

Response-time analysis exposes pre-knowledge through one specific combination: an unexpectedly short time to answer plus a correct answer on an item that is hard for everyone else. A candidate who knows the question in advance does not need to read it, and that shows up as speed the item does not justify.

The effect is measurable, and the hit rate is lower than most people expect. A study of two computer-based licensure examinations, Using Response Time to Detect Item Preknowledge in Computer-Based Licensure Examinations, calibrated item timing on an early sample and then tested a later one. In the non-adaptive exam, 2 items out of 111 looked exposed and 2 candidates out of 1,172 showed signs of pre-knowledge across multiple items. In the adaptive exam, the method found nothing at all.

Two candidates in 1,172. Keep that ratio in mind the next time a vendor demo implies a third of your applicants are cheating. Honest-looking data mostly looks honest, and a method that flags 10 percent of a cohort is far more likely to be badly calibrated than to have found a crime wave. Calibrate first, accuse later.

The adaptive result is the practical lesson buried in that study. Adaptive delivery gives each candidate a different path through a large item pool, which is consistent with there being far less for pre-knowledge to grip. On that evidence, item-pool design did more for integrity than detection did.

How do score patterns reveal outside help?

Score patterns reveal outside help because the order of right and wrong answers carries more information than the total. Ability produces a predictable shape: easy items right, hard items mixed, very hard items mostly wrong. Help produces a shape ability cannot explain, and the statistics that measure the gap are called person-fit statistics.

This is the most direct answer to a question candidates and administrators both ask: on a 100-question test, is a score of 95 more suspicious than 94? By itself, no. One extra correct answer is noise. What makes a 95 suspicious is which 95 items were right. A candidate who nails the five hardest items in the pool and drops two of the easiest has produced a shape that real ability almost never produces, and that is flaggable at any total score, including a 72.

Researchers at Florida State University put a number on it. Work by chemistry professor Ken Hanson and machine learning engineer Ben Sorenson, published in the Journal of Chemical Education in August 2024 and summarized by FSU News, fed nearly 1,000 questions from five semesters of exams into ChatGPT and then used Rasch modeling and fit statistics to spot its answers. The method identified ChatGPT-generated response patterns with almost 100 percent accuracy and a false positive rate of almost zero.

What gave the generator away was the shape. It sometimes answered the hardest questions correctly while missing easy ones, which is backwards from how students perform. Hanson's framing of the tool is the useful bit for anyone writing assessments: it is an answer generator, built to look like it knows, which is convincing to a reader who does not know the material either.

Pair that with item-level psychometrics and the picture sharpens. Every question in a mature item bank carries a difficulty index and a discrimination index, which say how hard an item is and how well it separates strong candidates from weak ones. A response set that contradicts both indices at once is the single strongest statistical signal available, and it needs no camera, no microphone, and no assumption about intent.

How does candidate cheat detection work?

Candidate cheat detection works in three stages: collect signals during the assessment, score them against the behavior of everyone else who took it, then route anything unusual to a named human with the evidence attached. The third stage is the one teams skip, and skipping it is what turns a useful system into a liability.

Stage one is collection, and the honest version is a layered list rather than one magic feature. Identity checks confirm the right person started. Environment controls reduce how much help is reachable. Browser-level controls record what the candidate did on screen. Score and timing logs capture the response pattern. Each layer is weak on its own, which is why the strict setups run all of them.

Stage two is scoring. Signals get compared against the cohort, not against an absolute threshold, because an absolute threshold punishes slow readers and rewards fast guessers. The output should be a graded trust indicator rather than a yes or no: clean, worth a look, or confirmed.

Stage three is review. Hiring teams that run high assessment volume tend to build a standing rule here, because the alternative is re-litigating every flag from scratch. A workable rule: clean sessions auto-advance, mid-tier flags get a second assessment or a short live task on the same skill, and only confirmed violations with reviewable evidence end a candidacy.

How does Examplify detect cheating in exams?

This section answers the platform-specific questions that bring a lot of readers here, and most of those readers are test-takers rather than employers. The honest summary for both audiences: these tools see more than candidates assume and less than they fear.

Examplify, the exam-delivery application from ExamSoft used widely in law, nursing and medical programs, detects cheating by locking the testing environment rather than by analyzing answers. It runs the exam inside a controlled application that blocks other programs, copy-paste, screenshots and external drives for the duration, and it can record webcam video, screen activity and microphone audio through the session. Recorded sessions are reviewed, with anomalies flagged for a human proctor or administrator. Gaze direction is part of that review, so sustained looking away from the screen is the kind of thing that gets surfaced.

Its limit is the one every lockdown tool shares: it secures the machine it runs on and cannot see a second device sitting beside it. A phone on the desk is invisible to the application itself and only becomes detectable indirectly, through eye movement or a lighting change on camera. That gap is the reason dual-device monitoring exists.

Can Big Ideas Math detect cheating?

Big Ideas Math is a school curriculum and homework platform, not a secure exam system, so what it can detect is narrower than a proctored exam. Platforms of that type log the data a web application naturally sees: when an assignment was opened, how long each question took, how many attempts a student made, and whether answers changed in bursts. A teacher reviewing that log can spot an assignment completed in two minutes or an answer pattern that matches a classmate's exactly.

What it does not have is the proctoring layer: no identity verification, no environment control, no browser lockdown. Detection there depends on a teacher reading the activity log, which means the signals exist but somebody has to look.

Can TestGorilla detect cheating?

TestGorilla is a pre-employment assessment platform, and like most tools in that category it records anti-cheating signals during a test: webcam snapshots, full-screen exit and tab-switch events, IP checks and question-level timing, surfaced to the recruiter alongside the score. Readers comparing it feature by feature with Testlify can work through the full platform comparison rather than take either vendor's word for it.

The useful question when evaluating any assessment platform is not whether it has anti-cheating signals. Nearly all of them do. Ask instead whether the behavioral signals and the psychometric signals land in the same report, whether per-question timing is exposed or only a total duration, and whether a flag triggers a reviewable evidence trail or a silent rejection.

What a hiring platform sees that a classroom tool does not

The difference is cohort size and item history. A classroom tool compares a student to a class of 30. A hiring platform runs the same validated item thousands of times, which is what makes difficulty and discrimination indices stable enough to flag an individual response set against. Scale is the detection advantage, and it is why integrity analytics works better in hiring than in a single course.

How can analytics detect AI-generated answers?

Analytics detects AI-generated answers two ways: by classifying the text or code itself, and by catching the statistical fingerprint an answer generator leaves on a response set. The second is more reliable, because it does not depend on the generator's writing style, which changes with every model release.

Text classification is the familiar approach. A classifier reads an open-ended answer and estimates whether it was written, generated, or generated and then edited. Useful as a triage signal, and worth treating with real caution: classifier error rates run high on non-native English writers, and accuracy falls sharply once text is paraphrased. A classifier result belongs in a review queue, never in an automated rejection.

The statistical route is sturdier, and the FSU result above is the clearest demonstration of it. Because a generator answers from pattern rather than understanding, it fails in places a struggling human does not. Measure the response set against item difficulty and the mismatch shows up whether the candidate typed the answer, pasted it, or read it off a second screen.

On the environment side, a strict setup also looks for the tooling: browser extensions and AI assistants running during the session, screen-share state, and clipboard activity on code and prose questions. For coding assessments, keystroke and paste history is particularly readable, because a solution that arrives in one paste at 400 characters never looked like typing.

Where exam analytics gets it wrong

Every signal on this page produces false positives, and some of them land hardest on candidates who did nothing wrong. This is the section vendor guides tend to leave out, and it is the part that decides whether an integrity program survives contact with real applicants.

• Disability and neurodivergence. Timing-based signals assume a typical reading and processing speed. Candidates with dyslexia, ADHD or a visual impairment produce timing profiles that look anomalous and are not.
• Gaze and movement checks. A candidate who looks away to think, has a tic, uses a screen reader, or sits in a small room with a doorway behind them will trip movement and presence rules repeatedly.
• Bandwidth and hardware. Disconnects, lag and failed camera checks correlate with income, not honesty. A flagged disconnect in a low-bandwidth region usually means low bandwidth.
• Text classifiers on non-native writers. AI-writing detectors misfire most often on people writing in a second language, which turns a fairness problem into a hiring decision. Testlify doesn't use an AI detector score as a pass or fail gate, and neither should you.
• One signal, no corroboration. A single tab switch at minute 14 is not a case. The only defensible flags are ones where independent signal families agree.

The fix is procedural, not technical. Publish an accommodation route before the assessment, let candidates request an adjustment without explaining themselves to a hiring manager, and require corroboration from more than one signal family before a flag changes an outcome.

How should you act on a cheating flag?

Treat a flag as a question, not an answer. The goal of the review is to decide whether the evidence is strong enough to change a hiring decision, and in most cases it will not be, which is the correct result rather than a failure of the system.

1. Read the evidence before the score. Open the session log and the response pattern together. If only one signal family fired, stop there and advance the candidate.
2. Check for a non-cheating explanation. Disconnect, accommodation request, shared household network, browser crash. Rule these out explicitly rather than by assumption.
3. Re-test on the same skill, differently. A short live task, a follow-up assessment from a different item pool, or a technical conversation. This is the highest-value step and the most skipped: it converts an ambiguous flag into a real signal about ability.
4. Keep the decision and the reason. Record what the evidence showed and what was decided. A year later, that record is the only thing that makes the decision defensible.
5. Tell the candidate something true. A disqualification that is disclosed with a reason is survivable. A silent rejection after a flag is how an integrity program becomes a reputation problem.

Pro tip: set your flag threshold by looking at how many reviews your team can genuinely complete each week, not by what the tool defaults to. A threshold that generates 40 flags a week for a team that can review 5 is the same as having no integrity program, except it also creates a written record of 35 flags nobody looked at.

How to design exams so the analytics work

Detection quality is set at design time. An exam built from 20 questions delivered in the same order to everyone gives analytics almost nothing to work with, and no amount of proctoring compensates. These five moves do more than any monitoring setting.

1. Build a real item pool

Aim for at least three to four times as many questions as any candidate sees. A large pool is what makes randomization meaningful, and it is why the adaptive exam in that licensure study turned up no sign of pre-knowledge at all. It is also the only durable answer to item leaks, since a leaked question is a small fraction of the pool rather than a large slice of the exam.

2. Randomize items and options

Shuffle question order and answer-option order per candidate. This breaks the simplest collusion method, where two candidates share answers by position rather than by content, and it makes answer-similarity analysis far more sensitive, because matching wrong answers across two shuffled papers is genuinely unlikely.

3. Set time limits per question, not just per test

A single overall limit hides exactly the data response-time analysis needs. Per-question timing is what lets you compare one candidate's 14 seconds on a hard item against a norm. If your platform only exposes total duration, the most reliable signal family on this page is unavailable to you.

4. Use open-ended and applied items, not only multiple choice

Multiple choice is the easiest format to leak, to guess and to generate. A work-sample task, a code problem with a visible edit history, or a short written answer produces far more signal per minute, and it is harder to outsource convincingly.

5. Say the rules out loud, then ask for agreement

An honesty agreement on the intro screen does something analytics cannot: it establishes what was agreed, so a later conversation is about a broken rule rather than a guessed-at one. The wider evidence says visible conditions matter too. A 2024 study of 741 undergraduates, comparing three unproctored online exams against one proctored in-class final in the same course, found clear evidence of more cheating on the unproctored exams, and found that cheating rose with each successive unproctored exam as students got better at it. Behavior shifts before any detection runs, which is the cheapest integrity gain on this page.

How does Testlify support cheating detection?

Testlify approaches this through the Testlify Assessment Integrity Framework, which protects the trustworthiness of assessment results across six layers: identity assurance, environment control, behavior monitoring, AI-assistance detection, reviewable evidence, and configurable strictness. The order matters. Evidence comes before judgement, and judgement stays with the hiring team.

In practice that means three presets rather than one setting: Standard for balanced proctoring, Strict for maximum security with enforced controls, and Custom for anything in between. More than 20 measures sit underneath them, including full-screen enforcement, tab-switch detection, face detection and single-presence verification, photo ID verification with a face match against the ID, periodic webcam snapshots, session recording of clicks and navigation, copy-paste tracking, multi-monitor restriction, AI-tool and browser-extension detection, IP proctoring and a candidate honesty agreement.

Two parts are worth singling out for anyone who read this far for the analytics rather than the cameras.

The first is dual-device proctoring, which closes the second-screen gap that defeats lockdown-only tools. The candidate's phone becomes a second camera positioned to capture both the candidate and the laptop screen, and it is a hard gate rather than a nice-to-have: the assessment will not start until mobile monitoring is active, a disconnect blocks the session, and ending it is logged and reported to the test administrator.

The second is item-level psychometrics in the recruiter's own report. Difficulty index, discrimination index, quality risk, answer distribution, score and time distributions, and per-question activity and timing logs are all exposed, alongside a trust score and trust insights. That is the join most hiring stacks are missing, the one the behavioral-cluster study depended on: response patterns and behavioral signals readable in the same place.

The fairness wiring is deliberate. The recruiter sees a three-tier flag, and the wording is evidence-first rather than accusatory: green means no suspicious behavior was observed, yellow means some behavior was not ideal and a quick manual review is recommended, red means cheating was confirmed. Auto-termination exists but is separate and opt-in, with a threshold the recruiter sets, so flags do not end a candidacy on their own. For AI scoring the product ships its own disclaimer, that AI scores and insights are for guidance only and human judgement should drive final decisions, and the AI score can be excluded from the final average entirely. On the privacy side, face verification data is deleted after 30 days and consent can be withdrawn at any time, while video and audio responses are removed after six months.

Two honest constraints. Assessments run on Chromium desktop browsers, so Chrome or Edge, and several proctoring features are desktop-only by design. The mobile app is a capture fallback for recording audio and video, not a way to sit a whole assessment on a phone.

For a wider view of the delivery models and controls, Testlify's guide to anti-cheating and proctoring covers the full set, the breakdown of online exam proctoring types compares automated, live and record-and-review delivery, and the prevention side of the same problem is covered separately, since stopping cheating and detecting it need different settings. If integrity is the specific trait you want measured rather than monitored, there is also an integrity assessment in the test library.

Ready to see what your current assessments are already recording and never surfacing? Book a demo and walk through a real proctoring report, or start free and run one assessment with Strict mode on to see the full signal set for yourself.

Frequently asked questions (FAQs)