Are we in a cheating pandemic? – Measured Response #2

Welcome back to the second edition of Measured Response

Last week I argued our sector was looking into a foresight mirror on AI and mistaking it for a window. This week, a question the mirror has been quietly reflecting back for years, and one we’ve been too polite to ask out loud.

“Are we in a cheating pandemic?”

I don’t ask that lightly. “Pandemic” is a loaded word, and I’ve watched it migrate from epidemiology to marketing copy in many sectors with the same unease as anyone else. However, strip it back: widespread, cross-border, persistent, evolving faster than the response. The parallels with what’s happening in assessment right now are uncomfortably close. Minus the rats…

Hantavirus, as we know, is having a moment in the headlines again. Rare, regional, frightening, well-contained. Cheating (or malpractice if we are being diplomatic) is none of those things. We just talk about it as if it were.

So, what are some of our recent pandemic ’strains’? A few recent examples:

• The Law School Admission Council (LSAC) is returning the LSAT to in-person test centres for August 2026, citing organised cheating operations based in mainland China, aggressive enough to warrant entirely suspending online testing.
• The Indian NEET-UG 2026 assessment was cancelled following allegations of paper leaks circulating on WhatsApp and Telegram which affected 2.2 million candidates.
• Just 4 days ago, a Government probe, involving the National Cyber Crime Investigation Agency (NCCIA) has been ordered in Pakistan following online leaks of Cambridge O and A Level exam papers
• 59% of hiring managers now suspect candidates of using AI tools to misrepresent themselves, and 62% admit job seekers are now better at faking with AI than recruiters are at detecting it. Don’t get me started on AI detection…
• A 2025 Journal of Academic Ethics review found 44.7% of students admitted to online dishonesty. Honestly, I’m surprised it’s that low!

Five examples, five different parts of the sector. Same pattern.

So is “pandemic” the right word?

I went to a dictionary description of a pandemic and applied three tests to our “cheating pandemic”:

1. Is it Widespread? Yes. Cross-jurisdictional, cross-modality, cross-sector.
2. Is it evolving faster than the response? Very much, yes! By the time a vendor publishes “10 ways our platform stops X”, sites like Reddit and even TikTok have “10 ways to get around their 10 ways”. The arms race isn’t new, it now just has an ‘AI-primed’ warhead.
3. Is it useful as a frame? This is the one I’d push hardest. I was involved in planning test delivery during Covid and Pandemic focused thinking forces us to talk about transmission, not just symptoms. Our sector is fluent in ‘symptom-talk’ (“We detected X.” “Our flag rate is Y.”). We are much weaker on ‘transmission-talk’; the cheating networks, supply chains, financial incentives, the technology platforms that make up the ecosystem.

If it’s yes to all three, “pandemic” isn’t hyperbole. It’s a valid diagnostic frame.

Here’s where I’d map the current ‘outbreak’. Five different issues, all active, all interacting and spawning new variants.

1. Remote proctoring under pressure. The story isn’t really about technology. Well for us in Europe anyway. It’s about the EU AI Act classifying student-monitoring AI as high-risk from August 2026 (or is it now 2027?), making pure AI-only proctoring effectively non-compliant without a human oversight loop. Add in from the USA, the Cleveland State University settlements from 2022, the 2024 Honorlock class actions and a generation of candidates who’ve watched the TikTok “how to defeat” tutorials, and the trust deficit is structural, not a PR issue. However, to be clear Remote Proctoring isn’t dying, but the assumption that a non-AI enhanced, Remote Proctoring solution can still be a sole, primary defence should be.
2. Test centres aren’t a simple fallback. ACCA’s decision announced last year to move back to test centres and LSAC’s decision (mentioned earlier) is the loudest version of a quieter trend. However, and this is the part the media appears to be glossing over, centres are not a magic bullet either. The Indian high-stakes scandals are physical, test centre scandals. Going back to centres without redesigning the assessment isn’t a security upgrade. It’s just a venue change.
3. AI threats: the easy frame and the harder one. The easy frame: candidates use AI, we detect AI, as an arms race. The harder frame, and the one that matters: GenAI has compressed the cost of bespoke cheating to roughly zero. Item-specific, candidate-specific, context-aware ‘help’, on demand. Detection always assumed scarcity of effort on the cheating side. Scarcity is long since over.
4. New ways of cheating: the hardware story. Bluetooth earpieces are the boring incumbent always put up on a pedestal as the ‘easy threat’. Smart glasses, on-device LLMs, real-time transcription, £7 webcams from Amazon (thanks Tim Burnett!) and screen-overlay AI copilots designed specifically to be invisible to secure browsers. This is the hardware front. Desktop AI assistants designed to operate outside the browser sandbox, where proctoring/security software has no authority to monitor, are an existence proof. If the threat lives outside your security perimeter, your security perimeter is irrelevant.
5. Commercial cheating: Traditionally the essay mill model was seen as the ‘commercial arm’ of cheating, but that market/model is in decline. However, importantly, the commercial cheating industry isn’t shrinking, it’s simply restructuring. Contract cheating groups are now DM-ing hundreds of students through their own LMS-provided messaging services. No website, no URL to track, just a number, and a solicitation for “services”. The visible web is being replaced by a darker, smaller, more relational AI-supercharged supply chain.

The Measured Response

So, if we accept this is a pandemic, widespread, evolving, structurally outpacing the response, the response can’t simply be a better lockdown browser. It can’t be a better proctor. It can’t be a better detector (even if they worked). Those are ‘masks’. Useful, sometimes necessary, really uncomfortable in hot weather, but masks.

The actual response, and one I discussed at the Assessment Horizons conference in Cambridge in April, is the one we keep edging around. “Re-innovation”: rebuilding assessments as something genuinely new rather than patching existing formats.

“Redesign” undersells it. Re-innovation means accepting that some formats, recall-heavy, single-sitting, AI-trivially-solvable, were already living on borrowed time before GenAI, and that propping them up with more security, often as an afterthought, is a sunk-cost decision dressed as a risk decision.

Three things I’d argue for:

1. Treat security as a stack, not a product. Identity, environment, behavioural signals, content design, post-hoc analytics, governance. No single layer is sufficient. Most RFPs I see still treat it like it is.
2. Treat the supply side as a sector responsibility. Cheating-as-a-service is an industry. I’d argue we’ve been treating it simply as student misconduct. That category error has cost us a decade and put us on the back foot. The work of the Credential Integrity Action Alliance in the USA is a huge step forward and one we should all be following. https://credentialintegrity.org
3. Treat construct validity as the security question. If your assessment can be aced by a model that has never sat in a medical clinic, never written a brief, never debugged a production system, your security problem is downstream of a measurement problem. Fix the measurement problem! Authentic Assessment is where we need to be.

And one thing I’d argue against: framing this as a moral panic about students. The students aren’t the pandemic. They’re the population. The pandemic is the system we’ve built, even if inadvertently, around them.

That’s the Measured Response.

Over to you…

• Is “pandemic” too strong? Or have we been too British and polite for too long?
• Which of the five issues in my ‘outbreak’ is most under-discussed in your part of the sector? What have I missed?
• And the one I keep coming back to if you’ve followed my conversations on LinkedIn this last few weeks: at what point is retreating to test centres no longer a security strategy, but a stay of execution?

Comments are open.

Until next week,
Paul Muir

p.s. If you are a test-security geek or simply want to learn more about the latest on test security, make sure to register for the Conference on Test Security (COTS) taking place in November this year – https://conferenceontestsecurity.org