Founder Perspective · 7 min read
Cheating-as-a-Service Doesn't Need Gadgets. It Needs a Remote Access Tool.
The pitch arrives on Telegram, WhatsApp or Signal, or through an anonymous Instagram account or a Facebook group. A tool goes onto your computer an hour before the exam. The operator watches your screen and moves your mouse to mark the answers, during a lockdown session. It works with every lockdown browser. You pay only if you pass.
Look at what is missing from that offer. There is no camera to buy, no earpiece to hide and no device to carry into the room. It is software, installed remotely, paid for on results.
Hardware gets most of the attention in exam security right now, and some of it is deserved. But the services that sell passes at scale run on software, and that changes where the defence has to go.
Hardware can do the whole job
The gadget threat is real, so start by stating how serious it is. A candidate can run an entire session on hardware: smart glasses, a camera on their body, a camera on the desk between laptop and candidate, or a high-definition camera on a wall or cabinet behind them, pointed at the screen. Those send the screen to another person or to an AI model. The answers come back through a covert earpiece, a haptic ring, a pad against the leg or back, or flashes of light read at the edge of the screen.
Cognisense, which tracks the external cheating economy, lists gadget marketplaces as one of four categories of malpractice it monitors, alongside third-party cheating services, cheating tutorial services and fake certificate sellers.
There are few good preventive or detective controls for this. Invigilation, room checks, radio-frequency detection and assessment design all help. None of them is something software on the candidate's device can provide. Our own threat model puts the physical environment, including second phones, earpieces and smart glasses, in a separate layer, outside what a device-level control can address. I would rather say that plainly here than leave a reader to assume otherwise.
What the profiled market sells
The most detailed public count I know of is Cognisense's 2026 edition of its high-stakes certification threat intelligence guide, which is available to subscribers and approved recipients. It profiles 59 commercial providers in four categories: 21 third-party cheating services, 11 cheating tutorial services (paid guidance, software, overlays and AI), 12 gadget marketplaces and 15 fake certificate sellers.
Set the certificate sellers aside, since they bypass the exam altogether. Of the other 44 sellers of help before or during an assessment, 32 sell people or software and 12 sell hardware.
Those are provider counts, not exam volumes, and Cognisense is careful about what they show. It says its coverage is not exhaustive, that public marketing proves only what is offered, and that advertised capabilities are untested. I read the counts as a direction, not a market share. The direction is that the people and software routes outnumber the hardware route, which fits what comes next.
Why the services sell software
A cheating service has one hard problem: the candidate does not trust it. The buyer is giving money and access to an anonymous seller on a messaging app, with no contract and no refund, and every reason to expect a scam or a later demand for more. The market's answer is to be paid only after a confirmed pass. Pay-after-result or pay-after-pass terms are a recurring pattern across the 21 third-party services Cognisense profiles, and the proxy services I wrote about earlier work the same way.
Now ask the seller to add a gadget.
| Software route | Gadget route | |
|---|---|---|
| Paid by the candidate up front | Nothing | An expensive camera or haptic device, before any result exists |
| Sourcing | A download and a remote session | Buying hardware safely and quickly, from a source the candidate also has to trust |
| Risk in the room | Nothing physical to find | A device to hide and an invigilator who might see it |
| Seller's cost per exam | One operator's time | Hardware, shipping and support |
| Reach | Many candidates, many credentials | One kit per candidate |
A gadget ruins the pitch, because it removes the one thing that makes the offer credible: nothing to pay until it works. That is my reading of the market, not a measured result. It matches what I have seen in the services I have reviewed, where the standard offer is software only.
What the software is
The tooling is not exotic. Some of it is ordinary commercial remote-support software. Some is open-source or commodity remote-access trojans that anyone can download; Quasar and Remcos are two well-known examples. And some is modified builds of mainstream remote-support tools, altered so the process stops looking like what a scanner expects.
Cognisense's profiles describe the mechanism for only some providers. Two name remote access explicitly, and several others describe a specialist working inside the candidate's own session. Most of the 11 tutorial sellers are AI answer overlays, a separate software route that I cover in invisible overlays.
I am not going to describe how those modifications are done. What matters is the consequence. A control that works by recognising the tool is chasing a moving target. Every rename or rebuild restarts the race, and the seller only has to win once to sell the result to every candidate after.
I wrote up the other half of the trick, installing the agent before the lockdown browser's scan runs, in how proxy exam services beat proctoring.
"Works with every lockdown browser"
That line is marketing, and it should be read as marketing. One profiled provider's homepage claims it will bypass every proctoring platform, and Cognisense's reading is that naming a proctoring product turns a marketing claim into something the product's owner can test. It makes the right point about the claim itself: a published workaround "is not proof of universal defeat", but it is a reason a control "should be independently validated rather than assumed effective".
I agree with both halves. Do not take a seller's word that your control fails, and do not take your vendor's word that it holds.
The layer most exam software actually works at
It is tempting to say the device layer has had its turn: a lot of effort has gone into watching the desk, the room and the candidate. I think that misreads where most deployed software sits. A lockdown browser is an application. It locks one window and checks for things it recognises. That design is older than the remote-exam boom.
In my assessment, newer products mostly fall into two groups: detection that matches names, signatures or behaviours it already knows, and device-behaviour checks that cover a handful of the techniques a candidate has available. Both have value. Neither addresses the one thing every remote-operator service needs, which is a live path from the candidate's machine to the operator.
Safe Exam Browser is a documented example. Its process control closes applications it recognises by name, and its manual says it only has a URL filter for the built-in browser: "other applications and the system are not blocked from accessing the internet." That is a design choice for a free kiosk tool, not a defect. It is also exactly the gap a remote operator uses. The full comparison is on its own page.
A remote operator cannot see a screen or move a mouse without a connection out. Block the path and it stops mattering which tool is on the machine, what it is called, or when it was installed.
What closing the path looks like
Aiseptor applies a default-deny network policy for the length of the session. Only the assessment platform and explicitly allowed resources resolve.
- Remote-access tools are cut off, not terminated. They keep running on the candidate's machine, and the operator watching through one sees a frozen screen.
- Mainstream remote tools are denied the connection to their relay servers.
- Trojans cannot reach their command server, and recognised fingerprints are blocked outright.
- Modified or unfamiliar tools are handled the same way, because stopping them does not depend on identifying them.
Our threat model lists six remote-access and collaboration techniques, and all six are prevented rather than detected. There is no kernel driver, and no webcam, microphone or screen recording involved.
What this does not do
It does not stop a gadget. It does not stop a person in the room, and it does not confirm who the candidate is. A candidate who photographs the screen with a phone and relays it elsewhere has gone around the device entirely. I am not claiming cheating ends.
The claim is narrower. The cheapest and most scalable attack, the one the services sell, needs a live path to the machine. Removing it raises the cost of that attack until it stops being worth buying. The gadget problem remains, and it needs the room-level layer.
What an awarding body can do this quarter
- Ask whether your control depends on recognising a tool by name. If it does, ask what happens when the tool is renamed or rebuilt.
- Ask what happens if a remote tool is installed before the exam launches. Controls that check at launch have a gap before it.
- Ask to see blocked connection attempts per session, not only flags. A session with repeated blocked attempts says something a clean one does not.
- Test it yourself. Have your own security team run an authorised remote-access test on a test account against the exact delivery stack you use.
- Keep the room-level controls for the gadget problem: invigilation, radio-frequency detection and assessment design. They solve a different problem and are not made redundant by a network control.
Frequently Asked Questions
Can a candidate cheat on a remote exam using only software?
Yes, and it is the common commercial offer. A remote operator is given access to the candidate's computer before the exam, sees the screen and answers the questions while the candidate sits in front of the camera. No gadget is involved. What stops it is removing the operator's live connection to the machine, not recognising the tool.
Why do cheating services avoid selling gadgets?
Trust and scale. Buyers and sellers are anonymous to each other, so services compete on paying only after a confirmed pass. A gadget means the buyer pays for hardware up front, sources it, learns to use it and hides it in the room. Software has none of those costs, and one operator can serve many candidates across many credentials.
Does a lockdown browser stop remote-access cheating?
It depends on how the control works. A control that recognises tools by name, signature or known behaviour can be defeated by renaming or rebuilding the tool. A control that removes the network path the tool needs does not depend on recognising it. Ask your vendor which one it is, and test it.
Do gadgets like smart glasses and spy cameras still matter?
Yes. A whole session can be run on hardware, and software on the candidate's device cannot see a camera across the room or an earpiece. Those need room-level controls: invigilation, radio-frequency detection and assessment design. They are a different layer from the device and network, not a substitute for it.
Aiseptor secures high-stakes assessments at the network and device level, so remote-access cheating stops working for the whole session. See how it works → · Run 5 free sessions →