Proctoring for Technical Recruiting: Defending Engineering Integrity in 2026
Most technical-interview cheating your proctoring flags still gets through, and the invisible overlays it never sees. Here's how network-layer security closes the gap without a kernel driver.
48% of technical candidates were flagged for AI assistance across 19,368 live interviews, and 61% of those flagged candidates would still have advanced past the hiring bar undetected, according to Fabric's 2026 State of AI Interview Cheating report. Separately, proctored coding-assessment fraud more than doubled in a year, from 16% to 35%, per CodeSignal. The problem isn't that candidates are cheating. It's that most of the cheating your current tooling flags still gets through, and most of it it never sees at all.
The reason is architectural. The interview co-pilots candidates use now, tools like Cluely and Interview Coder, don't run inside the browser your proctoring tool watches. They run as separate OS-level processes the browser has no permission to see. Here's why that gap exists and what a network-layer defense actually does about it.
Key Takeaways
- Invisible AI overlays render answers on a layer marked excluded from screen capture, so a browser-based or screen-recording proctor never sees them. They're a separate process, not a browser event.
- On-device LLMs make no outbound call to a known AI provider, so network keyword filters miss them. Catching them takes OS-level signals: GPU memory deltas, active inference processes, model files on disk.
- Network-layer enforcement closes the gap by controlling what the candidate's device can reach during the assessment, rather than trying to watch the candidate more closely.
- Aiseptor integrates via REST API with no permanent agent and no kernel driver, and runs alongside your existing ATS or coding platform rather than replacing it.
Why Invisible Assistants Beat Legacy Proctoring
A browser is sandboxed by design. It can't enumerate other processes, read the network stack, or query hardware state, restrictions that exist to protect users from malicious websites. That same boundary is what makes browser-based proctoring blind to the tools candidates use in interviews now.
Invisible AI Overlays
An invisible AI overlay like Cluely or Interview Coder renders a transparent layer above the candidate's IDE and marks it excluded from screen-capture APIs. It never touches the browser's DOM and never appears in a screen recording, so a tool watching either surface has nothing to flag. The overlay isn't hiding from your proctor specifically; it's invisible to anything reading the frame buffer. Detecting it requires operating at the OS layer where the overlay actually runs.
On-Device LLMs
A language model running locally on the candidate's machine (Ollama, LM Studio, a custom inference binary) makes no request to a known AI provider, so a network filter watching for calls to OpenAI or Anthropic sees nothing. This is the case that trips up tools claiming to block "AI traffic" by keyword. Catching a local model takes OS-level signals instead: active inference processes, GPU VRAM deltas consistent with a loaded model, and model files present on disk.
What Network-Layer Enforcement Does Instead
Rather than trying to name-match these tools, which loses to a renamed binary or an open-source fork within the hour, network-layer exam security enforces a default-deny policy on the candidate's device for the duration of the assessment: only the assessment platform and the resources it explicitly allows are reachable. Cloud AI endpoints, remote-access relays, and second-device pivots that route through the primary machine fail to resolve, regardless of what a tool calls itself. Local models are caught by the OS-level signals above, not the network.
The enclave doing this is ephemeral. It deploys in about 30 seconds, requires no kernel driver, and removes itself completely when the session ends, with nothing left on the candidate's machine. Aiseptor collects network-access signals and device-activity metadata, not webcam, microphone, or keystroke data, with a default 24-hour retention window. That matters for recruiting specifically: senior engineers routinely refuse to install invasive, permanent proctoring software on personal machines, and this model asks them to install nothing that outlasts the interview.
Fitting It Into a Hiring Stack
Integration is a REST API call from your existing ATS or coding-assessment platform. You create a session with a single authenticated POST /api/v1/sessions, redirect the candidate to the URL you get back, and receive HMAC-signed webhooks as the session progresses, including the integrity verdict at the end. There's no polling and no change to your existing interview UI. See the developer quickstart for the exact request and response fields; most integrations are running in production in under a business day.
This is a security layer for technical interviews, not a replacement for identity verification. Those tools remain the right layer for confirming who is sitting the interview. Aiseptor covers the layer underneath, the device and network surface where invisible overlays and on-device LLMs operate. Pricing is usage-based and billed per session, with no long-term licensing commitment, and the first 5 sessions are free.
For the earlier framework this builds on, see preventing technical interview cheating, or request free access to test it against your own interview flow.
Frequently Asked Questions
Can candidates still use ChatGPT on a second device?
Aiseptor's network policy applies across every interface on the candidate's primary device, so a phone tethered as a hotspot doesn't create an unmonitored path off the interview. A fully separate second device on its own cellular connection is a hardware pivot no network policy on the primary machine can block; that vector is lower-bandwidth and is best addressed alongside the identity verification Aiseptor runs beside, not instead of.
Does Aiseptor require candidates to install permanent software or kernel drivers?
No. The security enclave is session-scoped and requires no kernel driver. It activates when the interview starts and removes itself completely once it ends, with nothing persistent left on the device.
How does Aiseptor detect "invisible" AI overlays that don't show up in screen recordings?
By operating at the OS layer where these tools run. An overlay like Cluely stays hidden by marking its layer excluded from screen capture, so Aiseptor targets that technique, and the network path a cloud-based overlay needs to reach its backend, rather than matching a specific process name.
Is network-layer proctoring compliant with privacy regulations like GDPR?
Aiseptor is GDPR- and CCPA-compliant by design. It collects network-access signals and device-activity metadata only, with no webcam, microphone, or keystroke logging, and a default 24-hour retention window, which avoids the biometric and environmental recordings that create most proctoring compliance risk.
Can Aiseptor integrate with our existing ATS or coding assessment platform?
Yes. It's built as a modular layer that integrates via REST API, so hiring teams can add it without replacing their assessment platform or changing the candidate experience.
Frequently Asked Questions
Can candidates still use ChatGPT on a second device?
Aiseptor's network policy applies across every interface on the candidate's primary device, so a phone tethered as a hotspot doesn't create an unmonitored path off the interview. A fully separate second device on its own cellular connection is a hardware pivot no network policy on the primary machine can block; that vector is lower-bandwidth and is best addressed alongside the identity verification Aiseptor runs beside, not instead of.
Does Aiseptor require candidates to install permanent software or kernel drivers?
No. The security enclave is session-scoped and requires no kernel driver. It activates when the interview starts and removes itself completely once it ends, with nothing persistent left on the device.
How does Aiseptor detect "invisible" AI overlays that don't show up in screen recordings?
By operating at the OS layer where these tools run. An overlay like Cluely stays hidden by marking its layer excluded from screen capture, so Aiseptor targets that technique, and the network path a cloud-based overlay needs to reach its backend, rather than matching a specific process name.
Is network-layer proctoring compliant with privacy regulations like GDPR?
Aiseptor is GDPR- and CCPA-compliant by design. It collects network-access signals and device-activity metadata only, with no webcam, microphone, or keystroke logging, and a default 24-hour retention window, which avoids the biometric and environmental recordings that create most proctoring compliance risk.
Can Aiseptor integrate with our existing ATS or coding assessment platform?
Yes. It's built as a modular layer that integrates via REST API, so hiring teams can add it without replacing their assessment platform or changing the candidate experience.