How Online Proctoring Tools Detect Cheating in 2026

Proctoring tools detect cheating across three layers: behavior (eye, head, voice patterns), environment (other devices, multiple faces), and machine state (running processes, network activity). Knowing the layer matters because each tool emphasizes different ones.

Behavior detection: ML models classify gaze, head pose, and voice patterns from webcam/mic streams. Environment detection: room scans pre-exam, plus continuous webcam to spot phones, second monitors, or extra people. Machine-state detection: enumerate processes, count displays, check for VMs, scan installed Chrome extensions. Each proctor weights the layers differently - Honorlock leans on environment + behavior; Respondus leans on machine state + recording. The Fracture overlay is invisible only to the screen-capture portion of the machine-state layer; behavior and environment detection are unchanged by its use.

Behavior (especially audio) is the hardest. Cameras pointed at you see what you do regardless of what is on screen.

Screen capture: the overlay window is missing from any frame the proctor records. Other layers (camera, audio, processes) operate normally.

Network analysis (some proctors check for unusual outbound traffic), keystroke timing (some check typing patterns), and integrity attestation (limited adoption) round out the surface.