As Test Takers Turn to AI for Answers, Exam Security Must Catch Up
It’s hard to detect whether someone is using artificial intelligence (AI) to cheat on IT certification exams, but new tools and processes are emerging to boost trust.
Certifications play a critical role in keeping up with the latest industry metamorphosis, but artificial intelligence (AI) is now muddying the verification process.
From Meta Glasses to AI browsers and deepfakes, exam administrators face a growing list of risks to monitor — and organizations need to know that the person they hired can actually do what their certification says they can.
Score legitimacy has become harder to assess as test takers use AI to fill in the blanks. As a result, the industry is shifting toward more in-person testing and stricter fraud-detection protocols to keep certifications credible.
Certifications range from entry-level cloud and cybersecurity knowledge and cover Google, Microsoft, and Amazon Web Services updates. In some industries, like government, banking, and financial services, certified IT departments are required to stay current on compliance regulations.
Cheating is a risk that has existed for as long as testing has. But AI has significantly changed the testing game for IT certification, explains Marielle Carlos, data forensics scientist at Caveon.
Traditional threats, like harvesting pre-knowledge, plagiarism, or collusion proxy testing, have evolved as people use AI as an unauthorized aid, she says, and it has become an incredibly challenging problem.
However, the problem is still in its infancy stage — so much so that Caveon added a new category to its testing security threats taxonomy: unknown.
“It makes it hard to know if your exam is measuring actual competence or if it’s measuring someone’s ability to use AI to answer the question,” Carlos tells Dark Reading. “It really challenges the usefulness of that exam.”
Red Flag: When Speed and Score Don’t Add Up
Carlos spends her day interpreting test results to help programs decide whether anomalies warrant any additional attention or professional review. Over the past two years, she has seen how AI has changed the way certification programs monitor metrics to assess cheating. Previously, it may have been enough to look at speed and score separately to flag a case for review. Now attention has shifted, as administrators take numerous variables into account since AI can combine multiple cheating tactics.
During her research, Carlos noted a “huge boom of people” who are testing fast and receiving high scores. No concrete data exists that says it’s all due to AI, but there is enough organizational interest and concern over that trend’s growth that Carlos says she and her team will look at it more.
But uncertainty hasn’t stopped other organizations from taking action. Widespread irregular exam results and verified cheating attempts discovered during ISC2’s online proctoring pilots led the nonprofit to require in-person testing, says Casey Marks, chief operating officer at ISC2. The consortium also implemented “the most stringent security protocols available to analyze each result and detect irregularities,” including biometric and identity verification.
The testing environment mirrors the most stringent conditions used by licensed professions, such as doctors, to provide the highest security available in the industry, Marks says. Regarding AI use, the fact that ISC2 is exclusively a test-center based for all exams ensures no access to outside resources or technology during exam administration, he adds.
“The candidate, the employer, and every other professional holding that credential depend on the credibility of the process,” Marks tells Dark Reading.
‘AI Can’t Replace Human Judgment’
Regardless of AI introducing new risks, certifications remain one of the most universal ways for employers to validate a candidate’s necessary knowledge and skills when making hiring or promotion decisions, Marks adds.
Carlos agrees but urges programs to have conversations around protecting score validity across the entire process.
“That includes secure exam design, control during administration, analysis of results, and a clear process for responding to your security concerns,” Carlos adds.
A layered approach is crucial because while there are “tools to indicate possible AI use, it’s hard to pinpoint exactly.” Carlos points to research by Sarah Toton, director of data forensics at Caveon, as an example. Toton conducted an experiment comparing AI and human test taking based on test results and response patterns.
“She has seen some distinct differences in response timing. When someone uses AI, they’re often six to 48 times faster compared to an individual test taker,” she explains. “That said, AI can get some things wrong sometimes, particularly the questions that involve some realm of human judgment.”
Use AI, Just Not During Tests
In an ironic twist, the same technology people use to cheat on exams is also becoming one of the most in-demand certifications employers rely on to validate real skills.
Many certifications, like ISC2’s Certified Information Systems Security Professional (CISSP), have and continue to evolve to address how AI is impacting security best practices, Marks says. That’s in addition to new AI-specific security certifications that are also entering the market.
For example, the Computing Technology Industry Association launched SecAI+ to help organizations secure, govern, and responsibly integrate AI into their cybersecurity operations.
“As certifications evolve, especially with AI now playing a key role in so many facets of our work, the value of certifications for employers is increasing,” Marks adds.
Read more about:
Originally published on Dark Reading
