Off-device security threats arise when information or assistance reaches a candidate through equipment or people outside the computer being monitored during an assessment. Tim Burnett's Test Community Network research presentation demonstrates how accessible cameras, phones, auxiliary computers, AI software, wearables, and discreet feedback can combine into a cheating capability. It establishes that these routes are technically possible; it does not establish how often candidates use them. Assessment teams should test the limits of their controls, decide whether unaided performance is essential, and weigh task redesign or controlled delivery against increasingly intrusive monitoring.

An off-device threat is an unauthorised source of information, assistance, recording, or communication that operates beyond the assessment device or its software controls. Examples include a separate camera or screen, an auxiliary phone or computer, a remote helper, a wearable, or a feedback channel that does not interact directly with the monitored device. This differs from on-device misuse, such as opening an unauthorised application in a locked browser. A secure browser can restrict activity on the exam computer while leaving the surrounding environment outside its view. The distinction matters because each route needs a different control and evidence model.

Remote assessment controls often observe only part of the candidate's environment. If questions and answer options are visible on screen, another device or person may support the candidate without producing an obvious signal in browser logs. That creates a gap between evidence that the test software behaved as intended and evidence that the candidate completed the assessment unaided. The TCN presentation is a practical demonstration and expert threat signal. It should prompt threat modelling and testing, not be read as evidence that off-device cheating is widespread or that every remotely delivered test is compromised. Its value is that it gives assessment teams a concrete scenario against which to examine assumptions about webcams, secure browsers, and supplier monitoring claims.

- **On-device control**: a restriction or monitoring measure applied to the computer running the assessment. - **Off-device assistance**: information or help supplied from another device, person, or environment. - **Environmental assurance**: how well an assessment can establish what is happening around the candidate. - **Threat model**: plausible misuse routes, their likelihood and impact, and the controls intended to address them. - **Residual risk**: the risk that remains after controls have been applied. - **Construct**: the capability the assessment is intended to measure, including whether tool use is allowed or part of competent performance.

The TCN presentation shows that off-device assistance can be assembled from accessible technology and can operate outside the monitored exam computer. This supports a practical conclusion for assessment owners and suppliers: test the boundaries of remote controls rather than assuming device lockdown provides environmental assurance. The source also points towards a design response. Where unaided knowledge is essential, programmes may need stronger environmental controls. Where professional practice includes tools, an assessment can make tool use explicit and assess the candidate's judgement. The right choice depends on the construct, stakes, accessibility, and operating context.

The main debate is how to respond to a demonstrated capability without imposing disproportionate checks on every candidate. Stronger room or device controls may address some routes, but they can raise privacy, accessibility, dignity, and operational concerns. Remote delivery may still be appropriate when the task design, threat model, and review arrangements support the intended evidence claim. It is also contested how much confidence organisations should place in vendor claims about AI monitoring, browser lockdown, or data forensics. A system may perform well on activity it can observe while remaining unable to see a separate device or person. Independent scenario testing is needed to understand that boundary.

- **False assurance**: a locked assessment device may be mistaken for a controlled assessment environment. - **Construct mismatch**: monitoring may be strengthened even where the task would be better redesigned around applied judgement. - **Disproportionate surveillance**: room scans and device checks can affect privacy, accessibility, and candidate dignity. - **Unequal conditions**: candidates may have different access to devices, rooms, connectivity, and support. - **Unfair decisions**: ambiguous signals can be treated as proof without human review or an appeal route. - **Supplier overclaiming**: observed on-device performance may be presented as broad integrity assurance.

1. **State the evidence claim.** Define whether the assessment measures unaided recall, supervised performance, or competent use of tools. 2. **Map plausible routes.** Include separate screens, cameras, phones, wearables, helpers, and communication outside the exam computer. 3. **Test controls against scenarios.** Ask internal reviewers or suppliers to show what their controls can and cannot observe. Record the limitations. 4. **Compare design and delivery options.** Consider applied tasks, staged submissions, oral follow-up, permitted tools, controlled centres, and remote monitoring against the same construct. 5. **Use proportionate controls.** Choose the least intrusive approach that provides adequate assurance for the stakes. 6. **Keep decisions reviewable.** Treat monitoring signals as prompts for human review, with clear evidence standards, appeals, and remediation. 7. **Reassess as capability changes.** Update the threat model when tools, delivery arrangements, or evidence of misuse changes.

| Response | What it provides | Main trade-off | When it may fit | |---|---|---|---| | **Secure the assessment device** | Restricts unauthorised activity on the test computer | Leaves the surrounding environment less visible | Device-bound risks are the main concern | | **Add environmental controls** | Improves assurance about the candidate's immediate setting | Adds privacy, access, and operational burden | Unaided performance is essential and stakes justify the burden | | **Redesign the assessment** | Can reduce the value of generic external assistance | Requires new tasks, marking guidance, and validation | Applied judgement or contextual reasoning is part of the construct | | **Permit and assess tool use** | Makes relevant tool use explicit and assessable | Changes criteria and comparability requirements | Tool use reflects real professional practice | | **Move selected assessments to controlled centres** | Provides stronger environmental supervision | Reduces flexibility and increases cost | Residual remote risk is unacceptable for a specific high-stakes decision |

A certification body uses a secure browser and webcam for a remote knowledge test. A structured security review finds that those controls mainly address activity on the assessment computer. The body compares redesigning selected questions around applied judgement, using a controlled centre for the highest-stakes test, and permitting tools while assessing how candidates use them. It documents the evidence claim and remaining risks for each option before changing delivery.

- Tim Burnett's expert presentation demonstrating off-device AI-assisted cheating capabilities and discussing assessment design, delivery, and security. - Overview of device restriction, construct alignment, and the limits of lockdown controls. - Discussion of supervision models, environmental visibility, and remote delivery trade-offs. - Buyer-oriented guide to evaluating supplier claims and control coverage.

Suppliers may offer secure browsers, webcam monitoring, identity checks, device detection, behavioural analytics, or forensic review. These capabilities address different parts of the threat model. Buyers should ask what the product observes, which off-device scenarios it has been tested against, what evidence supports its claims, and how suspected incidents are reviewed. A demonstration helps explain a feature; it is not by itself independent evidence of effectiveness.

### What does off-device cheating mean in an online exam? It means unauthorised help or information reaches a candidate through something outside the computer being monitored, such as another device, a person, or a communication channel. ### Can a secure browser prevent off-device assistance? It can restrict activity on the exam computer, but it cannot by itself establish what is happening elsewhere in the candidate's environment. ### Does the TCN research show that off-device cheating is widespread? No. It demonstrates that particular capabilities can be assembled. It does not measure prevalence across candidates or assessments. ### Should every remote exam move into a test centre? Not automatically. The decision depends on what the assessment must prove, the stakes, the realistic threat model, and whether redesign or permitted tool use can provide better evidence. ### What should I ask a proctoring supplier about off-device threats? Ask which scenarios its controls can observe, what has been independently tested, what remains outside coverage, and how human reviewers handle uncertain signals and appeals. ### How can I reduce off-device risk without intrusive monitoring? Consider redesigning tasks so generic external answers are less useful, using staged or oral evidence where appropriate, and matching stronger environmental controls only to assessments whose stakes justify them.

Tim Burnett (Admin)

`Test Community Network. "Off-device security threats in assessment." TCN AI & Assessment Wiki. Last reviewed 2026-09-28. https://testcommunity.network/knowledge/test-security/wiki/off-device-security-threats.html`

- Primary expert source for the page's account of off-device threats and practical implications. - Context on what device-level controls can and cannot establish. - Context on remote supervision and environmental visibility.