How Proctored Exam Detection Actually Works (Technical Breakdown)
TL;DR
Proctoring software combines screen capture, webcam analytics, process scanning, network monitoring, and behavioral AI. Each layer can be defeated individually; the trick is being invisible to all of them at once. OS-level system overlays are the only category that achieves this.
If you understand how proctoring detection works at the technical level, the right strategy becomes obvious — you don't need to outsmart the AI, you need to never enter the data stream it analyzes.
Layer 1: Screen capture via OS API
Every proctoring tool reads from the operating system's screen-capture API. macOS exposes ScreenCaptureKit; Windows exposes Desktop Duplication. Both APIs return a frame buffer of what the OS considers visible.
The key word is "considers." The OS itself filters out certain UI layers — accessibility cursors, system notification banners, and a category called system overlays that's been part of the platform for a decade. Applications that live in those layers are not included in the buffer.
Layer 2: Webcam video analysis
A live or recorded webcam stream gets fed into a head-pose and gaze-estimation model. The model outputs a per-second score: where is your face pointing, where are your eyes looking, how often does that change.
Glancing at a phone shows up as a downward gaze of several seconds. Looking at a small panel near the exam question on the same screen doesn't — your eyes never leave the screen.
Layer 3: Process scanning
The proctoring app enumerates every running process and compares names, file hashes, and binary signatures against a maintained list of known cheating tools, screen recorders, VMs, and remote-desktop apps.
Tools not on the list — including legitimate developer tools, productivity apps, and the kind of chat client Lockdownify is built as — aren't flagged.
Layer 4: Behavioral signals
Keystroke cadence, mouse movement patterns, time spent on each question, abnormal pasting, and exam-completion timing all feed a behavioral suspicion score.
None of these change when you use an overlay, because the overlay doesn't type, paste, or move your mouse — you do, at your normal rhythm.
Layer 5: Network telemetry
Outbound network connections from the machine are monitored. Traffic to known cheating endpoints is flagged. Traffic to standard cloud-API endpoints (the same ones used by hundreds of productivity apps) is not.
Lockdownify queries Anthropic, OpenAI, and Google AI endpoints — the exact same endpoints used by Notion, Linear, Slack, and a dozen other apps a student might legitimately have running.
Try Lockdownify on your next exam.
100% bypass guarantee on every plan. Refund + exam-fee reimbursement if you ever get flagged.
Sign up nowFrequently asked questions
Why don't proctoring tools just block the OS-level exclusion?
They can't without breaking core OS features like accessibility. Apple and Microsoft both require that proctoring software honor the system-overlay exclusion because thousands of legitimate accessibility tools depend on it.
Could proctoring software take a screenshot using a different API?
Only by escalating to a level of system access neither Apple nor Microsoft will grant to consumer software. The screen-capture API is the only authorized path; system overlays are excluded from it by design.
Will Lockdownify get me caught?
No. Lockdownify is filtered out of every screen-capture pipeline at the operating-system level — before a single pixel is ever encoded. LockDown Browser, Honorlock, Proctorio, Zoom, Teams, and Meet all read the same OS frame buffer, and Lockdownify is excluded from it. We re-test against every major proctoring tool weekly. If you ever do get flagged, we refund your subscription and reimburse the exam fee.
What platforms does Lockdownify support?
macOS 13 Ventura and later, and Windows 10 and 11. Both desktop apps ship today.
How much does it cost?
$40/month or $28/month if you pay annually (save 30%). One plan unlocks every model — Claude Opus 4.7, GPT-5, and Gemini 3.1 Pro — unlimited questions, unlimited screenshots, and the 100% bypass guarantee. Cancel anytime.
Keep reading