The European assessment security landscape is changing fast. Online delivery, increasingly capable artificial intelligence, organised proxy activity, content harvesting and compromised test centres are creating threats that can move faster than traditional controls. This workshop moves beyond a conventional presentation and puts participants inside realistic exam security investigations.

The session starts with a practical foundation for defensible investigations. The presenters will examine the preparations that need to be in place before an incident occurs, how to structure and conduct an investigation, and how to turn findings into proportionate remediation and enforcement. Legal considerations will run throughout, including candidate terms, rights to collect and preserve evidence, data privacy, cooperation obligations and the decisions that affect what an organisation can do when misconduct is suspected.

Participants will then work through three fast-paced, facilitated scenarios. Each begins with limited information, such as a tip, unusual activity or suspicious telemetry. Working in groups, attendees will decide what to investigate, in what order and why. New evidence will then be revealed, requiring each group to reassess its assumptions and choose its next move.