Proctor Compatibility
Examplify and AI overlays, a technical breakdown
An honest, technical look at how ExamSoft Examplify locks down macOS, what its kernel-level monitoring can actually see, and how the Whisply overlay behaves on Pro Undetected.
Examplify is a lockdown app that quits unapproved processes, blocks screenshots, and watches for foreground changes. Whisply Pro Undetected runs as a system overlay that stays out of Examplify's captured frame.
- Examplify is ExamSoft's kernel-assisted lockdown app that quits unapproved processes and blocks screenshot APIs while a secure exam is loaded.
- Whisply Pro Undetected runs the overlay as a system-level window with content protection, so it stays out of Examplify's screen capture path.
- Pro Undetected ships with an armed Examplify mode. Limits still apply on managed devices, fresh OS builds, and admin-locked Macs.
Examplify on macOS installs a launch daemon and uses a kernel extension on older builds (a System Extension on Ventura and later) to enforce its allow-list. That is why a stock screen recorder fails under it, and why overlay isolation has to happen at the window-server layer, not the app layer.
How Examplify detects external apps
Examplify enters Secure mode by loading a macOS System Extension that intercepts the screenshot key combinations, hides the Dock, disables Mission Control, and blocks Cmd+Tab. A launch daemon polls the running process list against an internal block-list of screen recorders, remote-desktop apps, virtual cameras, and known overlay tools. The app queries CGGetActiveDisplayList to refuse second monitors, asks the system for installed Extensions to refuse competing capture utilities, and watches active-application changes through a private NSWorkspace notification. Screen captures requested by other apps return blank for the Examplify window itself, and any attempt to read its window list via CGWindowListCopyWindowInfo is filtered.
How Whisply’s overlay isolation works
Whisply's overlay is an NSPanel created above the standard window stack with NSWindowSharingNone enabled, the same macOS content-protection flag Apple uses for DRM video and 1Password uses for autofill popovers. The WindowServer excludes that surface from every screen capture path, including ScreenCaptureKit, CGDisplayCreateImage, and the screenshot shortcuts Examplify intercepts. The menu-bar agent runs under a generic process name signed by Whisply Inc., and Pro Undetected's armed Examplify mode adjusts process metadata before launch. Cmd+Return summons the overlay through an event tap that does not steal foreground focus, so Examplify's active-application watcher sees no switch event.
What Examplify actually is
Examplify is the desktop client for ExamSoft, a testing platform used by law schools, medical boards, nursing programs, pharmacy boards, and a growing list of professional licensure bodies. The app downloads an encrypted exam file ahead of time, then runs the test offline in a hardened window that takes over the Mac. When you launch a secure exam, Examplify checks the running process list, asks macOS for a list of installed System Extensions, and refuses to start if it finds anything on its block-list.
The product has been around since the early 2010s and has gone through several detection generations. The current macOS build (versions in the 3.x line, with regular point releases) ships a System Extension, a launch daemon, and a privileged helper. It runs on Apple Silicon natively and on Intel under Rosetta only for legacy versions. ExamSoft publishes minimum requirements at examsoft.com and updates them every academic cycle, which is why a Mac that worked last semester sometimes stops working in August.
Examplify is one of the strictest lockdown apps in active use. It is more aggressive than a browser-based proctor like Honorlock and roughly comparable to Meazure Learning's older SofTest client on the legacy lockdown spectrum. It does not record video of you. It does not watch your face. It locks the machine.
What it watches for on macOS
When a secure exam is loaded, Examplify enters what its docs call Secure mode. The Dock is hidden, Mission Control is disabled, Cmd+Tab is intercepted, Cmd+Q on the Examplify window is blocked, and Cmd+Shift+3 through Cmd+Shift+6 (the system screenshot shortcuts) are caught by the System Extension and dropped before they reach the WindowServer. The app polls for running processes on a short interval and maintains an internal block-list of known screen recorders, virtual cameras, remote desktop tools, and second-monitor utilities.
It also asks macOS for the list of connected displays. A second monitor will usually cause Examplify to refuse to start. Bluetooth keyboards are allowed, but some exam templates disable them. Voice Control and Dictation are blocked by the System Extension. Sidecar and Universal Control are detected and rejected. AirPlay receiving is shut down for the duration of the exam.
What Examplify does not do is interesting. It is offline-first. The exam runs without an active internet connection for the duration of the test, and answers are uploaded after submission. There is no live human proctor, no camera feed, and no AI behavior analysis on the candidate's face. The threat model is the machine, not the human.
Where AI overlays usually fail
Most consumer AI overlay apps are built as standard Cocoa windows. They show up in the WindowServer's window list at a normal layer, they appear in screenshots, and they get caught by any app that calls CGDisplayCreateImage or the newer ScreenCaptureKit APIs. That is why a basic Electron AI assistant gets picked up by Examplify on launch, or shows up as a black rectangle the first time the exam tries to capture state.
A second class of overlay tries to hide by registering as a system service or a menu bar agent. That gets past visual capture but trips Examplify's process scanner, because the binary signature or bundle ID is on the block-list. Apps that ship under their literal product name with a known developer cert tend to get added to that list within a release cycle or two.
The third failure mode is the foreground-switch problem. Examplify watches for the active application changing. An overlay that steals focus the moment you press its hotkey causes Examplify to flag the event in its local log. On some exam configurations, that log gets reviewed after submission and can trigger an integrity inquiry even if the overlay itself was never captured visually.
How Whisply is built differently
Whisply is not a Cocoa window in a standard layer. The overlay is created as an NSPanel above the normal window stack with NSWindowSharingNone set, which is the macOS API for telling the WindowServer to exclude this surface from screen captures and screen recordings. That same flag is what Apple uses for its own DRM-protected video frames and what 1Password uses for its autofill popovers. Examplify's screenshot interception and its capture-based health checks see a blank region where the overlay sits.
The Whisply menu-bar agent runs under a generic process name, signed by Whisply Inc., and the Pro Undetected build ships an armed mode that adjusts the process metadata before launch. Cmd+Return summons the overlay without stealing keyboard focus from the foreground app, which means Examplify's active-application watcher does not see a switch event. The overlay accepts mouse and trackpad input through a separate event tap that does not register as a foreground transition.
None of this is magic. It is the same content-protection plumbing macOS exposes to any developer who reads the AppKit headers. The work was in wiring it together so the overlay stays useful (still scrollable, still typable, still hearing audio through CoreAudio) while remaining invisible to the capture pipeline.
What Pro Undetected adds for Examplify specifically
Pro Undetected includes a per-proctor armed mode. When Whisply detects Examplify is foreground (it reads the bundle ID, same as any other Mac app), it switches the overlay into a stricter posture. The summoning hotkey shortens its window of visibility, the audio capture path moves to a lower-priority CoreAudio tap that does not register as an aggregator device, and the menu-bar icon is hidden so a proctor reviewing a post-exam screenshot of the menu bar sees nothing unusual.
The Pro Undetected tier is $149.99 a month or $44.99 a month annual. It also adds Computer Use (the agentic mode that can act on the Mac on your behalf), the proctor whitelist (LockDown Browser, Safe Exam Browser, OnVUE, Prometric, Honorlock, Proctorio, Inspera, Meazure, Examity, Kryterion, NBME, Gradescope, and others), and lifted message limits.
Examplify is included in the standard Pro Undetected whitelist. There is no extra fee for it. The $500 one-time whitelist tier covers a smaller set of high-friction systems (TestNav, ACT, Edvistas) that need separate engineering work per release.
Honest limits
Whisply works on the Mac you own, the OS build you control, and the account you log in to. On a school-managed Mac with MDM profiles, an IT department can install configuration profiles that block third-party System Extensions, force-quit unsigned background agents, or require Examplify to run under a managed account that cannot install new apps. Whisply cannot work around an MDM lock and we do not pretend to. If the Mac is not yours, this conversation is different.
Fresh macOS releases can change the rules. When Apple shipped the ScreenCaptureKit revision in macOS 15, several content-protection edge cases moved. We test against the current Examplify release on the current macOS, but a point release of either side can require a Whisply update. Pro Undetected includes the updates. Free and Pro do not include the armed Examplify mode at all.
Finally, no overlay is invisible to a human in the room. Whisply hides from software capture. It does not hide from a person walking behind you, a webcam pointed at your screen, or a phone propped against your monitor. If the testing environment is in-person and physically observed, the overlay's window-isolation does nothing useful for you.
Compatibility matrix
| Scenario | Whisply behavior |
|---|---|
| Examplify in Secure mode, mid-exam, Whisply overlay summoned via Cmd+Return | Overlay renders on top of the Examplify window. Examplify's screen-capture health checks see a blank region. Foreground focus stays with Examplify, no active-application switch event fires. |
| Examplify launching a new secure exam with Whisply already running in the menu bar | On Pro Undetected with armed Examplify mode, the menu-bar icon hides and the process metadata is adjusted before Examplify's process scan runs. On Free or Pro, the standard process name may be flagged. |
| Cmd+Shift+5 screenshot tool used during an Examplify exam | The system screenshot shortcuts are intercepted by Examplify's System Extension and dropped before reaching the WindowServer. This is an Examplify behavior, not a Whisply one. Whisply has no involvement. |
| Examplify offline mode with no internet connection | Whisply requires internet for model calls. If Examplify is running fully offline (which is its default for the exam itself), the overlay can be summoned but will show a connectivity error when you send a message until you regain a network path. |
| Second monitor connected with Examplify trying to start | Examplify refuses to start with a second display attached. This is unrelated to Whisply. Disconnect the second monitor or use the built-in display only, regardless of whether Whisply is installed. |
| School-managed Mac with MDM profiles installed by IT | Managed Macs can block third-party System Extensions, force-quit background agents, and restrict app installation. Whisply cannot work around an MDM lock. Run it on a personal Mac instead. |
| Examplify on macOS 15 or newer with the latest ScreenCaptureKit revision | NSWindowSharingNone continues to honor exclusion in current macOS. Whisply is tested against the current Examplify and current macOS pairing each release. Pro Undetected includes the updates automatically. |
| Examplify post-exam upload phase, exam window closed | Once Secure mode exits, the Mac returns to a normal state. Whisply operates as it does in any other context. Cmd+Tab, screenshots, and second monitors all work again. |
A note on academic honesty
This page exists because students and licensure candidates ask honest technical questions about how their Mac behaves under Examplify, and they deserve honest answers. The questions are not the same as the conduct. Using Whisply during a closed-book exam where outside resources are prohibited is your decision and your responsibility, and the consequences (academic, professional, licensure) sit with you alone. Examplify is most common for bar exams, medical boards, and graded coursework where the rules are explicit. Whisply does not endorse breaking those rules. We publish technical detail because pretending the Mac is a mystery does not help anyone.
Related questions
Can I use an ai overlay with examplify on my Mac?
Yes, on Pro Undetected. The overlay is created with NSWindowSharingNone, so Examplify's screen-capture health checks and the screenshot shortcuts it intercepts see a blank region where the overlay sits. The menu-bar agent runs under a generic signed process name, and armed Examplify mode adjusts metadata before launch to stay out of the process block-list. Free and Pro do not include the armed mode and are not recommended under Examplify.
Does Examplify record my camera or microphone?
No. Examplify is a lockdown app, not a remote proctoring service. It does not capture video of your face, audio of your voice, or behavior analytics. The threat model is the state of the Mac during the exam: running processes, screen captures, second monitors, and foreground app changes. If your program pairs Examplify with a separate remote proctor (some bar exams do), that proctor is a different product with its own page on this site.
Will Examplify show that another app was running?
Examplify keeps a local log of foreground-application transitions and process changes during Secure mode. On Pro Undetected, Whisply summons the overlay through an event tap that does not register as a foreground switch, so the log does not see an application transition. The overlay process itself runs under a generic name and is hidden from the menu bar in armed mode.
Does it work on Examplify for bar exams?
Bar exam administrations vary by state. The Examplify client behavior is the same one we test against. The administration environment is not. Most state bar exams are in-person, physically proctored events, which means a human in the room can see your screen regardless of how the overlay is rendered. Window isolation does nothing against a person standing behind you. For remote bar administrations that use Examplify alone without a separate live proctor, the overlay behaves as described above.
What happens if Examplify or macOS updates?
We test each Examplify point release against the current macOS and ship a Whisply update if anything needs to change. Pro Undetected includes those updates automatically. If you are mid-exam season, leaving auto-update on is the safer choice. A new macOS major version sometimes requires a few days of work on our side before we recommend it.
Why does my school's IT-managed Mac refuse to install Whisply?
Managed Macs with MDM profiles can block third-party System Extensions, restrict installations to an approved list, and prevent background agents from running. Whisply cannot work around an MDM lock and we do not try. If you are on a school-issued machine, use a personal Mac for anything you install yourself.
Is Whisply guaranteed to stay private during Examplify?
No. We do not promise undetectability as a guarantee, and you should be suspicious of any product that does. The macOS APIs we rely on (NSWindowSharingNone, event taps, content protection) are stable Apple-supported surfaces, and we test against the current Examplify release. A new Examplify revision, a new macOS build, a managed device, a fresh proctor capability, or simply a person looking at your screen can change the picture. Treat this as a technical breakdown, not a warranty.
Try Whisply free.
Mac only. macOS 13 or later. No bot in your calls.