On 3 May, more than two million students sat NEET-UG, India’s single national entrance exam for undergraduate medical admission. Within days, investigators found the paper had been compromised; it was not stolen off a truck or hacked from a server, but rather reconstructed from memory by examiners with authorised access and passed on in person to small groups of coached students.(Sign up for THEdge, The Hindu’s weekly education newsletter.)The exam was cancelled, re-sat seven weeks later under heavy security, and results were finally out in mid-July. Since then, a chargesheet has been filed, the education minister has resigned, and the government has appointed a high-powered task force to recommend technology-driven reforms to the exam system. The Centre has since told the Supreme Court that a multi-layered security architecture is now in place and that a shift to computer-based testing is under active consideration, with the task force due to report within three months.Join THEdge LinkedIn groupNone of that, though, is really the part that matters for the next exam.Measurement science rests on one idea: a test score only means what it claims to mean if the conditions that produced it were sound and it is used explicitly for the purpose intended. The NEET-UG score is meant to indicate that a student has the pre-requisite skills to successfully study medicine. Their entry into the programme is then determined by how their score is ranked against every other candidate sitting the same test under identical conditions. The integrity (validity) of the exam and selection process is contingent upon the standardisation of the process.For example, it depends on all students having equal access to the exam and nobody seeing the questions before sitting the exam. Break that condition, and the score no longer carries the meaning it was intended to convey, not just for students who had early access, but for everyone who sat the exam. Validity is not only about whether a score reflects what it claims to measure. It is also about what happens once that score is used - a lost year, a second exam taken under intense pressure, families paying for re-coaching they cannot afford. Researchers and practitioners in the assessment field call this consequential validity (or the unintended aftereffects of the exam), and, by their own account, it is one of the most under-examined parts of the study of validity. It deserves more weight than it usually gets when we talk about the validity of the exam process.The wrong vulnerabilityThis was not an ordinary breach in security. It happened inside the exam construction process, not outside of it - reconstructed from memory by people with legitimate access to the content, not stolen by an outsider. That distinction matters, because it points to a different weakness than the one most of the proposed response addresses. Tighter invigilation, air-transported papers, a blocked messaging app - all of these are designed to strengthen the exam against outside interference. They do little about addressing the risk that starts within the exam construction process, among people who see the content before anyone else does.Two design features made this failure as damaging as it was. One national paper, sat on one day, means one point of compromise is a significant threat to the validity of the entire exam. Large-scale testing programmes on this scale usually mitigate that risk by rotating the order of items in the test, utilising multiple equated forms, sometimes providing on-demand delivery - so a single breach doesn’t force a mass cancellation. A cancel-and-retest response creates its own problems: two papers, sat on alternate dates, raise the issue of validity when there is no a priori evidence that the two result sets are comparable. That is, announcing a retest does not necessarily resolve the basic issue of comparability between the two sets of results.There is also a further, more challenging fairness issue. NEET exists because the previous system of entry enabled those with resources (money to buy a medical seat) through the utilisation of management quotas and capitation fees. The network behind this breach charged families between ₹2 lakh and ₹15 lakh for early access to the questions. That is the same unfairness the NEET exam is intended to address. So after constructing an exam to minimise unfairness and inequity that existed in the process of competitive entry into the medical program, the exam itself failed in its aim (it is a test with relatively low validity and significant consequences for the system and for students).Beyond digital fixesThe planned move to computer-based testing from 2027 is being widely seen as the solution. It may help, but it changes how the exam is delivered, not the parts of the process that failed this year. China’s Gaokao, sat by some 13 million students, has stayed largely pen-and-paper despite far more advanced digital infrastructure than India’s, for close to the same reason India held off for years: an exam this large and this consequential is a hard one to move without creating new failure points of its own.A misconfigured setting on the digital SAT in the United States last year auto-submitted thousands of students’ tests early. India’s own CUET-UG has had repeated server and connectivity problems. None of this argues against computer-based testing. It argues that a secure item bank, which is a centralised repository of test questions and a defensible standard-setting process must be the foundation needed for quality assessments. Introducing digital delivery without those foundations just moves the same vulnerabilities onto a new platform and adds some of its own.This is not the first time a leak has produced a reform commitment. The 2024 NEET controversy led to its own committee and review. The pattern each time has been the same: harden security after the fact, promise structural change, move on. What hasn’t changed is the underlying design - a single, high-stakes national sitting with no redundancy built into it. A task force, however well-resourced, inherits that design unless it chooses to change it.Designing trustSome of the reform proposals now circulating call for exactly this kind of redundancy - dynamic, algorithmically calibrated item banks and multiple testing windows, closer to how the GRE works. That is a worthwhile idea, that should be taken seriously. But it has to be acknowledged that it is challenging to implement, in a relatively short time, in a program as high stakes and visible as NEET. Calibrating a live item bank across multiple languages, not just in English, is indeed a challenge and failure would be a disaster. Multiple testing windows mean solving comparability issues across every window, not just two. And a bigger, more distributed item bank is a bigger, more distributed set of people with access to unreleased content - a larger, not smaller, version of the exact insider-risk problem that this year’s breach exposed. None of that is a reason not to attempt it. It is the reason it needs to be built by people who understand what can go wrong in the attempt, not just what it looks like when it works.We are not writing this article as people who run testing programmes for governments, and it is not our place to hand India a fix. But a few design choices recur across large testing systems that manage this problem well: item banking and rotation, so no single form carries all the risk; logged, individually attributable access to content during development, so that a breach can be traced quickly rather than treated as one diffuse failure; formal equating procedures, so multiple forms are defensible against exactly the kind of challenge a cancel-and-retest invites; and a permanent, technically qualified core staff, since institutional memory is hard to sustain on short-term contracts. None of this is free.Item banking and computer-based delivery work best where digital access and infrastructure are even, and in India they are not - rural candidates, first-generation test-takers, and students assessed in regional languages carry the disadvantage of a poorly implemented version of exactly the system meant to fix this. That is not an argument against reform. It is a reason the reform must be designed and tailored to the students for whom it is intended rather than be post hoc adjusted to fit their needs at the end.The harder questionThis is all standard practice used by agencies worldwide for large-scale licensure and admissions tests, as documented in international literature on test security and validity. The unique aspect is not scale alone: no other country conducts a single exam so consequential for so many candidates in one sitting, under this much competitive pressure for so few available seats.That pressure does not begin at NEET. It builds through a school system where marks carry outsized weight from an early age, and NEET is simply the last and most consequential point in that chain. A better-designed, more secure exam can make that final gate fairer. It cannot, on its own, change what drives so much anxiety into a single day - that is a separate, harder problem, and a longer one to solve.That scale provides the opportunity for success. Get the design right, and the NTA would be operating at a level of functionality that few institutions in the world have been able to accommodate. A task force can order better security. It cannot, on its own, decide whether the exam is built well enough to be trusted again. That comes down to the item bank, the standard-setting, and how many forms a single result has to answer for. After two committees, two leaks, and one resignation, the question is no longer whether reform has been promised. It is whether this one changes those things, or just tightens the lock on the same door.(Pooja Nagpal is a Ph.D. candidate at the Centre for Educational Measurement and Assessment, University of Sydney, and has worked on assessment programs in India with NCERT and CBSE. Professor Jim Tognolini is Director of the Centre for Educational Measurement and Assessment at the University of Sydney and previously helped establish the Government of India’s assessment centre under CBSE)