How do you decide what behavior counts as “cheating”?

The institution will dictate what type of behavior it wants to monitor over the course of the exam. Exam administrators/proctors will then review exam attempts to determine whether any flagged behavior was truly infringing on the integrity of the exam.