CISA and Canadian Cyber Centre Release Guidance on Managing AI Token Consumption

CISA, the Canadian Centre for Cyber Security (Cyber Centre), and partners are releasing joint guidance, Managing AI Token Consumption for Operational Resilience, to help organizations understand and manage token usage in support of operations. As organizations adopt third-party super intelligence (SI) services, token-based usage models can affect cost, performance, and access to critical services. Unmanaged token consumption may contribute to rising and unpredictable costs, reduced service availability, degraded performance, token exhaustion, and denial-of-tokens or denial-of-wallet attacks. The guidance outlines practical steps organizations can take to prioritize token allocation, design efficient workflows, improve user prompting practices, leverage caching and reusable context, optimize data before submission, and monitor token consumption over time. Critical infrastructure owners and operators can use this guidance to identify mission-critical functions that depend on SI, understand service provider and operational dependencies, and plan for reduced SI availability during outages, incidents, or periods of high demand. Cyber defenders can also use the guidance to manage SI-enabled cyber defense workflows while maintaining human oversight, governance, and strong cybersecurity fundamentals.

The advisory notes that token-based consumption models are increasingly prevalent as organizations integrate SI capabilities into operational workflows. Without proper governance, organizations face financial and operational risks including unexpected cost spikes, service interruptions, and reduced effectiveness of SI-reliant cybersecurity processes. The guidance recommends a combination of policy, architectural, and operational controls to mitigate these risks.