CISA: AI token consumption is becoming an operational resilience issue, and agencies and critical infrastructure should plan for it

The US Cybersecurity and Infrastructure Security Agency (CISA), together with the Canadian Centre for Cyber Security (Cyber Centre) and partners, published the joint guide “Managing AI Token Consumption for Operational Resilience” on Thursday, October 22, 2026. The message is that when an AI service is metered and billed in tokens, consumption is not just an accounting matter: it affects cost, performance and access to services that may support critical operations.

A three-tier governance model

At the heart of the guide is a three-tier governance model aimed at controlling cost and keeping operations reliable. The first tier, “mission-critical”, covers cyber defence, incident response and threat intelligence, with the highest priority for token availability. The second, “operational”, covers core processes such as benefits processing, compliance and policy analysis, with usage monitoring. The third, “productivity”, covers drafting emails, summarising meetings and general research, which may be subject to usage limits or restricted access at times of high demand. Splitting token allocation can raise costs, but it improves resilience and continuity of operations.

A token is a unit of data (text, characters, phrases) that the model uses to read and process language. There are two kinds: input tokens, which the user sends to the model, and output tokens, which the tool produces in its answer. A subset of input tokens is “cached”, which lets the model reuse input from prompts it has already processed. Instead of charging per user or licence, AI services charge by token usage, which makes costs hard to forecast: a simple question consumes hundreds of tokens, while analysing large documents or an automated multi-step process can reach tens of thousands.

Consumption climbs when large texts or images are sent, when extra information and the conversation history are added to the request, when the same data is submitted again and again, and when connected systems pull or process data from several platforms. Agentic workflows, in which AI programs carry out successive steps on their own and each step reprocesses the earlier content, are especially costly. The guide warns that usage will rise rapidly.

Six risks and how to respond

The guide lists six risks: unpredictable cost, limited access to critical services when low-value activity takes up capacity, poor visibility of usage, degraded performance (delays and inconsistent results with very long prompts), token exhaustion and deliberate attacks. Exhaustion happens when an organisation reaches its limits or budget, leading to failed requests or lost access. The guide recommends progressive alerts, with indicative thresholds: informational at 70% of the quota, warning at 80% and critical at 90%.

In denial-of-tokens attacks, perpetrators cause excessive use, through automated prompts or abuse of public AI interfaces, so that quotas run out and legitimate users lose the service. In denial-of-wallet attacks the aim is financial damage, with complex requests that produce long answers or with loops in which the tool’s output is fed back as input.

Practical recommendations include clear prompts with excerpts instead of whole files, caching of repeated content, preprocessing data before submission and choosing a model suited to the task. Smaller or local models from trusted sources, even traditional tools, may be enough. The guide also recommends an AI governance working group with representatives from IT security, finance, legal and operations, human approval for actions with material consequences, several providers so there is a fallback during an outage, and dashboards with alerts. An unusual rise in tokens may indicate a data leak, just as unusual spikes in network traffic do. It also proposes feeding usage data into a SIEM (security information and event management) platform and correlating it with identity, cloud, API and system logs.

Critical infrastructure operators are asked to identify which functions depend on AI and on which providers, to plan how they will operate when AI is less available, because of outages, incidents or high demand, and to maintain capabilities without it, such as manual procedures. AI, the guide stresses, does not replace the fundamentals of cybersecurity or human oversight.

CISA is active on other fronts these days, such as the critical PHP vulnerabilities on which it called for immediate patching with the UK’s NCSC, and the joint SafePay ransomware advisory. The guide is addressed to organisations of every size and sector and recommends that token billing models be understood before any agreement with a provider.