Managing AI token consumption: what CISA, Cyber Centre and ASD ACSC advise

What the agencies published

CISA's publication page, dated October 22, 2026, says that CISA, the Canadian Centre for Cyber Security (Cyber Centre), and partners are releasing joint guidance titled Managing AI Token Consumption for Operational Resilience.

This explainer answers one question. What do CISA, the Cyber Centre and the Australian Signals Directorate's Australian Cyber Security Centre (ASD ACSC) advise security leaders to do about AI token consumption as an operational resilience and availability risk? The CISA page is a short announcement, so most of the detail below comes from the longer Cyber Centre and ASD ACSC pages. Where a point appears in both of those pages, this guide attributes it to both. Where only one page carries the wording, the guide says so. Dates in this guide are those CISA gives.

Why token use is an availability risk

CISA's page says that as organizations adopt third-party "super intelligence (SI)" services, token-based usage models can affect cost, performance, and access to critical services.

CISA also says unmanaged token consumption may contribute to rising and unpredictable costs, reduced service availability, degraded performance, token exhaustion, and denial-of-tokens or denial-of-wallet attacks.

The Cyber Centre and ASD ACSC texts explain the cost side first. They say organizations pay for AI services based on usage measured in tokens, instead of per user or licence. They add that this pricing can be harder to predict and manage, because consumption varies with the length of prompts and responses, the context given to the model and the AI capabilities used.

The availability side is token exhaustion. Both texts say it can occur when an organization reaches its allocated token limits, usage quotas, rate limits, or budget thresholds, and that this may result from legitimate high-volume use, poorly optimized applications, or an unexpected increase in demand. They also say users and systems may then experience delays, degraded performance, failed requests, or loss of access to AI capabilities, and that organizations relying on AI-enabled services for operational or mission-critical functions may be particularly affected if contingency measures are not in place.

The texts also describe two deliberate attacks. A denial-of-tokens attack, they say, is a resource-consumption attack in which threat actors intentionally generate excessive AI usage to exhaust token allocations, consume budgets and resources, or trigger rate limits, using automated prompts, abuse of publicly accessible AI interfaces or tools, or manipulation of AI-enabled workflows.

Denial-of-wallet attacks, the texts say, aim to cause organizations financial harm by exploiting consumption-based, usage-based and pay-per-use pricing models to increase costs.

Prioritising tokens and planning for outages

The Cyber Centre and ASD ACSC texts say that, to control AI costs and maintain reliable operations, the authoring agencies recommend a tiered governance model. The three tiers follow.

For Tier 1, mission critical, the texts name high-priority functions such as cyber defence, incident response and threat intelligence, and say these services should receive the highest priority for token availability and operational continuity. For Tier 2, operational, they name essential business processes such as benefits processing, compliance activities and policy analysis.

For Tier 3, productivity, the texts name everyday activities such as drafting emails, summarizing meetings and doing general research. They say these lower-priority activities may be subject to usage limits or reduced access during periods of high demand.

For critical infrastructure organizations, the Cyber Centre text says they should plan for reduced AI availability during outages, incidents or periods of high demand. It also says they should consider how emergencies or heightened threat activity could increase AI usage demands, and integrate AI usage into broader organizational continuity planning.

The ASD ACSC text also says these organizations should maintain non-AI capabilities, such as previous digital automation controller processes or manual operations training, in case the AI becomes unavailable or untrustworthy.

Monitoring token use as a security signal

The monitoring actions in the longer texts are set out below.

As an example of progressive alerting for impending token exhaustion, the Cyber Centre text describes an information-only alert at 70% of the token usage quota, a warning at 80% and a critical alert at 90%.

Both longer texts list establishing token usage baselines and forecasting practices to support budgeting and capacity planning, and implementing usage alerts to identify unusual token consumption or approaching usage limits.

They also say to monitor unusual increases in token consumption as a potential indicator of data exfiltration, similar to how abnormal bandwidth spikes can signal unauthorized data transfers. In the same list they say to feed AI token telemetry into a security information and event management platform and correlate it with identity, cloud, API and system logs.

Governance, suppliers and fallback

For governance, the texts list establishing an AI governance working group that includes IT security, finance, legal, and operational stakeholders, and conducting an AI workload assessment to determine operational importance and risk. They also list defining disaster recovery procedures and operational playbooks with human oversight at key decision points during outages or unusual system behaviour, and requiring human authorization for consequential AI-driven actions.

On dependence on a single supplier, the texts recommend a multi-provider architecture that supports vendor diversity and reduces dependency on a single provider. They also recommend selecting the lowest cost model that meets operational requirements, and routing AI workloads to available providers during outages or service disruptions to improve resiliency.

The texts further recommend deploying dashboards to monitor token consumption and set thresholds for alerting the appropriate contacts. They also recommend deferring lower-priority productivity use cases until mission-critical workloads have been tested to ensure they can handle the expected demand.

The final items in the monitoring list concern suppliers and policy. The texts say to assess third-party AI providers for service reliability, quota limitations and operational risks related to token availability, and to update organizational guidance, controls and usage policies as AI adoption and token demands evolve.

Where the pages differ

The three pages carry the same title and, in the two longer texts, nearly the same wording. The differences are small. As noted above, CISA's summary uses the term SI, while the longer texts say AI.

The Cyber Centre text says organizations should consider whether an externally hosted model is the most appropriate tool for a task, and that smaller models, locally run models from trusted sources, or specialized AI tools may achieve similar outcomes while using fewer resources. Readers who need the exact wording of that point in the ASD ACSC version should check that page directly.

For the full list of actions, the Cyber Centre and ASD ACSC pages are the source. The three pages supplied for this guide do not describe specific incidents.