CISA and Canada's Cyber Centre publish joint guidance on AI token consumption

CISA and the Canadian Centre for Cyber Security, with partner agencies, published joint guidance on managing how organizations consume AI tokens so that token-based billing does not become an availability or financial risk. The guidance, issued October 22, 2026, is called Managing AI Token Consumption for Operational Resilience.

What it is

The guidance addresses organizations adopting third-party AI services that bill by token consumption rather than by seat or license.

It frames unmanaged token usage as a source of operational disruption as well as a cost problem, citing risks such as rising costs, reduced availability, degraded performance, token exhaustion, and deliberate attacks.

What it requires

The guidance sets out practical steps for managing consumption, including prioritizing token allocation, designing efficient workflows, improving prompting practices, reusing cached context, trimming data before submission, and monitoring usage over time.

It defines a denial-of-tokens attack as threat actors intentionally generating excessive AI usage to exhaust allocations, consume budgets, or trigger rate limits.

It separately defines denial-of-wallet attacks as attempts to exploit consumption-based pricing models to cause organizations financial harm.

For critical infrastructure owners and operators, the guidance says it can be used to identify mission-critical functions that depend on AI and plan for reduced availability during outages or high demand.

It also notes that cyber defenders can apply the guidance to manage AI-enabled defense workflows while keeping human oversight and strong cybersecurity fundamentals in place.

What security leaders should do

Security leaders should inventory which workflows and business functions depend on AI services and treat those dependencies the way they treat other critical vendor relationships, since the guidance frames token supply as an availability surface rather than a pure cost line. Teams should establish visibility into token consumption per workload or identity so that unusual spikes consistent with a denial-of-tokens or denial-of-wallet attempt can be detected early, and should set escalating alert thresholds before quotas are exhausted rather than after service fails. Procurement and governance processes should account for token pricing uncertainty before contracts are signed, and incident response plans should include a path for degraded or unavailable AI services, including manual fallback procedures for mission-critical functions.