CISA, Canadian Centre for Cyber Security, and partners publish joint guidance 'Managing AI Token Consumption for Operational Resilience'

Around 22 October 2026 CISA, the Canadian Centre for Cyber Security (Cyber Centre), and partners issued joint guidance, 'Managing AI Token Consumption for Operational Resilience.' As organisations adopt third-party super intelligence (SI)/LLM services with token-based usage models, unmanaged token consumption can drive rising and unpredictable costs, degraded performance and availability, token exhaustion, and 'denial-of-tokens' / 'denial-of-wallet' attacks. The guidance sets out practical steps to prioritise token allocation, design efficient workflows, improve prompting, use caching and reusable context, optimise data before submission, and monitor token consumption; it also tells critical-infrastructure operators how to identify mission-critical SI dependencies and plan for reduced SI availability during outages or high demand, and tells cyber defenders how to keep human oversight and governance while running SI-enabled defence workflows.

This is authoritative, multi-agency operational guidance aimed at critical infrastructure. It frames token consumption and denial-of-wallet as first-order resilience/availability risks of dependency on third-party AI/SI services — a new attack-and-availability surface that security and resilience teams have not traditionally budgeted for. It extends the US 'Super Intelligence' terminology and joins the wider NIST/NSA/CISA SI-guidance arc.

For organisations consuming third-party SI/LLM APIs, map the guidance into token-budget, caching, and monitoring practices and into continuity plans for SI-dependent mission-critical functions; for cyber defence teams, review prompt/context optimisation and human-oversight controls for SI-enabled workflows.