On 22 October 2026 CISA and the Canadian Centre for Cyber Security (the Cyber Centre), with partners, released joint guidance titled Managing AI Token Consumption for Operational Resilience. It is aimed at organisations that rely on third-party AI services priced and limited by tokens. For a CISO, the headline is that AI usage limits are now being framed as a continuity risk, alongside availability and cost.
This briefing is based on CISA’s resource page. We did not review the full guidance document, so the detail below is limited to what the page states.
What the guidance says
CISA’s summary makes these points:
- Organisations are adopting third-party AI services (the page uses the term “super intelligence” or SI) that run on token-based usage models, and those models “can affect cost, performance, and access to critical services.”
- Unmanaged token consumption may contribute to “rising and unpredictable costs, reduced service availability, degraded performance, token exhaustion, and denial-of-tokens or denial-of-wallet attacks.”
- The practical steps outlined are to prioritise token allocation, design efficient workflows, improve user prompting practices, use caching and reusable context, optimise data before submission, and monitor consumption over time.
- Critical infrastructure owners and operators are encouraged to identify mission-critical functions that depend on these services, understand provider and operational dependencies, and plan for reduced availability during outages, incidents or periods of high demand.
- Cyber defenders are pointed to the guidance for managing AI-enabled defence workflows while keeping human oversight, governance and security fundamentals in place.
Why this is a board-level issue
Our assessment is that this guidance changes how AI risk should be reported. Most board discussion of AI covers data leakage, model misuse and regulation. Token limits introduce a different failure mode: the service is working as designed, but the organisation has run out of allowance, or someone has driven the bill up on purpose.
Three exposures follow:
- Cost shock. An internal agent loop, a misconfigured integration or an abusive user can burn through a budget quickly. CISA names “denial-of-wallet” as an attack category, where the attacker’s goal is to inflict cost, not steal data.
- Availability. If a security operations workflow, customer service channel or fraud check depends on a metered AI service, exhausting the quota degrades that function. The comparison to cloud and managed-service concentration under regimes such as DORA and NIS2 is ours, not CISA’s; we have not checked how those texts apply to AI services.
- Weak accountability. Tokens are consumed by many teams through shared keys. Without attribution, nobody owns the overrun.
Five questions for management
1. Which business processes depend on a metered AI service? Ask for a list ranked by criticality, including security tooling. Few organisations have one yet.
2. What happens when the allowance runs out? The guidance urges planning for reduced availability. Ask whether a manual or lower-capability fallback exists and when it was last exercised.
3. Who can spend, and where is the ceiling? Look for per-team budgets, rate limits, spend alerts and a named owner for each API key. Shared, unmetered keys are a likely gap in our assessment; we have no prevalence data.
4. Can we detect abuse as well as growth? Consumption monitoring should separate legitimate demand from anomalies such as a sudden overnight spike. Ask who is paged and how quickly.
5. Is this covered in contracts and insurance? Review provider terms on rate limits, outages and overage charges, and ask whether your cyber policy addresses cost-inflation attacks. Do not assume it does. Our guide to board cyber risk reporting shows how to track these as recurring indicators.
What to do this quarter
- Add AI service dependencies to the critical third-party register, with provider, owner, budget and fallback.
- Set budgets and alerts at the key level, and remove shared keys where possible.
- Include a token-exhaustion scenario in the next resilience or tabletop exercise.
- Ask security operations whether any detection or triage workflow would stop working under a provider outage or quota limit.
For related reading on governing AI use inside the organisation, see our briefing on shadow AI governance.
Sources
- CISA: Managing AI Token Consumption for Operational Resilience (published 22 October 2026 per CISA’s advisory feed)