Many businesses now pay for AI tools by the token, the small chunks of text an AI model reads and writes. New joint guidance from CISA, the Canadian Centre for Cyber Security and partners says that pricing model brings risks that go beyond the monthly bill.
The document, titled Managing AI Token Consumption for Operational Resilience, treats token use as something to plan for, watch and limit. This guide covers what it warns about and the practical steps it lists.
Key facts
- CISA says token-based pricing for third-party AI services can affect cost, performance and access to critical services.
- Unmanaged token use can lead to costs that rise and are hard to predict, according to CISA.
- It can also cut service availability, slow performance and use up the tokens a team has, the agency says.
- The guidance warns of denial-of-tokens and denial-of-wallet attacks linked to token-based pricing.
- CISA recommends planning for reduced AI availability during outages, incidents or periods of high demand.
Background
Tokens are how many AI providers measure and bill usage. Each request and each answer uses some. When a business builds daily work on top of a paid AI service, the token supply quietly becomes part of how that work gets done.
CISA describes the new guidance as a way to help organizations plan for disruption and decide which token uses come first. The agency lists it next to other joint AI security guidance, including a statement from the Five Eyes cyber security agencies and guidance on careful adoption of agentic AI services.
CISA's page also points to joint guidance from NIST, NSA and CISA. That document lays out ten core voluntary incident response practices for organizations that train and evaluate highly capable AI agents.
What it means for you
The guidance is aimed at organizations that use third-party AI services billed by token, including owners and operators of critical infrastructure. A small business that runs customer chat, writing or data work through a paid AI tool fits that description too.
Costs that are hard to predict
Usage-based pricing means the bill follows activity. CISA says unmanaged use can push costs up in ways that are hard to forecast. A long prompt, a looping workflow or a tool that resends the same context again and again can all add up.
Running out at the wrong moment
Cost is only part of the picture. CISA warns that unmanaged use can reduce availability, hurt performance and lead to token exhaustion. If a key process depends on an AI service and the tokens run out, that process can stall.
Attacks that target the meter
The guidance names two kinds of abuse tied to token pricing: denial-of-tokens and denial-of-wallet attacks. CISA lists the denial-of-wallet attack among the risks of unmanaged use. That makes token limits a security topic as well as a budget topic, which fits within a broader plan for cybersecurity solutions.
Practical steps
The guidance lists these steps.
- Map what depends on AI. CISA says operators should identify mission-critical functions that rely on AI and understand their provider and operational dependencies.
- Plan for the AI being down. Operators should plan for reduced availability during outages, incidents or busy periods, so work can continue without it.
- Decide who gets tokens first. The guidance recommends prioritizing token allocation so the most important work is covered.
- Design leaner workflows. CISA recommends building efficient workflows and trimming data before it is sent to an AI service.
- Teach better prompting. The guidance calls for better user prompting habits along with caching and reusable context.
- Watch usage over time. CISA advises monitoring token consumption over time rather than checking only when a bill arrives.
- Keep people in charge. CISA says defenders using AI-enabled workflows should keep human oversight, governance and strong security basics in place.
CISA's page also says all critical infrastructure entities, large and small, should implement its Cross-Sector Cybersecurity Performance Goals.
Not every task needs AI in the first place, and picking the right ones is covered in which tasks in your business are actually worth automating. A review of current AI solutions and workflow automation can show where tokens are spent and where a simpler process would do. A plan for keeping key work going when a service fails belongs in disaster recovery and business continuity planning.
How cloud AI platforms meter tokens
Large cloud AI platforms publish their own rules for limiting and saving tokens, and those rules show what the guidance is talking about in practice. Microsoft's Azure OpenAI documentation explains that quota is set separately for each region, model and deployment type, and it is counted in tokens per minute, or TPM. According to Microsoft, the TPM a deployment receives then works as the hard rate limit for that deployment.
In one Microsoft example, a model with a 240,000 TPM quota in a single region could run as a single 240K deployment or as two deployments of 120K each. The same example makes clear that the combined total can never go past 240K. A fixed ceiling like that is one reason to decide in advance which work gets tokens first.
Caching is another tool. Amazon Bedrock's documentation describes prompt caching as an optional feature on supported models that can lower both response delay and the cost of input tokens. Bedrock needs a minimum prompt prefix before it creates a cache checkpoint, and that minimum currently runs from 512 to 4,096 tokens, depending on the model.
On Bedrock, every cache hit restarts the cache's time to live, or TTL. Many models there support a TTL of 5 minutes, so a cached prompt that sits unused past that window expires. For teams that send the same long instructions with each request, caching is one practical way to act on CISA's advice about reusable context.
What happens next
CISA describes the guidance as practical steps organizations can take. Organizations can use it to review their current AI contracts, workflows and fallback plans at their own pace.
Some details are not covered here. CISA's page refers to the services as super intelligence, or SI, while the guidance title uses the term AI, and the difference is not explained.
