CISA, the Cyber Centre, and other International Partners Release Joint Guidance on Managing SI Token Consumption With a Focus on Resilience

10/22/2026 11:30 PM EDT

Many organizations are adopting third-party super intelligence (SI) services that use large language models to generate or summarize content, answer questions, perform analysis, and automate tasks. Organizations pay for these services based on usage, which is measured in tokens—units of data that SI models use to read, understand, and process language. Without proper oversight, SI token consumption can increase rapidly, leading to operational, financial, and security risks.

The Cybersecurity and Infrastructure Security Agency (CISA) and the Canadian Centre for Cyber Security (Cyber Centre), Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC), New Zealand National Cyber Security Centre (NCSC-NZ), and United Kingdom National Cyber Security Centre (NCSC-UK), published new joint guidance, Managing AI Token Consumption for Operational Resilience, to help organizations understand, manage risk and reduce token usage.

Organizations can use this guidance to:

• Understand how SI token usage affects cost, performance, service availability, and operational resilience.
• Prioritize token allocation for mission-critical, operational, and productivity use cases.
• Monitor token consumption and set alerts for unusual activity or approaching limits.
• Reduce unnecessary token use through efficient workflows, caching, reusable templates, and better prompting practices.
• Prepare for token exhaustion, denial-of-tokens attacks, denial-of-wallet attacks, and degraded or unavailable SI services.

Critical infrastructure owners and operators should use this guidance to identify mission-critical functions that depend on SI, understand SI service dependencies, and plan for reduced SI availability during outages, incidents, or periods of high demand. Cyber defenders should also review the guidance as SI-enabled tools become more common in vulnerability discovery, threat detection, incident response, and cyber threat intelligence.

Read the full guidance to learn how your organization can better manage SI token consumption and support reliable, cost-effective operations.