Token Budget

What a Token Is

Language models read and write text in small units called tokens, which are often parts of words. Providers charge separately for input tokens, what the model reads, and output tokens, what it writes, and prices vary widely between model tiers.

Where Tokens Go in an AI System

• Context. Every file, log or tool result passed to the model is input tokens, and it is paid for on every call.
• Reasoning and output. Longer answers and step-by-step reasoning cost more output tokens.
• Agent loops. Each step of a multi-step agent re-sends context, so long loops add up quickly.
• Retries and dead ends. Work that is thrown away still costs tokens.

Why Token Budgets Matter in Security

Security work has a lot of noise. If a large share of findings are false positives and full investigation of each costs real money at frontier prices, a system that treats every finding the same spends most of its budget proving noise is noise. The goal is to spend tokens on the findings most likely to matter.

How to Get More From a Token Budget

• Route easy tasks to cheaper models and save expensive reasoning for hard ones.
• Let models fetch the context they need rather than loading everything up front.
• Filter out obvious noise before any model sees it.
• Track spend per task, so you can see which work is worth what it costs.

How Nullify Manages Token Spend

Nullify runs a mix of models and routes work to cheaper ones when that is all a task needs, so the budget goes to the findings that matter most. The most exploitable, widest-impact work goes first, and every token is tracked and every decision can be audited. Across five production tenants, 57% of 14,847 SAST findings triaged over 90 days were false positives, which is why routing them cheaply matters. See how Nullify prioritizes security work.