At-risk User

Concept

An account flagged as likely to leave soon because several warning behaviors overlap, used to decide who gets contacted first.

Why it exists

Teams have always counted the people who left. Anyone could say what share of accounts churned last month. What that number never contained was the name of anyone who would leave next month. Five percent gone is a summary of something already finished, not an answer to what to do this week.

So the meeting always stalled in the same place. Everyone would stare at the churn chart, and then somebody would ask who exactly they should reach out to on Monday. Nobody had an answer. With a rate and no names, the only available move was sending the same email to everyone.

The at-risk label exists to turn that rate into names. Instead of counting accounts after they leave, a team watches behavior beforehand and marks the accounts that look wrong. Pull the marked ones into a list and the question of who finally has an answer. Nothing about the underlying data is new here; the shift is that the judgment happens while there is still time to act on it.

How it works

Three decisions have to be made before any account can carry the flag: what to watch, how much has to pile up, and how often to recheck.

  1. Pick the behaviors. The raw material is the churn signal — a behavior pattern that tends to show up before someone leaves. Logins spreading further apart, a heavily used feature going quiet, the billing contact changing, all of these are candidates. Which ones actually predict anything comes from looking at the accounts that left over the past six months and finding what they did first.
  2. Set the line. One signal is never enough. A workspace whose weekly active headcount fell below half of last month's, that hasn't created a document in 30 days, and that hasn't invited anyone in two months gets flagged when two of those three hit. Scoring each signal and flagging anything over 70 points is the same rule written as arithmetic.
  3. Decide how often to recheck. The flag is not permanent. Most teams recalculate weekly, so an account flagged last week can drop off and a healthy one can appear. Recheck too rarely and the list describes a month that has already passed; recheck daily and it churns so much that nobody can work through it.

Where the line sits changes what the list is. Draw it loosely and 30 percent of all accounts land on it, at which point nobody opens the list at all. Draw it tightly and twenty accounts remain, which is manageable but leaves most of the eventual churn outside the list entirely.

So after setting a threshold, check it backwards: of the accounts that actually left last quarter, how many were on the list before they went. If only 12 of 40 were caught, the signals are wrong, and the fix is to choose different signals rather than to lower the line.

Where it shows up

The first place it gets used is the moment someone picks targets. Most churn prevention moves cost either money or somebody's hours, so the list decides where they go. A reactivation campaign, the batch of messages sent to users who have gone quiet, usually takes this list as its audience directly, while a save offer — a discount or alternative held back for someone already on the cancel screen — goes to a much narrower slice.

It shows up inside the product too. A help prompt that appears only for flagged accounts, or a banner pointing back to a feature someone stopped using. Showing the same thing to everyone annoys the people who are doing fine, so the flag narrows the audience.

The count itself is watched as a trend. If the rules haven't changed and the number of flagged accounts has grown two months running, something moved in the product or the market, and finding out what moved matters more than emailing the list.

The same judgment goes by another name in customer success, where it's a red account. The split is how much one customer pays. Thousands of small-plan teams can't each have a human attached, so they get automatic scoring and automatic messages; a customer on an annual contract gets a phone call from a named person.

How it sounds at work

"Twelve workspaces landed on the at-risk list this week, and four of them upgraded less than three months ago."

He's picking a subset to handle first rather than working the whole list. Losing an account that just started paying costs more, so it moves up the queue.

"It got flagged, but their admin was out all last week. Let's drop it for now."

A person adding context the scoring didn't have. The list is a proposal, not a verdict.

"The rules haven't changed and the at-risk count keeps climbing."

When the method is constant and the list gets longer, the cause sits in the product.

At Pagedeck, Ravi reruns the scoring on Monday morning and pulls the list. Out of several thousand workspaces, roughly eighty come back flagged in a given week, and since nobody can work eighty accounts by hand, most of them get an automated email while the few on annual contracts go to Sofia.

Mia pays less attention to the length of the list than to which signal fired most often. Last month an unusual number of flagged accounts had abandoned the invite flow, and it turned out invitation emails were being blocked by some corporate mail servers. That calls for a fix, not a save offer.

What people get wrong

The most common mistake is reading the list as the people who are definitely leaving. The word risk and the tidy list both make it look settled. But the flag names a probability. Of a hundred flagged accounts, something like thirty actually churn that quarter. Miss that and you send a half-price offer to all hundred, which means the seventy who were staying anyway collect a discount. A tool built to protect revenue ends up cutting it. The way out is not a better model but a cheaper first move: a message costs nothing to send to seventy people who were never leaving, while a discount does not.

The opposite mistake also shows up: treating the existence of the list as the work. A weekly list and a number on a dashboard feel like something is being managed. But flagging is diagnosis, and reducing churn is what happens next. With no response attached, the list just refills every week, and six months later all a team has is a record showing that the accounts which left had been marked first.

Easily confused with

TermWhat it namesHow it differs
Churn signalOne individual behavior that hints at leavingThe signal is the ingredient; the at-risk flag is the verdict reached by combining ingredients at the account level. A signal is an observation and is simply true or false, while the verdict involves choosing a threshold

Where to go next

  • Churn prevention

    see which activity this flag is the opening step of

  • Churn signal

    the behavior patterns the verdict is built from

  • Red account

    what changes when the same judgment is applied to enterprise customers

Last updated 2026-09-16