Three Signals That Appear Before Almost Every Churn
Churn is rarely sudden. The cancellation email arrives, and it feels sudden because no one on the CS or finance team saw it coming in time to act. But the account had been signaling for weeks. There are patterns that show up before B2B SaaS cancellations with enough regularity that, once you know what to look for, they stop looking like surprises and start looking like predictable failure states.
These are not obscure signals requiring a data science team to detect. They are observable from the operational data most SaaS companies already collect — billing events, product session logs, support tickets. The barrier is not detection capability. It is that the data lives in three different systems, and nobody has built the connection that surfaces all three signals on the same account at the same time.
Signal One: The Login Frequency Break
The most reliable leading indicator of non-renewal is a material drop in login frequency relative to an account's own usage baseline. Not absence — withdrawal. An account that went from logging in four times a week to once a week over a 30-day period is not obviously alarming when you look at any single session. But the trend line, measured against that account's 90-day baseline, is showing a 75% reduction in engagement. That account is disengaging.
The diagnostic question is whether the decline is structural or situational. A situational decline — a product team that slows down during a company-wide hiring freeze, a finance team that only uses the tool at quarter-end — has a detectable pattern: the usage dips and then recovers to baseline. Structural decline, which precedes churn, is typically monotonic. The usage falls and does not bounce back. The sessions shorten. The active user count within the account contracts. Often the most active user — the champion who drove the purchase and internal adoption — is the first to go quiet.
In B2B SaaS with named accounts, champion departure is its own sub-signal inside the login pattern. When the admin or primary power user stops appearing in session logs, and no other user picks up the frequency slack, the account has lost its internal advocate. Whatever goodwill and institutional knowledge that person carried about why the product matters is gone with them. Their replacement has no context and no reason to renew something they did not choose.
Signal Two: An Unresolved Support Ticket at the Wrong Time
Support tickets predict renewals in a way that most CS and finance teams have not operationalized. An open ticket that is 7 days old and assigned to support is normal. That same ticket, still open at 21 days, with no resolution, and a renewal date in 40 days, is a red flag with specific financial dimensions.
The mechanism here is not complicated. Customers who have an unresolved problem with your product are not in the right emotional and rational state to make a positive renewal decision. The ticket represents a gap between the product's promise and their actual experience. If that gap is still open when the renewal invoice arrives, it becomes the frame through which they evaluate whether to continue paying. "We have been waiting three weeks for a resolution on this" is a near-perfect setup for a renewal negotiation that goes poorly for you.
The specific risk profile is tickets opened by the primary account admin or by the champion contact, rather than peripheral users. A junior team member's ticket about a formatting edge case is low renewal risk. The head of operations opening a ticket about a core workflow that is broken and not hearing back in two weeks is a very different risk level.
We are not saying support ticket volume is a reliable churn predictor on its own — some of the stickiest, highest-NPS accounts also generate the most tickets, because they use the product deeply and push it hard. The signal is unresolved tickets combined with a near-term renewal date and degraded engagement signals elsewhere. That combination is the problem state.
Signal Three: Payment Friction in the Renewal Window
A billing failure within 60-90 days of a renewal date carries elevated churn risk even when it is eventually recovered through dunning automation. The payment failure itself is often a symptom of organizational instability — card reissued after an acquisition, budget owner changed, new procurement process introduced — and that organizational instability is the same force that makes renewals uncertain.
Consider a mid-size SaaS company serving operations teams, tracking around 250 accounts. An account at $28,000 ARR had a card decline in early Q4 of their fiscal year. The dunning email resolved it six days later. The billing team marked it recovered. The CSM was not notified. The actual context: the company had gone through a restructuring, the department that used the product had been reorganized, and the billing contact was now a new finance coordinator who did not know what the subscription was for. The renewal came up 55 days later. The new coordinator asked the new ops lead, who had no context, and the contract was not renewed. ARR leakage that was completely preventable with one phone call if anyone had connected the payment friction to the renewal calendar.
This is the operational failure that payment friction signals can prevent: not the card decline itself, but the organizational dislocation it often reflects.
Why the Signals Are More Powerful in Combination
Each of the three signals has noise on its own. A login drop can be a vacation. A billing retry can be an expired card with zero churn intent. An open ticket can be a minor request that the customer is not waiting urgently on. Acting on any single signal in isolation produces false positives and trains your CS team to distrust the signal entirely.
The reliability jumps substantially when two or more signals are present simultaneously on the same account within the same 90-day renewal window. An account showing login decline plus an open aging ticket is materially higher risk than either signal alone. Add a recent billing retry, and the composite picture is an account that is operationally unhappy, disengaged in product, and showing financial instability — and that is an account where a CSM call is almost always warranted, regardless of how healthy the account looked six months ago.
The practical implication for account prioritization: a three-signal composite flag should override any static health score or account tier weighting in your at-risk queue. A large-ARR account with a pristine historical health score that suddenly shows all three signals in a 30-day window is more urgent than a smaller account with a perpetually moderate health score. Recency and signal clustering matter more than historical averages when you are in the pre-renewal window.
The Timing Problem: Why "Watching" Is Not Enough
CS teams that do track these signals often describe a common failure: they see the signals, they note them, and then the renewal date arrives anyway before anyone acted with enough lead time. Watching is not the same as acting. The signals are only valuable if they trigger a defined workflow with a specific human action, assigned to a specific person, within a specific time window.
An account flagged with two or more signals at 75 days to renewal has meaningful runway for intervention. That same account flagged at 12 days to renewal is nearly impossible to save. The difference in outcome between those two scenarios is not the quality of the CSM or the quality of the product — it is the gap between when the signals fired and when someone was structured to act on them.
Building the action structure around the signals — defined escalation paths, time-bound response requirements, automatic queue population — is what separates teams that use churn signals for post-mortems from teams that use them for prevention. The signals are the same. The infrastructure around them is not.