Active seats in the trailing 30 days over contracted seats, per SaaS account, trended over two quarters and joined to the renewal date. Under threshold inside 120 days of renewal is downgrade risk; over cap is expansion with the evidence attached.
Logins alone overcount. A stated meaningful action in the window is the bar.
Contracted seats times price sums to the ARR ledger, so the risk figure reconciles.
Active seats, meaning users with a qualifying action in the last thirty days, divided by contracted seats, read against the curve for the contract's age.
An account has 100 seats. 96 logged in within ninety days, 81 within thirty, and 58 did something the product is for. Utilisation is 58 percent.
Login counted as use over a long window. Every account looks healthy until it cancels.