Support-Signal Escalation Playbook 2026

Neither signal alone is the play. Tickets spike on healthy accounts (power users file more, and that's fine); engagement dips without tickets have their own churn play. The trigger is the intersection — a ticket-volume spike against the account's own norm landing on an engagement score that's already falling — and it fires carrying ticket trend, engagement trend, ARR and renewal date, and how many seats are touching the affected area. Tune "spike" to the account's baseline, not a global number: three tickets from a two-seat account is a crisis; three from a five-hundred-seat account is Tuesday.

Ticket severity measures the bug. Blast radius measures the account. The scoring step joins the queue with the usage data and emits the fields the split decision reads:

• Blast-radius score — value at stake × spread: ARR, share of seats affected, whether the broken thing is a core-workflow feature or an edge.
• Root-cause theme — what the tickets cluster around, so the response targets a cause, not a symptom list.
• Champion affected? — if the person who renews you is the person blocked, the account risk is not what the ticket priority says.
• Days to renewal — the same bug is a different emergency at day 40 than day 400.

The decision has to be stingy, because escalation is expensive: page people for every spike and within a month the pages get muted. Contained means the blast radius is small — low spread, no champion, renewal far — even if the ticket count is loud. Account-threatening means the combination of value, spread and timing crosses your line. Write the line down (for example: blast-radius score in the top decile, or champion affected inside 120 days of renewal) and let the data apply it, so escalation is a fact, not a negotiation.

The threatening lane pages the account's CSM and the support lead into #escalations with the full case: blast-radius score, root-cause theme, champion status, renewal clock, links to the tickets. One thread, both functions, same facts. The failure mode this kills is the parallel response — support grinding tickets by SLA while the CSM apologises without knowing the root cause, each assuming the other has it handled.

The CSM and support lead agree on one plan in the thread: who fixes (support drives the root cause with engineering), who fronts (the CSM tells the champion what's happening, what the workaround is, and when they'll hear next — before the customer asks), and the update cadence until resolved. Proactive narration is the trust play: an account that watched you handle a bad week well often ends up more confident than one that never had the bad week. Log the escalation and its outcome on the account record; the renewal radar reads it later as a risk flag.

Contained flare-ups still get value from the join: the queue reorders by account impact, not just ticket age and severity — the at-risk account's medium bug jumps the healthy account's medium bug, and agents see the engagement context on the ticket so tone matches stakes. This is the quiet compounding win of the play: support stops treating identical tickets identically when the accounts behind them aren't identical at all.

Score the play per lane. Threatening lane: time from page to plan, plan to resolution, and did the engagement score recover to baseline within 30 days — resolution without recovery means the damage outlived the fix. Contained lane: did anything you called contained later blow up? Each one is a threshold bug; tune the line. And send the root-cause themes to product monthly — the recurring theme on high-value accounts is your roadmap telling you where it hurts.