How to spot at-risk accounts without a CS ops team