The Team-Based Activation Ladder (Setup → Aha → Habit)
Find the habit moment that predicts retention, then work backwards to the aha and setup moments.
- Difficulty
- Advanced
- Time to result
- ~months to results
- Steps
- 6
- Confidence
- 93%
Snyk defines activation not as login or even as finding value, but as a team forming a habit around deriving core value — for Snyk, fixing vulnerabilities. The habit moment is discovered empirically: it is the behavior that most strongly correlates with long-term retention (Snyk's: a team fixing a vulnerability within 30 days of team creation). Once found, you work backwards to the aha moment, the setup moment, and the individual user-level steps that lead there — producing a model of exactly which behaviors to influence.
Origin
Ben Williams (VP of Product, Snyk), describing the process Snyk's decision science function ran using quant analysis and ML models on their behavioral data platform, supported by qualitative research.
Core principles
- 01Activation is a habit, not an event.
- 02Define the unit of activation by how the product is really used — for Snyk, security is a team sport, so the unit is the team, not the user.
- 03The retention metric must be the core value action, not a login.
- 04Discover the habit moment from data; do not decree it in a meeting.
- 05Work backwards from habit to aha to setup, so every earlier step has a purpose.
How to run it
- 1
Name the core value action
Decide what deriving core value actually means. For Snyk it is not logging in, and not even finding vulnerabilities — it is fixing them.
Pro tip If the action you chose can be performed by an unengaged user, it is not core value.
- 2
Choose the right unit of activation
Snyk bases most activation and engagement definitions around teams, not users, because security is a team sport, different people fulfil different parts of the journey, and some fix activity happens off-platform where it can't be measured at user level. A one-person team is simply a team of one.
Pro tip Aggregate-level measurement also rescues you when parts of the value action happen where you cannot instrument it.
Watch out Picking the individual user as the unit when the product is used collaboratively will systematically understate activation.
- 3
Accrue baseline behavioral data
After building the data platform, wait long enough to build a good dataset. You cannot regress on data you have not yet collected — which is why data investment must start early.
- 4
Define the retention metric as continued core value
Snyk's retention metric is still fixing — whether a team is still fixing vulnerabilities — along with expected natural usage behavior and frequency, not returns or logins.
- 5
Find the habit moment by correlation
Run heavy quantitative analysis, spelunk the data, apply ML models plus supporting qualitative research, and find the behavior that most strongly correlates with improved long-term retention. Snyk's: a team fixing a vulnerability within 30 days of team creation, which correlates with three-month retention.
Pro tip The number will be a rounded approximation of a real inflection — 30 days is close enough to be actionable.
Watch out Correlation-derived moments still need qualitative research to explain the mechanism, or you optimize a proxy.
- 6
Work backwards to aha and setup, then to user-level behaviors
With the habit moment fixed, define the aha moment before it, the setup moment before that, and the individual steps a team must take to reach setup. The result is a model that lets you feed in the specific user-level behaviors you know can influence each step on the path.
Pro tip This backwards map is what gives the acquisition and activation teams their experiment surface.
In the wild
Snyk's decision scientists identified the personas and use cases, defined retention as still fixing vulnerabilities, then ran ML and quant analysis over the accrued behavioral data to find which early behavior best predicted long-term retention.
→ Teams that fix a vulnerability within their first 30 days are much more likely to still be fixing three months later — so 'fixed a vulnerability within 30 days of team creation' became Snyk's definition of an activated team.
Common mistakes
Defining activation as logging in
Logins measure presence, not value. Snyk explicitly excludes both logging in and even finding vulnerabilities — only fixing counts, because only fixing predicts retention.
Guessing the habit moment instead of deriving it
The moment is only useful because it is the behavior that most strongly correlated with downstream retention in the data. A decreed milestone gives the team a target with no proven link to survival.
Trying this before your data is trustworthy
The analysis required a working data platform and a wait to accrue baseline data. Attempting it on untrustworthy or non-behavioral event data produces a confident, wrong number.
Is it for you?
Best for
PLG product and growth leaders with a working analytics stack who need a defensible activation metric to organize acquisition and onboarding work around.
Not ideal for
Very early products with too little traffic or history to accrue the data needed for correlation analysis — use qualitative signal instead.
From the transcript
“so in the activation process we have set up moments aha moments and habit moments”
“so teams that fix the vulnerability within their first 30 days are much much more likely to still be fixing three months later”
“activation is indicative of the team forming a habit around the usage of sneak and when I say the usage I actually mean deriving core…”
From the episode
How Snyk built a product-led growth juggernaut
Ben Williams (VP of Product at Snyk)