My first move is always an instrumentation check - before forming hypotheses, I verify the data pipeline is intact. A broken event tracker once caused a fake 35% drop that nearly triggered an unnecessary rollback. Once I confirm data integrity, I work two axes: internal vs external and sudden vs gradual. A 20% overnight drop is sudden, which narrows me to a deploy, an infra event, or an experiment collision. I then run segment cuts: platform (iOS, Android, web), geography, acquisition channel, and new versus retained users. If the drop is isolated - say, Android only - the root cause is almost certainly platform-specific. If it is uniform across all segments, I look for a universal change: a shared dependency, a pricing change, or a partner outage. I build a 48-hour timeline of every change that touched the product, rank hypotheses by likelihood, and share a structured brief with the team: hypothesis, confidence level, and the one diagnostic step that will confirm or eliminate it. Root cause is not declared until I can see it reproduced or reversed.
Insider read
Really testing: Whether you diagnose before you panic - structured thinkers verify instrumentation first and segment before hypothesizing.
The tell: Juniors jump straight to a product hypothesis; strong candidates check data integrity first, then isolate by segment before touching any product explanation.
Follow-up: What if the segment cuts show the drop is equal across every slice - what does that tell you?
Say this"Before I form a single hypothesis, I confirm the logging pipeline is healthy, because a data issue looks identical to a product issue on a dashboard."