Determining the threshold for violations of State sovereignty in cyber operations is one of the complex issues of contemporary international law, particularly with respect to operations that remain below the threshold of the use of force but may affect data, systems, cyber infrastructure, or inherently governmental functions of the target State. Using a descriptive-analytical and doctrinal method, this article examines international instruments, judicial practice, State positions, the Tallinn Manual 2.0, and relevant legal scholarship to answer the question of when a low-intensity cyber operation may amount to a violation of the target State’s sovereignty. The article argues that the material damage approach, by limiting sovereignty violations to physical damage or permanent loss of functionality, fails to account for all meaningful forms of cyber encroachment. It further argues that although the Tallinn Manual 2.0 provides an important framework based on territorial integrity and inherently governmental functions, it leaves significant ambiguity with respect to low-intensity operations that do not cause visible physical damage. The article’s main contribution is the formulation of the criterion of “effective unauthorized intrusion”: an intrusion that goes beyond mere observation or copying of data, exceeds a de minimis threshold, and produces a measurable effect on the target State’s data, systems, infrastructure, or governmental functions. This criterion allows for a more precise assessment of low-intensity cyber operations without unduly expanding the concept of sovereignty violation.