This chapter analyses the preconditions of invoking self-defence against a malicious cyber operation. After examining the notion of 'armed attack' and under what circumstances a cybersecurity incident may reach the critical threshold, the study focuses on the question of attributing the malicious conduct to a state actor. Depending first on identifying the acting individual whose hacking then needs to be linked to a state via the rules enshrined in the ILC Articles on State Responsibility, the question of the applicable standard of evidence is analysed in detail. Concluding that the technical peculiarities of cyberspace will often prevent states from presenting a sufficient amount of proof of adversarial state involvement in a timely manner, the chapter exposes the inherent difficulties in connection with the doctrine of self-defence in cyberspace.