At this point, the economic sanctions are very short of a total embargo. Only a few percent of Russians are able to obtain restricted Western goods. On the other hand, none of these are life necessities, and most of the population has never been able to use or afford them anyway.
The one sanction that has had an effect on Russia's internal affairs was the restriction on semiconductor sales, particularly industrial ones. These are very difficult to overcome, as replacing them with Chinese or domestic equivalents requires a redesign and possibly a recertification.
Another was the ban on air travel and technical support for all aircraft. Short-term, it just prevents Russians from leaving their country. In the long term, it will cause an increased aircraft accident rate in Russia, as airliners will have to run on refurbished parts. This will harm internal and foreign tourism.
- The next legitimate level of escalation would be a blockade. That is, use of military force to interfere with the ability of other countries to supply goods and services to the target.
A blockade is considered an act of war. However, unlike an invasion, it's not likely to trigger a nuclear response, since it's not an existential threat.
There are few nations left to blockade, though. A blockade against Chinese shipments would be difficult to enforce, without involving Taiwan, and doing so would give the PRC a legitimate casus belli against the ROC, something they've been waiting for.
- NATO can engage in a proxy war against Russia - Western hardware, Ukrainian personnel. The first steps seem to be in the works. With enough financial commitment, this would start a second Cold War, and the first one didn't end well for the Soviet Union.
The drawbacks include a second Cold War. This would also all but guarantee invasions of less-defensible countries, as there's no room for further escalation, and Putin might need these countries as trading chips.
The potential risk is a symmetrical response. So far, there has been no meaningful increase in Russian-aligned hacker activity, with the exception of minor DDoS annoyances against a few media outlets. It's not clear if this risk is as major as it seems, as there is a suspicion that many "Russian hacker groups" only branded themselves as Russian.