State-of-the-art solutions for intrusion and attack detection have major drawbacks in resource-constrained platforms such as WSNs. In fact, those solutions require large amount of memory and storage to provide effective and useful intrusion/attack detection. This issue led the design of WIDS (WSN Intrusion Detection System) [IDS1], an intrusion detection system specifically designed to overcome the limitations and gain advantages on the peculiarity of WSNs. WIDS models the known attacks into more general Weak Model Processes (WPM), which are a simplification of Hidden Markov Processes where the probability on the edges can be only 1 or 0, i.e., a hidden state can be either reachable or unreachable. Each node in the WPM represents a possible state in which one WSN node happens to be. The reachability of a state depends on specific conditions on a chosen set of observable events which are detected and analysed by WIDS and the underlying networking drivers. WIDS uses such models to estimate the current state of WSN nodes and to detect when such states represent a danger for the WSN node or, for the whole WSN. For example, consider the observable, e.g., “Clear Channel Assessment Failure” (the node was unable to acquire the radio medium) which can lead to a dangerous state, e.g., “WSN node under Jamming”. The WIDS design has been recently implemented as a component in the TinyOS framework with the name TinyWIDS [IDS2]. TinyWIDS embeds WIDS design and provide enhanced radio transceiver drivers to provide low-level observables, the WPM representation as JSON, the continuous state estimation by inspecting selected attacks WPMs and notification system based on TinyOS events. Currently, TinyWIDS can detect incoming attacks and eventually the source of them, but it cannot provide any reactive behavior which could be useful to avoid further damage to the WSN before the operators could take action.