Abstract. Wireless Sensor Networks (WSNs) led the way to new forms of communications, which extend today the Internet paradigm to unforeseen boundaries. The legacy industry, however, is slower to adopt this technology, mainly for security reasons. Self-managed security systems allowing a quicker detection of and better resilience to attacks, may counterbalance this reluctance. We propose in this paper a hybrid threat detection and security adaptation system, designed to run on top of industrial WSNs. We explain why this system is suitable for architectures mainly composed of constrained or sleeping devices, while being able to achieve a fair level of autonomous security.