The peculiar characteristics of wireless sensor networks (WSNs) make them vulnerable to physical attacks. Once a sensor node is physically captured by an adversary, it can be modified not only to perform malicious ac- tivities to disrupt network operation but also to propagate malicious worms to infect other nodes. In the face of such a threatening scenario, the system ad- ministrator needs to be aware of which nodes may have been compromised, so that appropriate countermeasures can be taken in a timely fashion. This paper presents the Sensor Security Status (S3), a security metric model for estimating in an online manner the probability that a sensor node has been infected, based on both the interaction among nodes and the alerts from the intrusion detec- tion system (IDS). Simulation results show that S3 can accurately estimate node security level with low performance overhead and power consumption.