The EnergyShield project will develop an integrated toolkit covering the complete EPES value chain (generator, TSO, DSO, consumer). The toolkit combines novel security tools from leading European technology vendors and will be validated in large-scale demonstrations by end-users. The EnergyShield toolkit will combine the latest technologies for vulnerability assessment (automated threat modelling and security behaviour analysis), monitoring & protection (anomaly detection and DDoS mitigation) and learning & sharing (security information and event management). The integrative approach of the project is unique as insights produced by the various tools will be combined to provide a unique level of visibility to the users. For example, it will be possible to combine vulnerability scanning with automated threat modelling to provide insights into software vulnerabilities present in an architecture in combination with insights into what are the key assets, risks and weak links of the architecture. The toolbox will allow end-users to predict future attacks (as it provides insights to what attacks can be applied to the weakest links of the architecture) and learn from past attacks (for example using the insights from the vulnerability assessment and threat modelling to prevent attacks, and learning from attacks to update the probabilistic meta-model of the threat modelling). The toolkit will be implemented with the complete EPES value chain who will contribute to the specification, prototyping and demonstration phases of the project. Although the toolkit will be tailored to the needs of EPES operators, many of the technology building blocks and best practices will be transferable to other types of critical infrastructures. The consortium consists of 2 large industrial partners (SIVECO and PSI), whereof SIVECO is taking the lead supported by 6 innovative SMEs, 3 academic research organizations and 7 end-users representing various parts of the EPES value chain.