This research investigates the impact of cyberattacks on inverter-based microgrids through two distinct access periods, each focusing on different microgrid topologies and control layers. A structured test plan, including preparatory modeling and proof-of-concept validation, ensured a safe and effective transition to the experimental phase. The research considered two microgrid topologies to assess the effects of cyberattacks. The first access period involved a microgrid comprising Grid-Forming (GFM) and Grid-Following (GFL) inverters, with attacks targeting the Phase-Locked Loop (PLL) of the GFL inverter at the primary control level. The cyberattack in this phase involved the malicious reduction of the PLL’s PI gains in the GFL inverter, impairing frequency tracking performance. The second access period involved a microgrid consisting solely of GFM inverters, with attacks introducing False Data Injection (FDI) to the secondary control of one inverter. The cyberattack in this phase involved an adversary manipulating the sensor/metering device of one GFM inverter, introducing a constant disturbance to the reference frequency of the distributed secondary controller. In both cases, inverters were droop-controlled with d-axis priority current limitation. Both experimental phases were validated using Power Hardware-in-the-Loop (PHIL) setups. In conclusion, this research successfully validated the two initial hypotheses, demonstrating that cyberattacks at different control levels can significantly impact microgrid performance. The findings emphasize the critical role of control strategies and highlight how proper selection of droop gains can enhance cyber resilience, serving as a passive defence mechanism. These insights contribute to the development of more secure and reliable inverter-dominated microgrids.