The integration of Internet of Things (IoT) devices in microgrids enhances efficiency and adaptability but also introduces significant cybersecurity risks. This paper presents a conceptual hybrid modeling framework for cybersecurity modeling in IoT-enabled microgrids by combining System Dynamics (SD), Agent-Based Modeling (ABM), and statecharts. SD captures energy flows and storage dynamics, ABM models decentralized interactions among microgrid components, and statecharts represent cyberattack states and defensive responses aligned with the Lockheed Martin Cyber Kill Chain and MITRE ATT&CK for Industrial Control Systems (ICS) frameworks. A four-agent architecture—Microgrid, Attacker, Defense System, and External System—structures the modeling of cyber-physical interactions. An illustrative example shows how this hybrid approach can represent attack scenarios, such as Address Resolution Protocol (ARP) spoofing and smart meter manipulation, and how falsified sensor measurements could affect controller decisions and, conditionally, physical energy dynamics. The approach is conceptually compared against SD-only, SD+ABM, and AI/ML-based approaches, highlighting its intended advantages in interpretability and causal traceability. The scenarios establish representational feasibility, and a preliminary quantitative illustration compares normal, attacked, and defended conditions using resilience indicators; empirical validation against recognized microgrid benchmarks and testbeds remains future work.