Internet of Things (IoT) devices are increasingly used in environments where security weaknesses may cause operational disruption. Security evaluation of such devices therefore needs to examine how real hardware behaves during controlled attack scenarios, not only identify possible vulnerabilities.

The aim of this thesis was to develop, implement, and evaluate AttackLab, a hardware-based test environment with scenario-level automation for reproducible IoT security assessment. The study used a quantitative experimental approach in a controlled laboratory setting. Five ESP32-based reference nodes were used together with an iPhone target and Sigma's SmartSpa product. The empirical scope was limited to three implemented Wi-Fi-based scenarios: Wi-Fi reconnect, Wi-Fi DoS/overload, and Wi-Fi eavesdropping.

The results show that AttackLab supported automated scenario execution, structured phase control, run-specific evidence handling, and traceable analysis artefacts. The reconnect and DoS/overload scenarios produced measurable differences in reachability, disruption, and recovery behaviour. The eavesdropping scenario produced valid capture and protocol-level analysis artefacts across both induced and naturally occurring traffic.

The thesis concludes that a hardware-based IoT security test environment can strengthen transparency and reproducibility when real-device behaviour is studied under controlled attack conditions. AttackLab contributes as a practical experimental platform and as a methodological structure for evidence-oriented IoT security evaluation.