In cyber security, formulation is the way a capability is assembled and delivered: the mix of components, the packaging, and the channel used to get it into the target environment. A control can be technically sound in one formulation and weak in another. For example, the same detection logic may behave differently when shipped as an endpoint agent, a cloud service, or a mail gateway rule.
Formulation matters because attackers and defenders both rely on it. Criminals often change the formulation of phishing kits, malware droppers, or packed payloads to evade filters, sandboxing, and signature checks. Defenders do the opposite by refining the formulation of security products and policies so they are harder to bypass and easier to deploy. Good security usually depends on both the ingredients and the delivery method, not just the idea itself.