Security and forensic printing are needed to connect a physical object to the infrastructure—servers, databases, services, etc.—that is necessarily deployed for the “downstream” aspects of an anti-counterfeiting ecosystem. These aspects include investigation (secret shopping, evidence gathering, and analytics) and prosecution. For many branded products, including those of our company, the overwhelming majority of counterfeit goods are produced by a few large-scale counterfeiting operations. Therefore, an effective security and forensic printing campaign will be targeted at discovering the presence of counterfeiting in the supply chain as fast as possible, determining the size of each counterfeiter, and prioritizing the evidentiary and prosecution plans to eliminate the largest counterfeiters as fast as possible. This paper addresses the factors to be considered in successfully defining an effective security and forensic printing campaign, and early approaches to modeling and simulation of an overall ecosystem to optimize the campaign. Broadly, the following topics are of importance: (1) cost function; (2) input parameters; (3) devices available for deployment; and (4) system outputs. We also discuss the manner in which the solution can be deployed for products with widely different supply chain, counterfeiting and distribution requirements.