Protecting 188 Years of Brand Trust in the AI Era

The world’s longest continuously operating department store partners with Proofpoint for effective email security.

David Jones

At A Glance

David Jones, one of Australia’s most recognizable retail brands, was dealing with a large volume of phishing attacks. The 188-year-old retailer needed a layered email defense that could handle the growing threat volume, protect the brand from impersonation, and engage 5,000+ employees in its response. The company turned to Proofpoint’s email security stack and awareness platform, ZenGuide, to do all three: secure its email, its brand, and its workforce.

Products Used

  • Email Protection
  • Threat Protection
  • Human Resilience & Security Awareness

When you have different layers for your defense, you’re not just relying on one tool to help you with detection and prevention.

Sam Fariborz, Chief Information Security Officer, David Jones

Employees 

5,000

Headquarters

Melbourne, Australia
CHALLENGES

  • Defending a trendy target: After 188 years of building trust with Australian shoppers, David Jones is the kind of high-profile brand attackers try to impersonate. 

  • Modernizing for the AI era: As attackers use AI to craft sharper phishing emails, David Jones needed to train its workforce to be the next line of detection and reporting themselves. 

  • Dealing with rising threat volume: Phishing accounts for around 65% of David Jones's email threats, and 90% of those are Telephone-Oriented Attack Delivery (TOAD) attacks designed to bypass traditional detection. 

RESULTS

  • 99.95% efficacy blocking unwanted and malicious email across 15 million inbound emails over a 90-day window, with 20,000 advanced phishing, BEC, and malware threats neutralized before they reached an inbox. 

  • ZenGuide-driven workforce engagement that helped a lean security team turn 5,000+ employees into a daily line of defense, including shifting the phish button from unknown to widely-used.  

  • 98% success rate against brand impersonation attempts, with Email Fraud Defense shielding one of Australia's most-recognized domains from spoofing. 

The Challenge

When a Household Name Becomes a High-Value Target 

For 188 years, the luxury brand David Jones has been part of Australian shopping life in a way few retailers anywhere can claim. Founded in Sydney in 1838 by Welsh immigrant David Jones, it’s the longest continuously-operating department store in the world. Today, the company runs 38 physical stores across Australia and New Zealand and employs 5,000+ people. 

For Sam Fariborz, Chief Information Security Officer, that popularity comes at a cost. "Because the company has a high profile and it's a big brand, we might be targeted for too many security attacks and threats," she says. 

While David Jones himself never dealt with email threats, today’s entry method of choice for most attackers is the employee inbox. Phishing accounts for around 65% of the company’s email threats, 90% of which are Telephone-Oriented Attack Delivery (TOAD) attacks designed to bypass traditional detection. With a small security team, prioritization is critical. “We are a lean team and we cannot focus on too many activities at the same time,” Fariborz explains. 

Not to mention the Outback-sized issue of an expanding threat landscape. Attackers are now using AI to craft phishing emails that look nothing like the obvious red flags employees were once trained to recognize. "AI is a double-edged sword," Fariborz says. "It can be used to craft phishing emails that are not easy to detect with old signs of phishing." 

For a luxury retail company nearly two centuries old, it was time for a multi-layered cybersecurity makeover.

Email-related attacks are at the top of the list and the highest risk for us.

Sam Fariborz, Chief Information Security Officer, David Jones

The Solution

A Partner Trusted to Protect a Legacy  

When Fariborz joined David Jones, she was already aware of how effective Proofpoint was from previous experience. "I was familiar with the platform, and I was super happy to see Proofpoint at David Jones,” she says.  

Proofpoint’s stack has layers to it. Enterprise Email Protection, Targeted Attack Protection (TAP), Threat Response Auto-Pull, and Internal Mail Defense work together to filter, detect, remediate, and contain threats across the email environment, including lateral threats. Email Fraud Defense ensures brand protection, watching for spoofing attempts against the company’s domain and giving the team a daily handle on external impersonation attempts.  

Layered over the email defense is ZenGuide, Proofpoint’s security awareness training tool. ZenGuide deliberately engages David Jones's workforce, modelling phishing simulations on real-world patterns and giving every employee a phish button they can use to rapidly flag suspicious messages. The before-and-after has been dramatic. "When I started, nobody knew that button was there," Fariborz says. Now the workforce has fully adopted it.  

The partnership comes with another perk Fariborz values highly: the Proofpoint Academy. This education platform gives her a structured way to onboard new members of her security team. "The platform is great, especially for new analysts joining us,” she says. "I love that the training gets updated." 

For a lean team in a fast-moving threat landscape, Proofpoint Academy is an effective way for David Jones to stay ahead of the latest attack vectors and patterns. 

The Results

Results Fit for a Luxury Retailer 

Across a 90-day window, Proofpoint analyzed more than 15 million inbound emails for David Jones and blocked unwanted and malicious traffic at 99.95% efficacy. About 11.6 million messages were neutralized. And 20,000 advanced phishing, BEC, and malware threats—the kind designed to slip past basic filters—were stopped at a rate of roughly 1,600 advanced threats every week.  

The platform's reporting gives Fariborz the dashboards she needs to brief the business with confidence. This includes heat maps of threat trends over time, benchmarks against other retailers, and insight into the most-attacked people in the organization to inform targeted security awareness work. 

On the brand-protection side, Email Fraud Defense is delivering at a 98% success rate, blocking impersonation attempts against a domain Australians have trusted for generations. For a CISO whose company's reputation is part of its competitive advantage, that metric is doing both technical and strategic work.  

Through ZenGuide-driven security awareness, the team has turned the phish reporting button into a regular habit. Those who would not have engaged with security at all two years ago now actively flag suspicious mail. Employees are no longer an easy target; they have become a dynamic line of defense alongside the platform. 

Fariborz has laid the foundation for a future where security accelerates the workforce and allows the brand to keep doing what it does best—connect shoppers to luxury finds and unique items they love. "Security teams don't want to be a department of no. We want to be an enabler, helping the company thrive," she says. 

In luxury retail, trust is the brand. With the help of Proofpoint, David Jones is making sure it stays that way.