Case Study: Hoburne Brings AI Governance to 9 Sites With Control D

About Hoburne

Hoburne is a fifth-generation family business that has run holiday parks in the south of England since 1912. Today the group operates six holiday parks across Dorset, Hampshire, Devon, Somerset and the Cotswolds, alongside three golf clubs and a residential property development business. That adds up to nine sites and more than 800 employees in a wide range of roles, with some of them working remotely.

Lochie Eley, Senior IT Support Technician, supports the technology used across the group and helps strengthen its approach to cybersecurity. We spoke with him about why Hoburne added DNS filtering on top of its firewalls, how the team rolled it out, and how it now governs AI tools across the business.

The Challenge

Protection That Stopped at the Site Boundary

Hoburne already used on-site firewalls to block malicious websites and harmful content. That protection, Lochie said, "was largely limited to devices connected to our site networks, which left a gap for colleagues working from home or using devices away from our locations."

With staff spread across nine sites and working from home, a policy that only applies on the site network covers part of the workforce some of the time.

Generative AI Needed Rules That Held Everywhere

The other driver was the rapid growth of generative AI. Hoburne has an AI policy and selected Microsoft Copilot as its standard platform, but the IT team recognized that some roles would have a legitimate business case for other services.

"We wanted employees to benefit from approved AI tools while ensuring their use remained secure and aligned with our AI policy."

Blocking every AI service would cut staff off from tools the business wants them to use, and allowing everything would leave the policy unenforced. Hoburne needed broad protection on every managed device, wherever it was, with the ability to grant granular exceptions to individual devices where a request was approved.

The Solution

Why Control D

Lochie first came across Control D in his previous role at a managed service provider, where one of the customers already ran it. Finding a practical way to manage AI usage was one of his first projects at Hoburne, so Control D went on the shortlist alongside WebTitan and Cisco Security Cloud.

The alternatives either lacked functionality Hoburne needed or cost considerably more for a broader scope than the team's requirements justified. Control D offered the best balance of capability, flexibility and value.

"Control D gave us the granular policy controls we were looking for without adding unnecessary cost or complexity."

A Controlled Rollout Through Intune

Hoburne deployed Control D to a small test group through Microsoft Intune and used the trial period to evaluate it thoroughly before rolling out further. "The Intune deployment process was straightforward, and the supporting documentation was clear and comprehensive," Lochie said.

The statistics and analytics stood out early. They showed activity across the test devices and made it easy to check whether each policy was working as intended. "Barry, the built-in AI assistant, was also useful for answering product-related questions and helping us navigate the platform," he added. Setup and testing needed very little troubleshooting.

One Parent Policy, Targeted Child Policies

The capability Hoburne relies on most day-to-day is policy management, which the team built as a parent and child structure using Multiple Enforced Profiles. The parent policy is a catch-all applied to every managed device. It carries the core security and content restrictions Hoburne enforces across the group, including blocks on unapproved AI services.

Child policies handle the exceptions. When a user has a valid business need for a tool the parent policy blocks, such as ChatGPT, IT assigns a child policy to that user's device and leaves the baseline untouched.

"This layered approach keeps our baseline controls simple and consistent while allowing exceptions to be managed in a clear, targeted and auditable way."

Because Control D runs on each managed device, the same policies apply whether a laptop is at a holiday park, a golf club, or someone's home.

Support on the One Sticking Point

The only real sticking point during deployment came from Hoburne's in-house domain controllers. To keep internal resources resolving correctly, the team needed a wildcard exception for its internal domain. Once the cause was identified, Control D's support team guided them through the configuration.

"Their assistance was clear, responsive and made what could have been a more complicated problem straightforward to address."

The Results

AI Use That Follows the Policy

"Control D has given us a practical way to monitor and manage AI usage in line with our organisational policy."

Unapproved AI services are blocked by default, and approved exceptions go only to the devices that need them. The same rules hold on site and remotely, so Hoburne's AI policy is enforced on every managed device wherever staff are working.

Visibility the IT Team Didn't Have Before

The reporting has paid off beyond AI. It surfaced patterns in device and internet usage that the IT team had no view of before, giving them concrete leads to investigate and act on.

"This improved visibility means we can identify unusual or undesirable activity earlier, make policy decisions based on evidence and demonstrate that our controls are operating as intended."

That last point means IT can show the wider business that its controls work, with reporting to back it up. Lochie sums up the overall effect as significantly better oversight and more consistent policy management across the group.

A Clear Recommendation

Asked whether he'd recommend Control D, Lochie's answer was "Absolutely."

"Control D is straightforward to deploy and offers an impressive level of information, control and functionality for the cost."

He sees it as particularly well suited to organizations that need strong, consistent protection with the flexibility to carve out targeted exceptions for specific users or devices. His advice to peers is to make full use of the trial, start with a controlled test group, and take the time to learn the reporting and policy options before rolling out further.

For any organization putting an AI policy into practice, Hoburne's setup is a useful model. Everyone gets one baseline, and every exception is a deliberate, device-level decision that IT can audit.