That frugality is what enabled insurers to come through the recession less bruised than the banking industry, asserts Carney.

“What I mean by [inspired frugality] is the insurance industry, when it came to replacing [any] technology, decided to use it up, wear it out, and make do,” she says. If tools still were working, insurers stayed with them, even if the tools had reached the end of their depreciation life.

That strategy will not last much longer, predicts Carney. “I think there is going to be a catch-up when the market definitely turns around and carriers take [replacement projects] off the back burner,” she says.

At that point, however, which kind of security will be the focus seems unclear–insurers have not shown interest in investing in any specific security technology, in Carney's view. “[Insurers] are in the midst of upgrading core applications, and they are moving [processes] online,” she says.

Fraud identification also falls into the security risk area, adds Carney, as well as identity management, vulnerability management, and data security. “These are all areas [insurers] need to invest in,” she contends.

Banks have more security issues to deal with than insurers simply because banks are where the money is, notes Carney. “Security threats around insurance involve identity theft, fraud, data theft, and those kinds of things,” she says

Banks are bearing the brunt of the attention from regulators on online security issues, points out Carney. “[Insurers] lagged the banks in terms of moving online by six or seven years,” she says. “The same kinds of [security tools] banks bought a few years ago are what insurance carriers are implementing. Anything to secure that online transaction is a key investment right now.”