Merging the security function into DevOps won't happen overnight, but it's a vital step and the barriers aren't as high as sometimes believed