The buzzwords DevSecOps and ASPM (Application Security Posture Management) have increased in popularity lately. What do they actually mean, what value do they bring, where do they fit in, and why will you eventually have to care about it? When we know the What and the Why, we are left with the How. How many tools and products do you need? And how much will it cost to both train your teams and buy all those licenses? 
Constrained with not enough funds or resources, how much of this growing technology stack can utilize FOSS (free open source software) alternatives, and at the same time how should we shape our teams core competency to stop recreating the wheel in every company?