Twitter security is a huge mess, its former security boss charged in a whistleblower complaint — but huge security messes are all too common in the online world.

What they're saying: "Regulators, media and users of the platform will be shocked when they inevitably learn about Twitter’s severe lack of security basics," Peiter "Mudge" Zatko, who had just been fired as Twitter's security head, wrote in a report he intended to deliver to the company's board in February.

Driving the news: Zatko's complaint — filed with the Justice Department, FTC and SEC — landed with explosive force on the already high-stakes legal battleground between Twitter and Elon Musk.

Yes, but: You wouldn't have to hunt too hard to find plenty of other companies that would flunk the sort of basic scrutiny Zatko applied to Twitter's practices.

Between the lines: Many of the security issues Zatko identified in that report sound jaw-dropping, but may not be that far outside the norm. He found that:

None of that is good. But findings from SecurityScorecard — a company that studies the public online infrastructure of different online services and companies to figure out how vulnerable they are to hackers — suggest that Twitter's cybersecurity strategy is probably about average.

The big picture: Twitter's security woes are longstanding, and since 2011 it's been operating under a Federal Trade Commission consent decree requiring it to up its game.

Zatko's complaint is also being evaluated in terms of which side of the high-stakes and brightly spotlit Twitter vs. Musk legal fight will benefit.

That suggests Zatko's story is less about Musk's lawsuit and more of a classic boardroom pattern that the tech industry keeps repeating.

Alex Stamos joined Facebook as chief security officer in 2015 and quit in 2018 after the Cambridge Analytica scandal.

Be smart: Stamos' story and Zatko's are more parallel than matching — Stamos' internal conflict at Facebook was largely over fighting disinformation, not everyday security hygiene.

The bottom line: "This did not happen overnight," Zatko wrote in his report. "To get to Twitter's current state of insecurity required repeated downplaying of problems, selective reporting, and leadership ignorance around basic security expectations and practices."

The other side: A statement by Twitter CEO Parag Agrawal said that Zatko had been fired for "ineffective leadership and poor performance" and that his claims "so far" are "a false narrative that is riddled with inconsistencies and inaccuracies."