A cyber attack is a "matter of when, not if", with a global average of between 100 and 250 attacks per second, a new report says.

Kordia's annual Cyber Security Report indicated New Zealand businesses were often unprepared to adequately respond to a cyber attack, with many under-reporting incidents, as well as ransom payments made to recover stolen data.

While 10 percent of NZ businesses said they had paid a ransom demand over the past year, the statistic was out of line with the global average of between 50 and 60 percent, which indicated the rate of company ransom payouts was much higher than one in 10.