Can you check the system audit information with System,RequestAudit settings enabled. Also check the document history table for the updated content id and make sure the update is recorded.
What is the user being used to update the security group and what are permissions assigned? What happens when you update some other metadata field like comments, Is it reflecting?
You need to check your indexer state and see if its running without any issue.
go back to search it still displays old security group even after i refresh the page, re-run the search
Enable requestaudit,system* + Full verbose tracing and clear the view server output section.
Run the same test case and once completed , check the server output logs to see if any error / exception is captured.
If none, then check if the Auto Indexer is running and not stuck.
I'll setup tracing. Let's see what happens
Try bypassing the search cache to test and verify it is not a cache issue.
You can do this quickly by adding &UseSearchCache=0 to the end of your url and hitting enter.