Import updated report from one environment to another environment, but modified security to reports doesn't updated in new environment.

That is the way Appian works. As stated in the documentation (forum.appian.com/.../Application_Deployment_Guidelines.html

"When importing an object that already exists on the target server (identified by UUID), the resulting role map contains a union of the users/groups between what's on the target server and what's listed in the import package."

If you are trying to remove groups from the security role map the removal has to be done in the target environment too so that the union mentioned above doesn't result in both groups.

In summary, every time you do an import the security rolemap from SOURCE and TARGET is merged using the union operation for each role, there are no deletions using the import, deletions need to be explicitly done on the TARGET too.

That is the way Appian works. As stated in the documentation (forum.appian.com/.../Application_Deployment_Guidelines.html

"When importing an object that already exists on the target server (identified by UUID), the resulting role map contains a union of the users/groups between what's on the target server and what's listed in the import package."

If you are trying to remove groups from the security role map the removal has to be done in the target environment too so that the union mentioned above doesn't result in both groups.

In summary, every time you do an import the security rolemap from SOURCE and TARGET is merged using the union operation for each role, there are no deletions using the import, deletions need to be explicitly done on the TARGET too.