Yes, the security group that is being used by multiple EC2 instances can be modified. The changes will be implemented immediately and be applied to all the previously running EC2 instances without restarting the instances