@WazzaJC 

yes it should be after insert BR

The BR will copy files from parent to child only when child is getting created.

You should also update the parent field

(function executeRule(current, previous /*null when async*/ ) {
	
    new GlideSysAttachment().copy('sn_si_incident', current.parent_security_incident, 'sn_si_incident', current.sys_id);

})(current, previous);

If my response helped please mark it correct and close the thread so that it benefits future readers.