Security starts when IRCC sends a request to the National Security Screening Division (NSSD) and screening partners. However, for inland CEC applicants the security is a very quick process as most applications only go though a record check and not a comprehensive screening. To read on record check vs comprehensive screening, see
In your case, most likely the issue seems that no one has worked on the application. Also, check if your eligibility is conclusively passed, or just has a note from an analyst or assistant. Only after the eligibility is conclusively passed, will the security be initiated. See my previous post on this at
Have you requested your GCMS notes? Since you are an inland applicant you can request your GCMS notes through either IRCC or CBSA yourself via the ATIP portal <>
To read on GCMS notes from CBSA vs IRCC
The GCMS notes will let you know when was the last time your application was worked on. Many applications are in the same state as yours where they have been sitting for months and no one has touched them.
Hope this helps!