My imm consultant did ordered AITP for both of us. Security not started doesn't really mean it is about to start security check as most applicants never gone through security check while it shows "not started".How many ATIP GSMC you ordered? You need order GSMC for BOTH of you. Security check is launched for normaly 1 out of 2 applicants, as a rule for those with a more complex background.
P.S As CSIS is a different organization and sometimes IRCC does not update information in a timely manner. Security check rarely takes more than a year, usually ~6-11 months after eligibility.