On a technical level it differs primarily on that it's not an external service that can only start responding after the website has been hacked; they treat the damage caused by a successful hack instead of preventing the hack in the first place. Because we can scan the code itself, we can actually patch vulnerabilities before they are being exploited. The beauty is in that we do not do "normal" updates but just patch the vulnerabilities in a non-obtrusive way, this prevents the website to fail because of incompatibilities.