Two possible reasons why this might occur:
1. The online scan uses Rapid Release definitions, by default SEP uses certified definitions.
2. The online scan will scan places SEP does not, like inside restore points. SEP doesn't scan inside them because a virus is inactive while in an archive, if something tried to extract it Auto-Protect would catch it at that point.