It's likely they are using an engine based almost entirely on run-time heuristics - that is, stopping malware when it behaves suspiciously. VirusTotal does "scan-time" analysis of files where the file is never run, only checked against AVs. If they have no "traditional" signatures, they wouldn't be compatible with this method.