What's the difference between observation mode and blocking?

Observation, included on Free, shows real exploitation attempts against your running application, including the route, the CVE, the timestamp, and the source IP. Blocking stops those attempts at runtime before they succeed, closing the window between a CVE being disclosed and your team shipping a patch. Blocking isn't available on Free.

See: What Is CVE Monitoring vs. Blocking?