the first rule of deception imho is that it needs to deceive the threat actor, and you should assume that the threat actor has done enough recon to know what makes sense and what stands out in an environment. If you have a canary in a file about a project that doesn't exist or use an external "canarytokens.com" domain the document, that might be a low quality decoy. Tools to automate deployment, maintenance and alerting/integration (SIEMS,etc..) are much more useful.

If your company is making deception software, then you already know that Microsoft, Google and similar companies are your competition if your strategy is to do what they do, but I'm sure you've already strategized around all this.