Is deception technology actually useful for detecting attackers, or is it just another layer of alerts?

A cybersecurity professional is seeking input on the practical value of deception technology (decoy servers, honeytokens, fake credentials) in real security environments. They want to understand whether these tools can provide sufficient telemetry to analyze attacker behavior, identify reconnaissance or lateral movement, and whether they are practical for smaller security teams and MSSPs to manage. The poster specifically asks for experiences from those who have deployed platforms like Thinkst Canary, Dentigrid, or FortiDeceptor, or built custom honeypots, and whether deception technology actually improved detection and incident response in production environments.