The SEC generally applies the "Howey test"[0] when deciding is something is to be declared as a security or not. It is "a contract, transaction or scheme whereby a person invests his money in a common enterprise and is led to expect profits solely from the efforts of the promoter or a third party."
So a token from an ICO that might accumulate in value if the team delivers is a security. A pure utility token or cryptocurrency is not. This is a major reason why many ICOs shoehorn in some kind of use for their token in their platform (when they could just have used e.g. ETH for payment) in order to skirt being classified as a security.
https://en.wikipedia.org/wiki/SEC_v._W._J._Howey_Co.