The SEC follows a principle called the 'Howey Test' to identify whether something is actually a security. Essentially, they look at the substance of a thing, rather than whatever it happens to be called, to identify whether something is a security.

I'm not a lawyer, so here is a link to more detailed information about the Howey Test:

https://consumer.findlaw.com/securities-law/what-is-the-howey-test.html

Utility tokens are tokens that pass the test and are not considered securities by the SEC. Security tokens are tokens that fail the test and are considered securities. The reason that it's so important is that any ICO that doesn't register properly as a security and follow the rules that is found to fail the test can have all of its US assets seized. Even if they are offshore, there are treaties in place that con still result in effective action being taken against them in many jurisdictions.

For an investor, it becomes a rather perilous minefield. Anything where you will 100% get rich if the project 100% succeeds is probably a security token, whereas anything with a legit utility token could potentially succeed 100% with the token not ever rising in value at all.