A coin is considered a security if it satisfies all three prongs of the Howey Test: https://en.wikipedia.org/wiki/SEC_v._W._J._Howey_Co.

    1. Someone invests their money
    2. In a common enterprise
    3. With the expectation of profits from efforts of a third party

This is a boolean and statement--all three cases must be true for it to be a security.

As an example of how the SEC interprets these three prongs in application to cryptocurrencies, read their statement on the DAO: https://www.sec.gov/litigation/investreport/34-81207.pdf

If the SEC takes enforcement action against a token, the case would go to the courts, and then the courts would be responsible for deciding if the SEC's interpretation of the Howey Test is valid or not.