The current (June 2018) reality:
Utility tokens are network internal tokens. Think of "steem power", for example. One of the few truly utility tokens, that is used only inside Steem platoforms to value content by a user (reader/viewer on dTube) and allow content producers to have a direct compensation, as the SteemPower can be exchanged on Steem into Steem-Dollars or the Steem currency itself, both listed on many exchanges.
Security tokens are network external tokens, that offer payments of any(?) kind (revenue, profit, dividend, etc.) and/or get listed on central exchanges (the decentralized exchanges could be seen as an agglomeration of direct interactions between two private parties and therefore not really an exchange at all - I am sure they will pose an own heavy headache to regulators once they figure them out). Keeping with the Steem project - these would be the mentioned Steem token itself and Steem-dollar, although the latter was created to have a stable value to the USD, but ... well ... stable exchange rates in free and open markets are a headache for the founders (see Tether and all others).
Currency: Native network tokens, that are generated on the specific network and traded everywhere.
Future things to clarify to & with regulators:
All tokens can be many things at the same time and/or in different times. At the same place and/or different places. Markets, communities and developers can always change their and our perception of a token.
Bitcoin was a currency. At the moment, it still is more of an asset (although we all hope, Lightning will push it back to the currency level).
Ethereum started as offer to invest by buying the tokens...so....well...a security (I know, the SEC just got its head around it, saying something different). Then Ethereum started to have its actual use case, being a utility needed to pay the computations of its virtual machine.
Then, because of its amazing potential, the value of Ethereum rose and rose...because the markets figured that dApps, SmartContracts and ERC20 tokens would generate an ecosystem on Ethereum, that gave it great value.
So people invested in Ethereum to participate in an anticipated value increase (a security), while at the very same time, developers bought and used Ethereum for their projects - hence it was also a utility at the same time.
Because of what is happening since early 2017, I think, security token need an own regulation, similar to the Crowd funding regulation. Actually, at the moment it seems good to limit funds similarly and maybe allow exceptions for foundations with clear goals in technological and/or social/biz. We need progress and probably must help the greedy pack to understand how to invest in what...I wish it was different, but 2018 has clearly proven, there is no limit for the stupidity and evil of the greedy packs - both scammy founders and filthy investors. If we cannot get rid of them, we may loose what we started this all for - decentralization, freedom and self-determination.
I my view, we therefore now need to stop acting as if the theoretically possible and needed innovations to come/forming (closed, token economic loop from founders to investors to users, allowing a new way of interacting with each other) is already the reality in practice.
It is not. Actually now, in June 2018, it seems we took a couple of steps back from where this was going...and we need to turn around and get it back on track.
I really fear, that "bending reality" in order to get an exception (e.g. this "my ICO token is one with only a utility" discussion) may lead to the complete opposite...but that's just me, myself & I. ;-)